Update mcp-auth and mcp-authz policy versions

[Thenujan-Nagaratnam]

• Resolves: [Bug]: MCP authentication with Claude #3445

This pull request updates the versions of two policy dependencies in the gateway/build-manifest.yaml file. These updates ensure that the project uses the latest features and fixes from the upstream policy modules.

Dependency updates:

• Upgraded the mcp-auth policy from version v1.2.1 to v1.3.0.
• Upgraded the mcp-authz policy from version v1.1.1 to v1.2.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: b4d29217-8064-4afb-91a6-96c3e0e12fdd

📥 Commits

Reviewing files that changed from the base of the PR and between 6585ad1 and 4738d42.

📒 Files selected for processing (3)

• gateway/it/features/mcp_policies.feature
• gateway/it/steps/http_steps.go
• gateway/it/test-config.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The gateway updates MCP policy versions and adds integration coverage for gatewayurl precedence. MCP requests now apply the configured host. Authentication challenges and protected-resource metadata use the configured gateway URL.

Changes

MCP gateway URL configuration

Layer / File(s)	Summary
Update MCP policy versions gateway/build-manifest.yaml	Updates mcp-auth to v1.3.0 and mcp-authz to v1.2.0.
Validate gateway URL resolution gateway/it/test-config.toml, gateway/it/steps/http_steps.go, gateway/it/features/mcp_policies.feature	Defines gatewayhost and gatewayurl, applies the configured host to MCP requests, and verifies gatewayurl in mcp-auth and mcp-authz challenges and metadata.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 4738d

The configured gateway URL behavior has no established merge-blocking risk in the available evidence.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the dependency updates and references the related issue, but it omits most required template sections, including Approach, User stories, Documentation, Automation tests, Secur…	Complete the required sections in the repository template. Describe the implementation approach, affected user stories, documentation impact, unit and integration test coverage, security checks, samples, related pull requests, and test envi…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: updating the mcp-auth and mcp-authz policy versions.
Linked Issues check	✅ Passed	The linked issue requires MCP authentication to use the configured external gateway URL and authentication flow instead of a gateway or localhost URL [#3445]. The PR updates mcp-auth to v1.3.0 and…
Out of Scope Changes check	✅ Passed	The changed integration test configuration, MCP request host handling, and policy scenarios support [#3445]. They enable tests to send the configured host and verify gatewayurl precedence over the d…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Description check

Explanation

The description explains the dependency updates and references the related issue, but it omits most required template sections, including Approach, User stories, Documentation, Automation tests, Security checks, Samples, Related PRs, and Test environment.

Resolution

Complete the required sections in the repository template. Describe the implementation approach, affected user stories, documentation impact, unit and integration test coverage, security checks, samples, related pull requests, and test environment. Mark non-applicable sections with N/A and a brief explanation.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

---

_{Comment @coderabbitai help to get the list of available commands.}

[Thenujan-Nagaratnam]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[RakhithaRR]

We cannot ignore the default scenario. We have to validate both scenarios through tests

[Thenujan-Nagaratnam]

Since it is a system parameter, in order to do that we have to bring another test stack with a different config.toml. Not sure whether it is worth doing just to check this behavior only.

Also this is covered in the policy's unit tests.