feat(mcp): configurable transport host/Origin allowlist#397

Merged

gbrlcustodio merged 23 commits into

devfrom

feat/303-transport-host-allowlist

Jul 14, 2026

Commits on Jul 13, 2026

feat(mcp): derive a configurable transport host/Origin allowlist
gbrlcustodio
committed
docs(mcp): document the transport host/Origin allowlist
gbrlcustodio
committed
refactor(mcp): reuse optional_str in the allowlist normalizer
gbrlcustodio
committed
refactor(mcp): move ResourceServer into the auth module
gbrlcustodio
committed
refactor(mcp): build_resource_server_auth consumes ResourceServer
gbrlcustodio
committed
refactor(mcp): wire the resource server once in the runtime
gbrlcustodio
committed
refactor(mcp): order required builder kwarg before the defaulted one
gbrlcustodio
committed
fix(pr-review): honor an explicit empty origin allowlist
gbrlcustodio
committed
refactor(mcp): split for_profile into per-profile builders
gbrlcustodio
committed
refactor(mcp): resolve the inbound issuer at the composition root
gbrlcustodio
committed
refactor(mcp): rename ResourceServer.host_forms to host_authorities
gbrlcustodio
committed
refactor(mcp): move outbound session identity into auth
gbrlcustodio
committed
refactor(mcp): import auth contracts through the package facade
gbrlcustodio
committed

Commits on Jul 14, 2026