Jeremy Rose 250b5ea2bf Bind MCP OAuth refresh tokens to their issuer (#39615) ...

## Why

An authorization server discovered for an MCP server can change. A stored refresh token must not be sent to a different issuer than the one that originally granted it.

## What changed

- Persist the discovered authorization server issuer with new OAuth credentials and preserve it across refreshes.
- Validate that issuer against a single pinned metadata snapshot before refreshing or adopting stored refresh credentials.
- Require reauthentication when refresh credentials have no issuer or the issuer changed. An unexpired access token can still be used without exposing its refresh token.

## Testing

Add coverage for issuer persistence, missing and changed issuers, metadata changes during startup, and refresh-token preservation.

GitOrigin-RevId: 07e48ba892f627428a28bbed5cca4ad703e2a5fd

2026-08-20 06:25:17 +00:00

..

src

Bind MCP OAuth refresh tokens to their issuer (#39615)

2026-08-20 06:25:17 +00:00

tests

Bind MCP OAuth refresh tokens to their issuer (#39615)

2026-08-20 06:25:17 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Harden MCP OAuth fallback credential writes (#39611)

2026-08-20 06:17:48 +00:00