We are using @platformatic/mcp@2.2.0 as an OAuth resource server and found three gaps in the published implementation.
-
TokenValidator validates signature and optional audience but does not constrain iss or require sub and exp. Configure the existing fast-jwt verifier with allowedIss: config.authorizationServers and require ["sub", "iss", "exp"].
-
/mcp creates sessions without persisting the verified subject. A second valid OAuth user can reuse a first user’s session ID and receive its stored authorization context. Persist the verified context when creating the session, and reject an existing session when its owner differs from request.tokenPayload.sub.
-
mcpAddResource({ uriPattern }) accepts a template, but resources/read only performs an exact map lookup. A concrete URI such as guardrails://support/request/req-123 therefore returns METHOD_NOT_FOUND. Match registered template placeholders with slash-bounded parameters before returning not-found.
I can provide the small compiled-dist patch and reproduction tests if useful. Related Redis error-listener work is tracked separately in #59.
We are using @platformatic/mcp@2.2.0 as an OAuth resource server and found three gaps in the published implementation.
TokenValidatorvalidates signature and optional audience but does not constrainissor requiresubandexp. Configure the existingfast-jwtverifier withallowedIss: config.authorizationServersand require["sub", "iss", "exp"]./mcpcreates sessions without persisting the verified subject. A second valid OAuth user can reuse a first user’s session ID and receive its stored authorization context. Persist the verified context when creating the session, and reject an existing session when its owner differs fromrequest.tokenPayload.sub.mcpAddResource({ uriPattern })accepts a template, butresources/readonly performs an exact map lookup. A concrete URI such asguardrails://support/request/req-123therefore returnsMETHOD_NOT_FOUND. Match registered template placeholders with slash-bounded parameters before returning not-found.I can provide the small compiled-dist patch and reproduction tests if useful. Related Redis error-listener work is tracked separately in #59.