fix: warn callers not to truncate the #t= temp-token fragment on MCP inline-auth links

[MarcusPeng]

Summary

When MCPEnableTempTokenAuth is on, per-user MCP auth flows (OAuth and headers) mint a one-time temp token embedded as a #t=<token> URL fragment on the auth link returned to the caller. Fragments never reach the server, so the token can't leak into access logs or get forwarded as a Referer header — but an AI agent relaying the link to a human frequently drops everything after the #, treating it as a non-essential anchor, which breaks the link.

Changes

• Added schemas.MCPAuthURLHasTempTokenFragment and schemas.MCPAuthTempTokenReminder
• Wired them into the inline-auth Message wherever it's built (per-user OAuth resolver, per-user headers resolver, bifrost-http's MCP server tool-call error path), only appending the reminder when the URL actually carries the #t= fragment
• Added unit tests covering both resolvers and the fragment-detection helper

Type of change

• Bug fix

Affected areas

• Core (Go)
• Transports (HTTP)

How to test

go test ./core/schemas/... ./core/mcp/credstore/... ./transports/bifrost-http/handlers/...

Breaking changes

• Yes
• No

Security considerations

None — the fragment was already never sent to the server; this only changes the accompanying human-readable message text.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 20bf855e-62d0-4ff1-9e81-ac27b11700fa

📥 Commits

Reviewing files that changed from the base of the PR and between e78c2d0 and d755477.

📒 Files selected for processing (1)

• core/changelog.md

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • MCP authentication-required messages now conditionally include a reminder to keep the #t= temporary-token fragment when copying or sharing inline-auth links.
  • The reminder is shown only when the returned authorization URL contains a temp-token fragment, reducing unnecessary prompts.

• Documentation

  • Added changelog entries documenting the #t= truncation warning behavior.

• Tests

  • Added coverage for temp-token–aware authentication-required messaging across relevant MCP connection paths.

Walkthrough

Changes

The MCP auth flow now detects #t= fragments in authorization URLs and appends a temp-token handling reminder to per-user credential and HTTP tool authentication errors. Shared schema logic and tests cover fragment detection and message behavior.

MCP temp-token auth reminders

Layer / File(s)	Summary
Auth URL reminder contract core/schemas/mcp.go, core/schemas/mcp_test.go	Adds the shared reminder constant and MCPAuthURLHasTempTokenFragment helper, with cases covering matching, absent, alternate, and empty fragments.
Credential resolver messages core/mcp/credstore/per_user_headers.go, core/mcp/credstore/per_user_headers_test.go, core/mcp/credstore/per_user_oauth.go, core/mcp/credstore/per_user_oauth_test.go	Per-user headers and OAuth authentication-required errors conditionally include the reminder, with provider-backed tests for URLs with and without #t= fragments.
HTTP tool auth message transports/bifrost-http/handlers/mcpserver.go, transports/changelog.md, core/changelog.md	MCP tool authentication errors conditionally include the reminder, and changelog entries document the temp-token fragment behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPClient
  participant perUserOAuthResolver
  participant MCPAuthURLHasTempTokenFragment
  participant MCPToolHandler
  MCPClient->>perUserOAuthResolver: Request connection headers
  perUserOAuthResolver->>MCPAuthURLHasTempTokenFragment: Check authorize URL
  MCPAuthURLHasTempTokenFragment-->>perUserOAuthResolver: Fragment present or absent
  perUserOAuthResolver-->>MCPClient: MCPAuthRequiredError with conditional reminder
  MCPClient->>MCPToolHandler: Execute MCP tool
  MCPToolHandler->>MCPAuthURLHasTempTokenFragment: Check auth URL
  MCPAuthURLHasTempTokenFragment-->>MCPToolHandler: Fragment present or absent
  MCPToolHandler-->>MCPClient: Tool error with conditional reminder

Loading

Possibly related PRs

• maximhq/bifrost#3656: Modifies per-user OAuth authentication-required message construction.

Suggested reviewers: akshaydeo, danpiths, roroghost17

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: adding a warning about the #t= temp-token fragment on MCP inline-auth links.
Description check	✅ Passed	The description follows the required template and covers the summary, changes, testing, affected areas, breaking changes, and security notes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
core/schemas/mcp.go	Adds the temp-token reminder text and the shared fragment-detection helper.
core/mcp/credstore/per_user_oauth.go	Adds the reminder to OAuth auth-required messages when the authorize URL includes the temp-token fragment.
core/mcp/credstore/per_user_headers.go	Adds the reminder to headers auth-required messages when the submission URL includes the temp-token fragment.
transports/bifrost-http/handlers/mcpserver.go	Adds the same reminder to MCP server tool-call auth errors when the selected auth URL includes the temp-token fragment.
core/schemas/mcp_test.go	Adds tests for temp-token fragment detection.
core/mcp/credstore/per_user_oauth_test.go	Adds tests for OAuth resolver reminder behavior.
core/mcp/credstore/per_user_headers_test.go	Adds tests for headers resolver reminder behavior.

_{Reviews (2): Last reviewed commit: "Merge branch 'dev' into 07-11-fix_mcp_au..." | Re-trigger Greptile}