Skip to content

feat: provide MCP-compatible OAuth client authorization for headless agents #114

Description

@seonghobae

Buyer gap

LineageWeave MCP clients need a supported non-password credential path without creating a second application-owned identity, issuance, revocation, and audit system.

Product boundary

Keyverse remains the authorization server and identity authority. LineageWeave remains an OAuth protected resource and accepts only resource-bound access tokens issued by Keyverse. Do not add LineageWeave-managed long-lived bearer keys.

Acceptance criteria

  • Publish and test OAuth authorization-server metadata and OIDC discovery for MCP clients.
  • Support a public-client authorization-code flow with PKCE and exact redirect URI validation.
  • Support MCP client registration through a reviewed standards-compatible mechanism when required by clients.
  • Issue access tokens bound to the exact LineageWeave MCP resource indicator and requested least-privilege scopes.
  • Preserve centralized revocation, deprovisioning, audit, and account policy in Keyverse.
  • Evaluate RFC 8628 device authorization only for clients that cannot complete a browser callback; do not implement it speculatively.
  • Add real browser/client integration evidence and negative tests for wrong issuer, audience, scope, redirect URI, expired token, and revoked account.
  • Add an ADR and doctoring references in APA 7th style before implementation.

Standards basis

LineageWeave linkage

This replaces the architectural direction attempted by LineageWeave PRs #333 and #334. ADR 0109 already rejects a static MCP API key because it creates a second identity and revocation system.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: apiAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationarea: dataDatabase, schema, migration, ETL, or lineagearea: securitySecurity boundary, hardening, or vulnerability preventionbugSomething isn't workingenhancementNew feature or requestpriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behaviortype: featureNew or expanded product capability

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions