[v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource - #3451
Merged
Claude / Claude Code Review
completed
Sep 5, 2026 in 7m 53s
Code review found 2 important issues
Found 7 candidates, confirmed 4. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 2 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/mcp/server/auth/provider.py:36 |
Conditional on a provider-mode (combined AS+RS) server enabling the new flag: RefreshToken.resource is read nowhere — |
| 🔴 Important | src/mcp/server/auth/middleware/bearer_auth.py:94 |
The gate accepts only an exact URL match with 'resource_server_url', but the SDK's resource policy elsewhere is hierarch |
| 🟡 Nit | examples/servers/simple-auth/mcp_simple_auth/token_verifier.py:77 |
The aud entry "naming this server" is picked with a raw 'a.rstrip("/") == own' string compare, weaker than the normalize |
| 🟡 Nit | examples/servers/simple-auth/mcp_simple_auth/server.py:78 |
Hard-coding validate_token_resource=True makes RFC 8707 checking unconditional, so the example's documented --oauth-stri |
Loading