OAuth authorization bridge for the authority role (0.6.0) - #6

Merged

Azdaroth merged 11 commits into

oauth-authorization-bridge

Jul 17, 2026

Commits on Jul 17, 2026

Harden the bridge, and let native MCP clients connect (RFC 8252)

Azdaroth
and
claude
committed
Accept only loopback unnamed; a scheme denylist fails open

Azdaroth
and
claude
committed
Stop the code being the key; fix four defects an independent review found

Azdaroth
and
claude
committed
Trim the round's comments to what only the code can say

Azdaroth
and
claude
committed
Make the config surface a gate, not a suggestion

Azdaroth
and
claude
committed
Say why the signing-secret minimum spares the secret_key_base fallback

Azdaroth
and
claude
committed