>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #1001
Update issue details
Title *
Description
EARS: When a tenant re-registers an MCP server name with a different URL, the system shall drop the stored token unless a new one is supplied. When tools.mcp.call resolves an auth_secret_path, it shall send the token only to the URL registered with that secret. FOUND in #924 review (L6): api/mcp_registry.py POST upserts url and keeps tenants/<t>/mcp_<name> when auth_token is omitted; tools.mcp.call accepts any server_url with any auth_secret_path of the same tenant, so a workflow of that tenant can send the stored token to another URL. Bind: store the registered URL with the token (or look it up in highway.mcp_servers) and compare before sending.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel