refactor(keycardai-mcp): drop deprecated bearer middleware shims (ACC-235)#104
Merged
Merged
Conversation
…-235) Removes the keycardai.mcp.server.middleware re-export shims that pointed at the deprecated BearerAuthMiddleware in keycardai-starlette. Anyone importing BearerAuthMiddleware should switch to AuthenticationMiddleware with backend=KeycardAuthBackend(verifier) and on_error=keycard_on_error. The deprecated symbols themselves stay in keycardai-starlette and come out in ACC-237. keycardai-agents repointed at keycardai.starlette.middleware.bearer so it keeps building. It still emits the DeprecationWarning shipped in keycardai-starlette 0.3.0; that goes away when ACC-232 archives the package. Bearer-helper unit tests (_get_bearer_token, _get_oauth_protected_resource_url) moved from packages/mcp/tests to packages/starlette/tests where the helpers live.
📦 Release PreviewThis analysis shows the expected release impact: 📈 Expected Version Changes📋 Package Details[
{
"package_name": "keycardai-mcp",
"package_dir": "packages/mcp",
"has_changes": true,
"current_version": "0.22.0",
"next_version": "0.23.0",
"increment": "MINOR"
}
]📝 Changelog PreviewThis comment was automatically generated by the release preview workflow. |
jerriclynsjohn
approved these changes
Apr 27, 2026
kamil-keycard
approved these changes
Apr 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Drops the
keycardai.mcp.server.middlewarere-export shims that pointed atBearerAuthMiddleware(and the_get_bearer_token/_get_oauth_protected_resource_urlhelpers) in keycardai-starlette. After this PR:from keycardai.mcp.server.middleware import BearerAuthMiddlewareno longer works. The canonical import isfrom keycardai.starlette import KeycardAuthBackend(used withstarlette.middleware.authentication.AuthenticationMiddleware).pip install keycardai-mcpconsumers stop seeing the DeprecationWarning shipped in keycardai-starlette 0.3.0 (feat(keycardai-starlette): emit DeprecationWarning from legacy bearer surface #99).Why
#97 introduced these shims so keycardai-mcp and keycardai-agents could keep building during the bearer-middleware migration. #99 added a runtime
DeprecationWarning. The runtime path inside keycardai-mcp itself already routes throughkeycardai.starlette.routers.metadata.protected_router, which uses the new pattern (AuthenticationMiddleware + KeycardAuthBackend), so the only remaining work for keycardai-mcp was dropping the dead re-exports.Notes for the reviewer
packages/mcp/src/keycardai/mcp/server/auth/provider.pyas a place to migrate. That file does not directly instantiateBearerAuthMiddleware; it goes throughprotected_mcp_router, which delegates to keycardai-starletteprotected_router. No edits there.packages/agents/src/keycardai/agents/server/app.pyis repointed atkeycardai.starlette.middleware.bearerso it keeps building. agents will continue to emit the DeprecationWarning until ACC-232 archives the package; that is intentional.packages/mcp/tests/keycardai/mcp/server/middleware/test_bearer.pytopackages/starlette/tests/keycardai/starlette/middleware/test_bearer.py, following the helpers themselves into keycardai-starlette.routers/metadata.pyre-export shim in keycardai-mcp is left in place. It is independent of the bearer-middleware shim and can be cleaned up in a separate follow-up.Breaking change
Yes, for any consumer who imports from
keycardai.mcp.server.middleware. The deprecation has been emitted from keycardai-starlette 0.3.0 since #99 merged. The import path was never documented as canonical. Auto-bump should take keycardai-mcp 0.21.x to 0.22.0 on merge.Test plan
cd packages/starlette && uv run --extra test pytestpasses (includes the ported bearer helper tests)cd packages/mcp && uv run --extra test pytestpassescd packages/agents && uv run --extra test pytestpasses (the DeprecationWarnings are expected, see notes above)uv run ruff checkfrom repo root passesgrep -rn "keycardai.mcp.server.middleware" --include="*.py"from the repo root returns zero hitsFollow-ups
keycardai/mcp/server/routers/metadata.pyand updateprovider.pyto importprotected_routerfrom keycardai-starlette directly. Out of scope here.