Claude
a73af353d4
Harden server; add authenticated Streamable HTTP transport and Nix module
- Streamable HTTP transport (MCP_TRANSPORT=http) with mandatory auth:
static bearer tokens or OIDC resource-server mode (JWT via JWKS, or
RFC 7662 introspection), RFC 9728 protected-resource metadata, and
DNS-rebinding protection
- secrets loadable from files via *_FILE variants
- timeouts on all outbound requests; JORTT_READ_ONLY tool filtering
- OpenAPI spec committed and bundled; no implicit network fetches
- Nix flake: sandboxed package build + hardened NixOS module taking an
EnvironmentFile (agenix-friendly)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>