Skip to content

feat: provide MCP-compatible OAuth client authorization for headless agents #114

Description

@seonghobae

Buyer gap

LineageWeave MCP clients need a supported non-password credential path without creating a second application-owned identity, issuance, revocation, and audit system.

Product boundary

Keyverse remains the authorization server and identity authority. LineageWeave remains an OAuth protected resource and accepts only resource-bound access tokens issued by Keyverse. Do not add LineageWeave-managed long-lived bearer keys.

Acceptance criteria

  • Publish and test OAuth authorization-server metadata and OIDC discovery for MCP clients.
  • Support a public-client authorization-code flow with PKCE and exact redirect URI validation.
  • Support MCP client registration through a reviewed standards-compatible mechanism when required by clients.
  • Issue access tokens bound to the exact LineageWeave MCP resource indicator and requested least-privilege scopes.
  • Preserve centralized revocation, deprovisioning, audit, and account policy in Keyverse.
  • Evaluate RFC 8628 device authorization only for clients that cannot complete a browser callback; do not implement it speculatively.
  • Add real browser/client integration evidence and negative tests for wrong issuer, audience, scope, redirect URI, expired token, and revoked account.
  • Add an ADR and doctoring references in APA 7th style before implementation.

Standards basis

LineageWeave linkage

This replaces the architectural direction attempted by LineageWeave PRs #333 and #334. ADR 0109 already rejects a static MCP API key because it creates a second identity and revocation system.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: apiAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationarea: dataDatabase, schema, migration, ETL, or lineagearea: securitySecurity boundary, hardening, or vulnerability preventionpriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: featureNew or expanded product capability

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions