modelcontextprotocol / modelcontextprotocol/typescript-sdk
Auth : Allow user provided routes to escape Auth middleware
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.4k
- Forks
- 2.2k
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 4
Description
Describe the bug
When hosted in k8, we need to provide liveness and healthcheck urls. But In case we implement mcp auth middleware, there is no provision to escape these routes. So K8 pods will crash loop due to auth issue and never come up.
Allow user provided routes to passthrough requireBearerAuth middleware.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the requireBearerAuth middleware entry point and trace how incoming routes are matched. Determine how user-provided liveness and healthcheck routes can bypass authentication while other routes remain protected; done means those routes work without bearer credentials and authenticated routes still enforce the middleware.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100