feat(mcp): per-user scope restrictions for BasicAuth mode - #628

Open

tkaufmann wants to merge 16 commits into

cbcoutinho:masterfrom

tkaufmann:feat/basic-auth-scopes

Commits on Mar 11, 2026

fix(mcp): escape XML-interpolated values to prevent injection
tkaufmann
committed
8ca2ac5
fix(mcp): add path traversal protection for WebDAV paths
tkaufmann
committed
d4d6bc3
fix(mcp): use defusedxml to prevent XML entity expansion
tkaufmann
committed
1884441
fix(mcp): prevent open redirect via next parameter
tkaufmann
committed
e7d2a4a
fix(mcp): run containers as non-root user
tkaufmann
committed
2217ba2
fix(mcp): use sharing:read scope for read-only sharing tools
tkaufmann
committed
a394a99
fix(mcp): secure SSL verification defaults
tkaufmann
committed
e867002
fix(mcp): add SSRF protection for user-provided URLs
tkaufmann
committed
06f0480
feat(mcp): parse BASIC_AUTH_SCOPES from environment
tkaufmann
committed
c93e9af
feat(mcp): inject synthetic AccessToken for scoped BasicAuth users
tkaufmann
committed
d51a623
feat(mcp): enable tool filtering for BasicAuth scopes
tkaufmann
committed
66db091
feat(mcp): add scope checks to MCP resource handlers
tkaufmann
committed
d79780b
docs(mcp): document BasicAuth scopes configuration
tkaufmann
committed
3e49a93
fix(mcp): update lockfile for defusedxml dependency
tkaufmann
committed
8fb609a
merge: lockfile fix from security-hardening
tkaufmann
committed
f1ede20
fix(docker): include full package directory in build context
tkaufmann
committed
dffbafd