Let a token verifier gate the server without AuthSettings - #3292
Open
maxisbey wants to merge 1 commit into
Open
Claude / Claude Code Review
completed
Sep 4, 2026 in 12m 20s
Code review found 2 potential issues
Found 2 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 1 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/mcp/server/lowlevel/server.py:781 |
'streamable_http_app' silently ignores 'auth_server_provider' when 'auth' is None, and this change widens the masked sha |
| 🟣 Pre-existing | src/mcp/server/lowlevel/server.py:813 |
Pre-existing, security-relevant: lowlevel 'streamable_http_app(auth=..., token_verifier=None)' builds a fail-open app |
Loading