feat: requires OAuth-only auth mode for MCP agents #12
Reference in New Issue
Block a user
Delete Branch "feature/mcp-oauth-oidc"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Remove the oauth_or_token fallback mode from MCP authentication.
MCP now supports only oauth for production agent connections and token for legacy/local static-token access. In oauth mode, MCP_TOKEN is no longer accepted, so external agents must use a valid OAuth/OIDC JWT access token with the required scope.
Update env examples and documentation to recommend MCP_AUTH_MODE=oauth, add a dedicated MCP OAuth README, and cover the new behavior with tests.