Marc-André Bombeck 3c6cb8b08d fix(mcp): record why a client fails to resolve at /authorize ...

CIMD client resolution swallowed every fetch failure as ssrf_blocked and
/authorize logged a bare invalid event, so an unreachable metadata host
was indistinguishable from a genuine SSRF block and the consent flow
returned invalid_client with no diagnosable cause.

Split the resolution failure into ssrf_blocked (a real private-host
refusal) and fetch_failed (timeout / connect error), carrying the
concrete SafeFetchError kind and cause as a short non-secret detail.
Thread the resolution reason and detail into the authorize.invalid
annotation behind a pinned meta shape, and cache a resolved CIMD
document for up to 24h so the consent flow does not re-fetch on every
hit.

2026-06-28 15:18:12 +02:00

..

connections

fix(mcp): close OAuth 2.1 resource-server gaps before the remote surface ships

2026-06-27 15:09:11 +02:00

oauth

fix(mcp): record why a client fails to resolve at /authorize

2026-06-28 15:18:12 +02:00

tokens

feat(mcp): allow minting and consenting to health:write connector tokens

2026-06-27 17:38:51 +02:00