Skip to main content

Module mcp_auth

Module mcp_auth 

Source
Expand description

Per-thread MCP bearer-token registry.

The remote app-server is a single process shared by many client sessions and configures its MCP servers once at startup (a process-wide token). To let a remote client scope a thread’s MCP tool calls to a specific identity (for Vex: a per-user-and-organization capability token), the client forwards the token at thread/start; the app-server records it here keyed by thread id, and the MCP tool extension reads it during execution via crate::tools::ToolExecutionContext::thread_id.

Lives in roder-api so both the app-server (writer) and MCP tool extension (reader) can reach it without depending on one another. The map is in-memory only: tokens are re-supplied by the client on the next thread/start, and they are expected to be short-lived capability tokens.

Functions§

clear_thread_token
Forgets any token recorded for thread_id (e.g. on archive).
set_thread_token
Records the MCP bearer token a remote client supplied for thread_id. An empty token is ignored (treated as “use the process default”).
thread_token
The MCP bearer token to use for thread_id, if one was registered.