Split from #144 (OWASP MCP07). Not dispatchable: needs secret provisioning.
Gap
chassisauth.BearerMiddleware(mcpToken, ...) accepts one static token, and the OAuth client_credentials endpoint (cmd/server/main.go, POST /oauth/token) hands out that same token. Every client — Claude Code on koala, claude.ai connector, Crush — has the same identity. Consequences: the #144 audit line can't tell them apart (except static vs JWT), and revoking a leaked token breaks every client at once.
Wanted
Server accepts a set of named static tokens (e.g. MCP_TOKENS = name:op-ref entries via ESO), principal = name.
OAuth endpoint issues a client-specific token, not the shared one.
brain_edit_root's static-principal gate keeps working — decide which named principals count as "local static" (probably only local-cli). That gate is control code: rule 8 review.
Per-client 1Password items + ExternalSecret in mathias/infra; .mcp.json in mathias/skills updated per harness.
Done when
Two clients connected at once log different principals in the #144 audit line, and revoking one leaves the other working.
Split from #144 (OWASP MCP07). Not dispatchable: needs secret provisioning.
## Gap
`chassisauth.BearerMiddleware(mcpToken, ...)` accepts one static token, and the OAuth `client_credentials` endpoint (`cmd/server/main.go`, `POST /oauth/token`) hands out that same token. Every client — Claude Code on koala, claude.ai connector, Crush — has the same identity. Consequences: the #144 audit line can't tell them apart (except static vs JWT), and revoking a leaked token breaks every client at once.
## Wanted
- Server accepts a set of named static tokens (e.g. `MCP_TOKENS` = `name:op-ref` entries via ESO), principal = name.
- OAuth endpoint issues a client-specific token, not the shared one.
- `brain_edit_root`'s static-principal gate keeps working — decide which named principals count as "local static" (probably only `local-cli`). That gate is control code: rule 8 review.
- Per-client 1Password items + ExternalSecret in `mathias/infra`; `.mcp.json` in `mathias/skills` updated per harness.
## Done when
Two clients connected at once log different principals in the #144 audit line, and revoking one leaves the other working.
---
_Created via git-mcp on behalf of @mathias_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Split from #144 (OWASP MCP07). Not dispatchable: needs secret provisioning.
Gap
chassisauth.BearerMiddleware(mcpToken, ...)accepts one static token, and the OAuthclient_credentialsendpoint (cmd/server/main.go,POST /oauth/token) hands out that same token. Every client — Claude Code on koala, claude.ai connector, Crush — has the same identity. Consequences: the #144 audit line can't tell them apart (except static vs JWT), and revoking a leaked token breaks every client at once.Wanted
MCP_TOKENS=name:op-refentries via ESO), principal = name.brain_edit_root's static-principal gate keeps working — decide which named principals count as "local static" (probably onlylocal-cli). That gate is control code: rule 8 review.mathias/infra;.mcp.jsoninmathias/skillsupdated per harness.Done when
Two clients connected at once log different principals in the #144 audit line, and revoking one leaves the other working.
Created via git-mcp on behalf of @mathias