Skip to content

v2.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jun 07:19
· 76 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.0.0
23981c4

What's Changed

BREAKING CHANGES

  • MCP_PROXY_AUTH_STATE_SECRET is now required when the authorize proxy is active (scope filtering, CIMD, or standalone iss interception). Existing deployments must add this variable — generate with openssl rand -hex 32.
  • MCP_PROXY_AUTH_ALLOWED_REDIRECT_URIS is now required for non-CIMD-only deployments. Configure allowed MCP client redirect URI patterns (see README for known client patterns).
  • token_endpoint in well-known metadata is now rewritten to the adapter's URL when the authorize proxy is active (was only for CIMD).
  • Upstream IdP client must register {MCP_BASE_URL}/authorize/callback as an allowed redirect URI.

Features

  • RFC 9207 iss parameter compliance — intercepts upstream IdP authorization responses to provide correct issuer identification, preventing mix-up attack rejections by MCP clients enforcing the 2026-07-28 MCP Auth Spec Draft
  • Unified token proxy — /token is now always proxied when the authorize proxy is active, handling redirect_uri rewriting for authorization code grants
  • Zero-downtime secret rotation via MCP_PROXY_AUTH_STATE_SECRET_PREVIOUS
  • Configurable state blob TTL via MCP_PROXY_AUTH_STATE_TTL_MINUTES (default 30 min)
  • Shared URI security validation — tightened redirect_uri checks (control chars, userinfo rejection) across DCR and authorize endpoints

Full Changelog: v1.0.1...v2.0.0

Assets 3
Loading