[joshrotenberg]

Closes #270. Part of #268.

Ordinary MCP credentials could manage backends and read management state, and scoped bearer tokens inherited HTTP administration through the fallback chain. HTTP and MCP management now require the dedicated security.admin_token. Without it, management is disabled. Empty, invalid, or reused static management credentials fail validation, including after programmatic configuration/environment preparation.

Administrators initialize separate MCP sessions with the management credential. Management tools, prompts, resources, templates, and completions are partitioned from ordinary backend capabilities; ordinary discovery helpers remain available. A private verified HTTP identity crosses into MCP through the explicit extension bridge. Session ownership distinguishes static credentials and management authority, while OAuth ownership uses issuer/subject or issuer/client ID. Authenticated OAuth callers without either identity cannot initialize a session. POST, GET/SSE, and DELETE cannot reuse another identity’s session.

Management dispatch bypasses backend policies, caching and coalescing, while both paths share configured audit/access logs, metrics and the global rate limit. Ordinary calls are guarded before shared caches and at backend dispatch to stop indirect access. proxy/call_tool cannot target the proxy namespace, including recursively. The remaining search target authorization work stays in #271.

Breaking behavior: deployments using open administration or bearer fallback must configure a dedicated admin token. Admin MCP credentials expose management capabilities only; use ordinary credentials for backend operations. Updated API/operator documentation, architecture guidance, Helm notes, and Docker example probe commands describe this behavior.

Validation

All six mandatory checks passed:

• Formatting and all-target/all-feature Clippy with warnings denied.
• 321 unit tests, 136 integration tests, 24 doctests; no failures or ignored tests.
• All-feature documentation with warnings denied.

The new configured-application suite exercises explicit/absent management credentials, ordinary/scoped callers, denied mutations without side effects, authorized backend/config/session operations, session replay and termination, custom separators, search-wrapper/composite indirection, and management prompts/resources. Four management integration tests also pass with all default features disabled. Unit regressions cover claim spoofing, credential collisions, completion/template privacy, and the shared global rate limit. Real Redis/SQLite integration tests and the existing credential-redaction regressions passed.

No dependency or version changes. Keep the reviewed tower-mcp Git pin. Releases remain on hold; tower-mcp will be released first when mcp-proxy is ready.

Manual review of pushed head 541c0157d25a3ff4818005716c8a31a3d6dc3df5 found no blocking issues. Reviewed authority provenance, missing/colliding credentials, session ownership, all capability lists and invocation paths, indirect calls, cache/coalescing isolation, shared observability/rate limiting, no-OAuth operation, and release compatibility. Merge remains gated on GitHub CI.