Claude
|
a73af353d4
|
Harden server; add authenticated Streamable HTTP transport and Nix module
- Streamable HTTP transport (MCP_TRANSPORT=http) with mandatory auth:
static bearer tokens or OIDC resource-server mode (JWT via JWKS, or
RFC 7662 introspection), RFC 9728 protected-resource metadata, and
DNS-rebinding protection
- secrets loadable from files via *_FILE variants
- timeouts on all outbound requests; JORTT_READ_ONLY tool filtering
- OpenAPI spec committed and bundled; no implicit network fetches
- Nix flake: sandboxed package build + hardened NixOS module taking an
EnvironmentFile (agenix-friendly)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
2026-07-11 19:10:55 +02:00 |
|