Harden MCP request limits, key lifecycle, and connection guides - #7

Merged

ruibaby merged 15 commits into

mainfrom

fix/mcp-security-hardening

Aug 25, 2026

Commits on Aug 25, 2026

Defer contributed tool permission checks until key authorization passes
ruibaby
committed
85e8f26
Rate limit MCP requests by canonical client address
ruibaby
committed
6f21b6d
Revalidate MCP access keys after password verification
ruibaby
committed
f38446a
Enforce MCP request timeout and in-flight concurrency limits
ruibaby
committed
b54349a
Budget in-flight attachment upload bytes
ruibaby
committed
594eff9
Keep MCP access tokens out of client connection guides
ruibaby
committed
0c5a110
Parse MCP client addresses without DNS resolution
ruibaby
committed
d4eaafd
Reserve exact decoded bytes for attachment uploads
ruibaby
committed
3646e19
Forget limiter keys whose counts return to zero
ruibaby
committed
1d9030b
Release in-flight permits when handler assembly fails
ruibaby
committed
330952a
Serialize limiter accounting within each key's map bin
ruibaby
committed
32edef5
Bound MCP authentication by the request deadline
ruibaby
committed
45b681c
Simplify MCP in-flight limit accounting
ruibaby
committed
fcccb3c
Fix MCP authentication filter bean creation
ruibaby
committed
d0160c9
Clarify access key warning text
ruibaby
committed
8dfd3e6