feat(mcp): Add session state-based JWT token propagation for MCP tools#3675

Open

timof1308 wants to merge 21 commits intogoogle:mainfrom

timof1308:feature/secure-token-handling

Commits on Jan 26, 2026

feat: implement secure token handling via request_state
timof1308
committed
feat: Add warning for non-primitive state values that may not serialize correctly into headers.
timof1308
committed
refactor: Introduce `HeaderProvider` type and modularize header generation logic in MCP tools.
timof1308
committed
feat: Add strict mode to `create_session_state_header_provider` to raise errors for non-primitive types and skip empty string values.
timof1308
committed
feat: Introduce `state_header_strict` config for strict state header type validation and add a test.
timof1308
committed
applied autoformat.sh
timof1308
committed
feat: Add RFC 7230 compliant header validation and sanitization
timof1308
committed
refactor: add future annotations import to types and internal modules.
timof1308
committed
refactor: Publicize header name validation, refine header name regex, and update header value sanitization to target control characters.
timof1308
committed
applied autoformat.sh
timof1308
committed
applied ./autoformat.sh
timof1308
committed
apply autoformat after rebase
timof1308
committed
test(mcp): Fix Mock InvocationContext to include request_state
timof1308
committed
Fix test_fast_api.py mocks to match new run_async signature
timof1308
committed
apply autoformat.sh
timof1308
committed
fix(mcp): Remove duplicate create_session_state_header_provider
timof1308
committed
docs: Clarify `ReadOnlyContext.state` property as `MappingProxyType` with `ChainMap` details, refine `request_state` initialization, and remove an unused header regex
timof1308
committed
docs: update `ReadOnlyContext.state` to use `MappingProxyType` with an improved docstring
timof1308
committed
Remove the `_HEADER_NAME_FORBIDDEN` constant
timof1308
committed
remove unused import of `get_mcp_auth_headers`
timof1308
committed
fix: apply pyink 25.12.0 formatting to 2 files
timof1308
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(mcp): Add session state-based JWT token propagation for MCP tools#3675

feat(mcp): Add session state-based JWT token propagation for MCP tools#3675
timof1308 wants to merge 21 commits intogoogle:mainfrom
timof1308:feature/secure-token-handling

Commits on Jan 26, 2026

feat: implement secure token handling via request_state

feat: Add warning for non-primitive state values that may not serialize correctly into headers.

refactor: Introduce `HeaderProvider` type and modularize header generation logic in MCP tools.

feat: Add strict mode to `create_session_state_header_provider` to raise errors for non-primitive types and skip empty string values.

feat: Introduce `state_header_strict` config for strict state header type validation and add a test.

applied autoformat.sh

feat: Add RFC 7230 compliant header validation and sanitization

refactor: add future annotations import to types and internal modules.

refactor: Publicize header name validation, refine header name regex, and update header value sanitization to target control characters.

applied autoformat.sh

applied ./autoformat.sh

apply autoformat after rebase

test(mcp): Fix Mock InvocationContext to include request_state

Fix test_fast_api.py mocks to match new run_async signature

apply autoformat.sh

fix(mcp): Remove duplicate create_session_state_header_provider

docs: Clarify `ReadOnlyContext.state` property as `MappingProxyType` with `ChainMap` details, refine `request_state` initialization, and remove an unused header regex

docs: update `ReadOnlyContext.state` to use `MappingProxyType` with an improved docstring

Remove the `_HEADER_NAME_FORBIDDEN` constant

remove unused import of `get_mcp_auth_headers`

fix: apply pyink 25.12.0 formatting to 2 files