feat(guardrails): MCPJWTSigner - built-in guardrail for zero trust MCP auth#23897

Merged

ishaan-jaff merged 22 commits intolitellm_ishaan_march_17from

worktree-fluttering-sleeping-cookie

Mar 18, 2026

Commits on Mar 17, 2026

Allow pre_mcp_call guardrail hooks to mutate outbound MCP headers
noahnistler
committed
Enhance MCPServerManager to support hook-modified arguments and extra headers. Update tests to validate argument mutation and header injection behavior, including warnings for OpenAPI-backed server…
noahnistler
committed
Refactor MCPServerManager to raise HTTPException for extra headers in OpenAPI-backed servers. Update tests to reflect this change, ensuring proper exception handling instead of logging warnings.
noahnistler
committed
Allow pre_mcp_call guardrail hooks to mutate outbound MCP headers

noahnistler
authored and
ishaan-jaff
committed
Enhance MCPServerManager to support hook-modified arguments and extra headers. Update tests to validate argument mutation and header injection behavior, including warnings for OpenAPI-backed server…

noahnistler
authored and
ishaan-jaff
committed
Refactor MCPServerManager to raise HTTPException for extra headers in OpenAPI-backed servers. Update tests to reflect this change, ensuring proper exception handling instead of logging warnings.

noahnistler
authored and
ishaan-jaff
committed
feat(guardrails): add MCPJWTSigner built-in guardrail for zero trust MCP auth
ishaan-jaff
committed
Update MCPServerManager to raise HTTPException with status code 400 for extra headers in OpenAPI-backed servers. Adjust tests to verify the correct status code and exception message.
noahnistler
committed
fix: address P1 issues in MCPJWTSigner
ishaan-jaff
committed
docs: add MCP zero trust auth guide with architecture diagram
ishaan-jaff
committed
merge: resolve conflicts from PR #23889
ishaan-jaff
committed
docs: add FastMCP JWT verification guide to zero trust doc
ishaan-jaff
committed
fix: address remaining Greptile review issues (round 2)
ishaan-jaff
committed
fix: address Greptile round 3 feedback
ishaan-jaff
committed
feat(mcp_jwt_signer): add verify+re-sign, claim ops, two-token model, configurable scopes
ishaan-jaff
committed
feat(mcp_jwt_signer): add verify+re-sign, claim ops, two-token model, configurable scopes (core)
ishaan-jaff
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(guardrails): MCPJWTSigner - built-in guardrail for zero trust MCP auth#23897

feat(guardrails): MCPJWTSigner - built-in guardrail for zero trust MCP auth#23897
ishaan-jaff merged 22 commits intolitellm_ishaan_march_17from
worktree-fluttering-sleeping-cookie

Commits on Mar 17, 2026

Allow pre_mcp_call guardrail hooks to mutate outbound MCP headers

Enhance MCPServerManager to support hook-modified arguments and extra headers. Update tests to validate argument mutation and header injection behavior, including warnings for OpenAPI-backed server…

Refactor MCPServerManager to raise HTTPException for extra headers in OpenAPI-backed servers. Update tests to reflect this change, ensuring proper exception handling instead of logging warnings.

Allow pre_mcp_call guardrail hooks to mutate outbound MCP headers

Enhance MCPServerManager to support hook-modified arguments and extra headers. Update tests to validate argument mutation and header injection behavior, including warnings for OpenAPI-backed server…

Refactor MCPServerManager to raise HTTPException for extra headers in OpenAPI-backed servers. Update tests to reflect this change, ensuring proper exception handling instead of logging warnings.

feat(guardrails): add MCPJWTSigner built-in guardrail for zero trust MCP auth

Update MCPServerManager to raise HTTPException with status code 400 for extra headers in OpenAPI-backed servers. Adjust tests to verify the correct status code and exception message.

fix: address P1 issues in MCPJWTSigner

docs: add MCP zero trust auth guide with architecture diagram

merge: resolve conflicts from PR #23889

docs: add FastMCP JWT verification guide to zero trust doc

fix: address remaining Greptile review issues (round 2)

fix: address Greptile round 3 feedback

feat(mcp_jwt_signer): add verify+re-sign, claim ops, two-token model, configurable scopes

feat(mcp_jwt_signer): add verify+re-sign, claim ops, two-token model, configurable scopes (core)

Commits on Mar 18, 2026

fix(mcp_jwt_signer): address pre-landing review issues

docs(mcp_zero_trust): rewrite as use-case guide covering all new JWT signer features

fix(mcp_jwt_signer): wire all config.yaml params through initialize_guardrail

docs(mcp_zero_trust): add hero image

docs(mcp_zero_trust): apply Linear-style edits

fix(mcp_jwt_signer): fix algorithm confusion attack + add OIDC discovery 24h TTL