Skip to content

v0.2.6 — Literal OAuth scopes and bounded MCP requests

Choose a tag to compare

View all tags
@FloKnapp FloKnapp released this 10 Oct 09:46
· 3 commits to main since this release
v0.2.6
37689dd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OAuth scopes now match literally in MCP authorization. A grant for notes:* or * no longer authorizes unrelated tool scopes; registered file-token identities retain their wildcard behavior. Current user permissions and the registry's OR semantics are preserved.

MCP JSON requests are read with a configurable size limit before decoding. mcp:transport:max_request_bytes defaults to 1 MiB; oversized requests return HTTP 413. Configure a positive integer if your application needs a different limit, and keep proxy/PHP input limits appropriate for the host.

Regression checks cover authenticated listing/calling, file-token compatibility, partial request streams and the HTTP boundary. Package tests passed on PHP 8.3, 8.4 and 8.5, with style and Composer validation. Applications using OAuth should also update naf/oauth-server to 0.2.5 or later.

Assets 2
Loading