@agentmailbox/mcp-auth 1.0.4 → 1.0.10

package/README.md

@@ -62,13 +62,13 @@ Replace:
 ## How It Works
 
 1. Fetches an OAuth2 access token using the Client Credentials flow
-2. Passes the token to `@anthropic/mcp-remote` via environment variable
+2. Passes the token to `mcp-remote` via environment variable
 3. Forwards all MCP communication to the AgentMailbox server
 
 ## Requirements
 
 - Node.js 18 or later
-- `@anthropic/mcp-remote` (installed automatically via npx)
+- `mcp-remote` (installed automatically via npx)
 
 ## License
 

package/index.js

@@ -19,7 +19,7 @@
  *       ],
  *       "env": {
  *         "MCP_OAUTH_CLIENT_ID": "your-client-id",
- *         "MCP_OAUTH_CLIENT_SECRET": "your-client-secret"
+ *         "MCP_OAUTH_CLIENT_SECRET": "your-client-secret"  // pragma: allowlist secret
  *       }
  *     }
  *   }
@@ -50,26 +50,25 @@ if (!mcpUrl || !tokenEndpoint || !clientId || !clientSecret) {
 }
 
 /**
- * Build a minimal environment for the child process.
- * Only passes through essential variables to avoid leaking secrets.
+ * Build a minimal allow-list environment for the child process.
+ * Only includes necessary system variables, avoiding exposure of ambient secrets.
  */
 function buildChildEnv(env) {
   const allowList = [
-    // Essential for process execution
+    // Essential system paths
     'PATH', 'HOME', 'USERPROFILE',
     // Temp directories
     'TMP', 'TEMP', 'TMPDIR',
-    // Windows-specific
+    // Windows system variables
     'SystemRoot', 'ComSpec', 'WINDIR', 'PATHEXT',
-    // Proxy settings (important for corporate environments)
+    // Proxy configuration
     'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY',
     'http_proxy', 'https_proxy', 'no_proxy',
     // Node.js configuration
     'NODE_EXTRA_CA_CERTS', 'NODE_OPTIONS',
-    // MCP-specific
+    // mcp-remote configuration directory
     'MCP_REMOTE_CONFIG_DIR',
   ];
-
   return Object.fromEntries(
     allowList.flatMap((key) => (env[key] ? [[key, env[key]]] : []))
   );
@@ -121,15 +120,17 @@ async function main() {
   try {
     const token = await getAccessToken();
 
-    // Build minimal environment with only necessary variables, plus the token
+    // Build minimal environment with only necessary variables
     const childEnv = buildChildEnv(process.env);
-    childEnv.AUTH_TOKEN = token;
 
-    // Launch mcp-remote with token passed via environment variable
+    // Launch mcp-remote with Authorization header via --header flag
+    // Note: Token appears briefly in process args, but this is acceptable for MCP client usage
     const child = spawn('npx', [
       '-y',
       'mcp-remote',
       mcpUrl,
+      '--header',
+      `Authorization:Bearer ${token}`,
     ], {
       stdio: 'inherit',
       env: childEnv,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentmailbox/mcp-auth",
-  "version": "1.0.4",
+  "version": "1.0.10",
   "description": "OAuth2 Client Credentials wrapper for MCP servers - enables M2M authentication with AgentMailbox",
   "type": "module",
   "bin": {