feat(mcp): Add session state-based JWT token propagation for MCP tools#3675

Open

timof1308 wants to merge 8 commits into

google:mainfrom

timof1308:feature/secure-token-handling

Commits on May 17, 2026

feat: add ephemeral request_state for secure token handling
timof1308
committed
feat(mcp): add state-to-header propagation with RFC 7230 validation
timof1308
committed
test: add tests for request_state and header propagation
timof1308
committed
fix: remove duplicate credential_key shorthand after upstream merge
timof1308
committed
fix: add missing Apache 2.0 license header to test_readonly_context_state.py
timof1308
committed
fix(mcp): harden header handling and add config validation
timof1308
committed
fix(mcp): sanitize headers in McpTool for consistency with McpToolset
timof1308
committed
fix(mcp): consolidate header sanitization and clean up review findings
timof1308
committed