[theaspirational]

Stacked on the direct-write lane PR (and through it on #5 and #4): the lane is what gives a verified identity something to write. The diff shows the lower commits until they merge; merge in order and nothing conflicts.

stdio is one process per agent session on one machine. okfy-mcp serve --http is one long-running process on a host, serving the same seven tools to every client, each seeing the others' writes on its next call. Two access models, eight commits in the order they were needed.

One shared token

• The token is read from a file, never a flag; missing, unreadable or short refuses to start (E_MCP_HTTP_TOKEN). A request without the header is 401 with the documented envelope (E_MCP_UNAUTHORIZED) before the MCP layer sees it.
• Stateless, JSON responses, no Session trace: one process serves everyone, so observed is absent rather than attesting one client's reads to another's write.
• Plain HTTP on loopback by default. TLS is a reverse proxy's job; --public-url names the host that proxy presents, so the SDK's DNS-rebinding guard accepts it.

Identities from an OpenID issuer

• --oidc-issuer <url> --oidc-audience <client id>: every request carries a JWT from that issuer, checked against its published keys (RS256, iss, aud, exp). Discovery is read once at start, so a wrong issuer refuses to start (E_MCP_OIDC_ISSUER) instead of failing every request. The SDK's middleware answers 401/403 and the protected-resource metadata is served by okfy-mcp itself (okfy:read, okfy:write, offline_access advertised, okfy:read alone required), so an MCP client can find where to log in and ask for the right scopes.
• Under a token, okfy_write and okfy_propose record the token's sub as the actor and ignore the client's own claim: the first place an actor string is a verified identity rather than a declaration. An issuer that serves several agent apps for one human may set an okfy_actor claim (claude:alice, codex:alice); it wins over sub.
• --oidc-issuer repeats: an Authentik puts each registered client under its own issuer path, and one bundle serves several clients. --oidc-issuer-prefix trusts the clients an issuer registered itself (dynamic client registration): discovery on first sight, signature checked, audience not.
• --oidc-write-group: the scope says what the client may do for the user, the group says what the user may do. A guest whose client asked for okfy:write still reads only (E_MCP_FORBIDDEN, nothing written).
• --oidc-read-group: closes the bundle to everyone the issuer does not list in that group; outside it every scope is withheld and the request is answered 403, nothing served. One issuer can then serve several bundles, each to its own people, behind one login.
• Two field fixes: the JWKS fetch names itself (User-Agent: okfy-mcp; a CDN in front of the issuer answered urllib's stock agent with 403, so every token was refused while discovery at start had passed), and a refused token logs its reason, never the token.

Tests

adapters/mcp/tests/test_http.py runs the server against a stub issuer that mints real RS256 tokens: wrong issuer, wrong audience, expired, unknown key and the old shared token never reach a tool; a read-only token searches but cannot write; several issuers on one bundle; a self-registered client under a trusted prefix; the write group outranking the scope; and the ledger naming the signed subject, not the typed actor.

🤖 Generated with Claude Code

[vsov]

Thank you! This is integrated into the source tree and published in a0517dd ("Unreleased: audit fixes A1-A10 and contributed PRs #4-#8"). Your commits were cherry-picked with authorship kept; this repository is an export of the source, so the PR itself is closed rather than merged. Your tests live in the source tree, which the export does not ship.

Follow-ups from a security read: prefix-mode discovery fetches only plain path segments under the prefix (../, %2e%2e, ?, # reached other paths before any signature check); failed discovery and unknown kid cached for 60 s; groups matched exactly (a string was a substring test); no fallback to the client's actor without a verified token; token identities must be one printable line; refused-token log uses repr; websocket scopes closed under the shared token; PyJWT, httpx, anyio, uvicorn, starlette and pydantic declared.

See CHANGELOG.md ## Unreleased for the full entry.