Module bearer_scope 

Per-token tool scoping for bearer token authentication.

When scoped bearer tokens are configured, this module provides:

• An Axum middleware that identifies which scoped token was used and injects scope info via TokenClaims into request extensions.
• An MCP middleware that reads scope info from extensions and enforces tool allow/deny lists per token.

Architecture

tower-mcp’s HTTP transport only bridges TokenClaims from Axum extensions to MCP extensions. To pass bearer scope info across this boundary, the Axum middleware inserts synthetic TokenClaims with scope details in the extra map (key: __bearer_scope).

The MCP-level BearerScopingService reads this marker and applies the matching token’s allow/deny rules.

Structs

BearerScopingService

MCP middleware that enforces per-bearer-token tool access control.

ScopedBearerAuthLayer

Axum middleware layer that validates bearer tokens and injects scope info.

ScopedBearerAuthService

Axum service that validates bearer tokens and injects scope info.