systemprompt-mcp 0.44.0

Native Model Context Protocol (MCP) implementation for systemprompt.io. Orchestration, per-server OAuth2, RBAC middleware, and tool-call governance — the core of the AI governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

//! MCP request authentication helpers.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

use crate::error::{McpDomainError, McpDomainResult};
use systemprompt_models::auth::{JwtAudience, JwtClaims};
use systemprompt_security::AuthError;
use systemprompt_security::jwt::{ValidationPolicy, decode_rs256_claims};

pub fn validate_jwt_token(
    token: &str,
    issuer: &str,
    audiences: &[JwtAudience],
) -> McpDomainResult<JwtClaims> {
    let policy = ValidationPolicy::issuer_scoped(issuer, audiences);
    decode_rs256_claims(token, &policy).map_err(|e| classify_auth_error(e, issuer))
}

fn classify_auth_error(error: AuthError, issuer: &str) -> McpDomainError {
    if error.is_issuer_mismatch() {
        return McpDomainError::TokenIssuerMismatch {
            expected: issuer.to_owned(),
        };
    }
    McpDomainError::TokenRejected(error)
}