cybercove-labs/shared-memory
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): CLI tokens minted at /connect for containerized MCP clients

Browse Source 
Adds a second token kind alongside Authentik OIDC access tokens for MCP
authentication. When the user visits /connect after signing into the Web
UI, the server mints an HMAC-signed JWT (kid="cli-v1") carrying their
Authentik identity in oidc_iss / oidc_sub claims. The token is shown
once in React state — never put in the URL or persisted on the client.

The MCP endpoint's bearer-token verifier dispatches by JWT `kid` header:
CLI tokens are verified locally via HS256(CLI_TOKEN_SECRET); everything
else goes through Authentik JWKS. Both paths resolve to the same
AuthenticatedClaims shape so userContextFromClaims handles them
identically.

This unblocks MCP clients running in containers where the OAuth loopback
callback isn't reachable — paste the token into Claude Code as a static
Authorization header and skip the OAuth flow entirely.

Revocation in v1 is "rotate CLI_TOKEN_SECRET to invalidate every issued
CLI token at once." Per-token revocation can come later if needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
shadowdao
2026-05-15 08:36:11 -07:00
co-authored by Claude Opus 4.7
parent 7ab6dfe6f6
commit 2bd8ea705d
7 changed files with 262 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+7
View File
@@ -59,6 +59,13 @@ EMBEDDING_DIM=384
# -----------------------------------------------------------------------------
NEXTAUTH_SECRET=replace-me-with-32-bytes-of-random
# -----------------------------------------------------------------------------
# CLI token signing key. Used to mint HMAC-signed JWTs from /connect for
# pasting into MCP clients (Claude Code etc.). Rotate to invalidate all
# outstanding CLI tokens at once. Generate with: openssl rand -base64 32
# -----------------------------------------------------------------------------
CLI_TOKEN_SECRET=replace-me-with-32-bytes-of-random
# -----------------------------------------------------------------------------
# App
# -----------------------------------------------------------------------------