5 commits

Author	SHA1	Message	Date
Jeremiah Lowin	3522a98766	Migrate to MCP Python SDK v2 (#4437)	2026-07-06 17:36:45 -04:00
Jeremiah Lowin	67527c1f69	Block unsafe OAuth redirect schemes (#4419)	2026-07-05 17:16:10 -04:00
Jeremiah Lowin	7fb037f20c	Harden OAuth Proxy silent consent against AS-in-the-middle (#3960)	2026-04-17 16:39:50 -04:00
Jeremiah Lowin	6aff9c94be	Remove form-action from default consent CSP, forward consent_csp_policy in all providers ... Drop form-action from the default Content Security Policy on the OAuth consent page. Chrome enforces form-action across the entire redirect chain, which breaks flows where an HTTPS callback internally redirects to a custom scheme (e.g. claude://, cursor://). Since the form posts to itself and all redirects are server-controlled, form-action adds no security value here. Also forward the consent_csp_policy parameter through all concrete OAuth providers (Auth0, Azure, Google, GitHub, Discord, WorkOS, AWS Cognito, OCI) so users can override the CSP without accessing private attributes.	2026-03-03 14:55:00 -05:00
Jeremiah Lowin	610551c7b6	Split large test files to comply with loq line limit (#3328)	2026-02-28 11:21:11 -05:00