MCP client: credential-source seam for refreshing short-lived bearer tokens
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 152
- Forks
- 16
- Avg merge
- 14h 48m
- Merged PRs (30d)
- 536
Description
Gap. MCP auth headers are captured once at connect (internal/adapter/mcp); reconnect (ADR 0056) reuses the same static headers. A run outliving a short-lived per-run token (schedulers mint 5–10m identities; k8s projected SA tokens are kubelet-refreshed on disk) loses access mid-run with no re-mint path.
What
- A credential-source seam for MCP server auth: re-read per request or on reconnect/401 — a file-based source covers k8s projected-token auto-refresh; env stays for static tokens.
- 401/403 → one credential re-read + retry before failing the tool call.
- Preserve the existing redirect hardening (no Authorization forwarding on cross-host redirects).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in internal/adapter/mcp and read ADR 0056 alongside the connect and reconnect authentication flow. Trace how static headers are captured and how redirect handling is enforced. Done means supporting file-based and environment credentials, refreshing once on reconnect or 401/403 before retrying, and preserving the no-cross-host-Authorization rule.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100