@kya-os/mcp-i-cloudflare 1.13.2 → 1.13.4

package/README.md

@@ -332,14 +332,18 @@ The framework includes built-in CSRF (Cross-Site Request Forgery) protection for
 
 #### Configuration
 
-CSRF protection is automatically enabled when `DELEGATION_STORAGE` KV namespace is configured. Optional token encryption can be enabled by setting `OAUTH_ENCRYPTION_SECRET`:
+CSRF protection is automatically enabled when `DELEGATION_STORAGE` KV namespace is configured.
+
+**`OAUTH_ENCRYPTION_SECRET` is REQUIRED.** It was previously optional (token encryption only), but the consent auth-gate fix made every check that depends on it **fail closed**: CSRF validation, CSRF token minting, and identity-assertion mint/verify all refuse rather than degrade when it is unset. A worker without it will **403 every delegation mint and 500 the credential render** — the consent flow does not work at all.
+
+Set it as a **secret**, not a committed var:
 
 ```bash
-# wrangler.toml
-[env.production.vars]
-OAUTH_ENCRYPTION_SECRET = "your-encryption-secret-here"
+wrangler secret put OAUTH_ENCRYPTION_SECRET
 ```
 
+Both surfaces resolve to `env.OAUTH_ENCRYPTION_SECRET`, so a `[vars]` entry does satisfy the runtime — but it commits the value to source control, so prefer `wrangler secret put` (or your platform's secret store). Managed deployments have this provisioned automatically; see `docs/security/consent-approve-gate-verification.md`.
+
 #### Backward Compatibility
 
 If `OAuthSecurityService` is not available (e.g., `DELEGATION_STORAGE` not configured), the framework falls back to base64-encoded state parameters. This maintains backward compatibility but provides less security. **For production deployments, always configure `DELEGATION_STORAGE`.**

package/dist/agent.d.ts

@@ -236,6 +236,11 @@ export declare abstract class MCPICloudflareAgent extends McpAgent {
     /**
      * Build tool execution context with IDP token (Phase 1 - MH-7)
      *
+     * @param delegationAuthorizationType - The stored authorization type of the
+     *   presented delegation (from `getDelegationFromStorage`), or undefined for
+     *   legacy records. Used by the delegation-only fallbacks below to reject a
+     *   delegation whose type does not satisfy the tool's required type (security
+     *   fix: consent-approve auth-gate, Task B3).
      * @private
      */
     private buildToolContext;
@@ -329,6 +334,7 @@ export declare abstract class MCPICloudflareAgent extends McpAgent {
         delegationId: string;
         userDid?: string;
         agentDid: string;
+        authorizationType?: string;
     }): Promise<void>;
     /**
      * Retrieve delegation from DO internal storage
@@ -352,6 +358,7 @@ export declare abstract class MCPICloudflareAgent extends McpAgent {
         delegationId: string;
         userDid?: string;
         agentDid: string;
+        authorizationType?: string;
         storedAt: number;
     } | undefined>;
     /**

package/dist/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAe9C,OAAO,EAYL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAStC,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAoBnC;;GAEG;AACH,MAAM,WAAW,qBACf,SAAQ,IAAI,CACV,aAAa,EACX,aAAa,GACb,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,oBAAoB,GACpB,YAAY,CACf;IACD,CAAC,GAAG,EAAE,MAAM,GACR,WAAW,GACX,MAAM,GACN,kBAAkB,GAClB,sBAAsB,GACtB,SAAS,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,mBAAoB,SAAQ,QAAQ;IAGxD,MAAM,EAGA,GAAG,CAAC;IAEV,SAAS,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAC1C,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACrC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC9C,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,mBAAmB,CAAC,CAAS;IACrC,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,wBAAwB,CAAC,CAAS;IAC1C,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,cAAc,CAAC,CAAgB;gBAGrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,qBAAqB,EAC1B,gBAAgB,GAAE,iBAA2C;IAkG/D;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB9B;;;OAGG;YACW,uBAAuB;IA8GrC;;;;;;;;;OASG;YACW,wBAAwB;IA0BtC;;;;;;;;;;;;OAYG;YACW,wBAAwB;IA6GtC;;;OAGG;YACW,8BAA8B;IAmG5C;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAC7B;QACE,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,SAAS,CACZ;IAID;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI9D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM;IAEzC;;;OAGG;IACH,SAAS,CAAC,eAAe,IAAI,MAAM;IAInC;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,SAAS;IAI5C;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAIrE;;;OAGG;IACH,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAIrE;;;;;;;OAOG;IACH,SAAS,KAAK,qBAAqB,IAAI,OAAO,CAE7C;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,wBAAwB,CACzC,GAAG,EAAE,aAAa,GACjB,uBAAuB;IAE1B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB3B;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAExD;;;;;;;;;;OAUG;YACW,yBAAyB;IAglBvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EAAE,gDAAgD;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,GAAG,CAAC,GACrC,IAAI;IAkHP;;;;;;;;;;OAUG;cACa,oBAAoB,CAClC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,GAAG,OAAO,EAEjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,KAAK,EACX,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,EAC1C,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,OAAO,CAAC;IA62BnB;;;;OAIG;YACW,gBAAgB;IA0f9B;;;;;;;;;;;;;;;;;OAiBG;YACW,qBAAqB;IA8GnC;;;;;;;OAOG;YACW,6BAA6B;IA2D3C;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAQ7B,aAAa,IAAI,MAAM;IAUvB;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA6uBhD;;;;;;;;;;;;;;;;OAgBG;IACG,wBAAwB,IAAI,OAAO,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IA2HF;;;;;;;;OAQG;cACa,wBAAwB,CAAC,IAAI,EAAE;QAC7C,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BjB;;;;;;;;;;;;;;;;OAgBG;cACa,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CACN;QACE,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GACD,SAAS,CACZ;IAwHD;;;;;;;;;;;;OAYG;YACW,sBAAsB;IA0FpC;;;;;;;;;;;;;OAaG;YACW,wBAAwB;IAqEtC;;;;;;OAMG;YACW,qBAAqB;CA+DpC"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAe9C,OAAO,EAeL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAa/B,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAStC,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAoBnC;;GAEG;AACH,MAAM,WAAW,qBACf,SAAQ,IAAI,CACV,aAAa,EACX,aAAa,GACb,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,oBAAoB,GACpB,YAAY,CACf;IACD,CAAC,GAAG,EAAE,MAAM,GACR,WAAW,GACX,MAAM,GACN,kBAAkB,GAClB,sBAAsB,GACtB,SAAS,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,mBAAoB,SAAQ,QAAQ;IAGxD,MAAM,EAGA,GAAG,CAAC;IAEV,SAAS,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAC1C,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACrC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC9C,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,mBAAmB,CAAC,CAAS;IACrC,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,wBAAwB,CAAC,CAAS;IAC1C,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,cAAc,CAAC,CAAgB;gBAGrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,qBAAqB,EAC1B,gBAAgB,GAAE,iBAA2C;IAsG/D;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB9B;;;OAGG;YACW,uBAAuB;IA8GrC;;;;;;;;;OASG;YACW,wBAAwB;IA0BtC;;;;;;;;;;;;OAYG;YACW,wBAAwB;IA6GtC;;;OAGG;YACW,8BAA8B;IAmG5C;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAC7B;QACE,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,SAAS,CACZ;IAID;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI9D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM;IAEzC;;;OAGG;IACH,SAAS,CAAC,eAAe,IAAI,MAAM;IAInC;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,SAAS;IAI5C;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAIrE;;;OAGG;IACH,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAIrE;;;;;;;OAOG;IACH,SAAS,KAAK,qBAAqB,IAAI,OAAO,CAE7C;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,wBAAwB,CACzC,GAAG,EAAE,aAAa,GACjB,uBAAuB;IAE1B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB3B;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAExD;;;;;;;;;;OAUG;YACW,yBAAyB;IAylBvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EAAE,gDAAgD;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,GAAG,CAAC,GACrC,IAAI;IAkHP;;;;;;;;;;OAUG;cACa,oBAAoB,CAClC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,GAAG,OAAO,EAEjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,KAAK,EACX,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,EAC1C,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,OAAO,CAAC;IAi4BnB;;;;;;;;;OASG;YACW,gBAAgB;IA6iB9B;;;;;;;;;;;;;;;;;OAiBG;YACW,qBAAqB;IA8GnC;;;;;;;OAOG;YACW,6BAA6B;IA2D3C;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAQ7B,aAAa,IAAI,MAAM;IAUvB;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAivBhD;;;;;;;;;;;;;;;;OAgBG;IACG,wBAAwB,IAAI,OAAO,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IA2HF;;;;;;;;OAQG;cACa,wBAAwB,CAAC,IAAI,EAAE;QAC7C,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QAMjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCjB;;;;;;;;;;;;;;;;OAgBG;cACa,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CACN;QACE,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QAEjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;KAClB,GACD,SAAS,CACZ;IA2HD;;;;;;;;;;;;OAYG;YACW,sBAAsB;IA0FpC;;;;;;;;;;;;;OAaG;YACW,wBAAwB;IAqEtC;;;;;;OAMG;YACW,qBAAqB;CA+DpC"}

package/dist/agent.js

@@ -22,12 +22,13 @@ import { DEFAULT_SESSION_TTL } from "./constants";
 import { buildNeedsAuthorizationMeta } from "./needs-authorization-meta";
 import { z } from "zod";
 import { generateDidKeyFromBase64, logger } from "@kya-os/mcp";
-import { OAuthService, IdpTokenResolver, ToolContextBuilder, OAuthRequiredError, DelegationRequiredError, DelegationErrorFormatter, SessionRegistrationService, SESSION_ID_PREFIX, recordWireForm, generateResumeToken, } from "@kya-os/mcp-i-runtime"; // product layer — stays (C2/C3)
+import { OAuthService, IdpTokenResolver, ToolContextBuilder, OAuthRequiredError, DelegationRequiredError, DelegationErrorFormatter, SessionRegistrationService, SESSION_ID_PREFIX, recordWireForm, generateResumeToken, authTypeSatisfies, isUnsatisfiableAuthType, MINTABLE_AUTH_TYPES, } from "@kya-os/mcp-i-runtime"; // product layer — stays (C2/C3)
 import { WebCryptoProvider } from "./providers/crypto";
 // CRITICAL: Import the OAuth service registry - this triggers globalThis registration
 // at module load time, preventing esbuild from tree-shaking the OAuth services
 import { getOAuthServices, isOAuthServicesAvailable, } from "./utils/oauth-service-registry";
 import { KVOAuthConfigCache } from "./cache/kv-oauth-config-cache";
+import { hideConsentToolsFromListing } from "./utils/hidden-consent-tools";
 import { IdpTokenStorage } from "./services/idp-token-storage";
 import { OAuthSecurityService } from "./services/oauth-security.service";
 import { WorkersFetchProvider } from "./providers/storage";
@@ -1110,6 +1111,12 @@ export class MCPICloudflareAgent extends McpAgent {
                 });
                 return credentialAuthHandler(args);
             });
+            // The consent tools above stay callable (the iframe invokes them via
+            // tools/call) but must not leak into tools/list, where clients render
+            // them and models call them despite the DO-NOT-CALL description.
+            if (!hideConsentToolsFromListing(this.server)) {
+                logger.warn("[MCPICloudflareAgent] Could not hide internal consent tools from tools/list (no handler found)");
+            }
             logger.info("[MCPICloudflareAgent] Registered MCP Apps consent UI resource");
         }
         catch {
@@ -1403,6 +1410,12 @@ export class MCPICloudflareAgent extends McpAgent {
         let delegationId;
         let userDid;
         let clientDid;
+        // SECURITY (consent-approve auth-gate, Task B2/B3): the presented
+        // delegation's own authorization type, surfaced from storage so the gate in
+        // buildToolContext can require it to satisfy the tool's required type.
+        // Remains undefined for the KV-legacy / JWT-extraction fallbacks below (no
+        // stored type) → fail-safe re-challenge on typed tools.
+        let delegationAuthorizationType;
         try {
             const agentDid = (await this.mcpiRuntime.getIdentity()).did;
             logger.debug("[MCPICloudflareAgent] 🔍 Starting delegation lookup (DO storage):", {
@@ -1424,6 +1437,8 @@ export class MCPICloudflareAgent extends McpAgent {
             if (doData) {
                 delegationToken = doData.delegationToken;
                 delegationId = doData.delegationId;
+                // Task B2: surface the stored delegation auth type for the call-time gate
+                delegationAuthorizationType = doData.authorizationType;
                 // Prefer userDid from DO storage if available
                 if (doData.userDid) {
                     userDid = doData.userDid;
@@ -1442,9 +1457,17 @@ export class MCPICloudflareAgent extends McpAgent {
                     const kvToken = await delegationStorage.get(userAgentKey, "text");
                     if (kvToken) {
                         delegationToken = kvToken;
+                        // Recover the delegation's auth type from its sidecar key so this
+                        // fallback can satisfy a typed tool. Records written before the
+                        // sidecar existed have none — that stays undefined and the gate
+                        // fails safe (re-challenge), which is the pre-existing behaviour
+                        // for legacy records, not a new rejection.
+                        delegationAuthorizationType =
+                            (await delegationStorage.get(STORAGE_KEYS.delegationAuthType(userDid, agentDid), "text")) ?? undefined;
                         logger.debug("[MCPICloudflareAgent] ✅ Delegation found in KV (legacy):", {
                             sessionId: sessionId.slice(0, 20) + "...",
                             source: "kv-fallback",
+                            hasAuthorizationType: !!delegationAuthorizationType,
                         });
                     }
                 }
@@ -1534,7 +1557,7 @@ export class MCPICloudflareAgent extends McpAgent {
         // Store AuthRequiredError to throw inside the inner try block where its handler lives
         let pendingAuthRequiredError = null;
         try {
-            toolContext = await this.buildToolContext(toolName, userDid, sessionId, delegationToken, mappedEnv);
+            toolContext = await this.buildToolContext(toolName, userDid, sessionId, delegationToken, delegationAuthorizationType, mappedEnv);
         }
         catch (error) {
             // Handle CredentialAuthModeError - build consent page URL (not OAuth URL)
@@ -1893,9 +1916,14 @@ export class MCPICloudflareAgent extends McpAgent {
     /**
      * Build tool execution context with IDP token (Phase 1 - MH-7)
      *
+     * @param delegationAuthorizationType - The stored authorization type of the
+     *   presented delegation (from `getDelegationFromStorage`), or undefined for
+     *   legacy records. Used by the delegation-only fallbacks below to reject a
+     *   delegation whose type does not satisfy the tool's required type (security
+     *   fix: consent-approve auth-gate, Task B3).
      * @private
      */
-    async buildToolContext(toolName, userDid, sessionId, delegationToken, env) {
+    async buildToolContext(toolName, userDid, sessionId, delegationToken, delegationAuthorizationType, env) {
         // Only build context if userDid is available and AgentShield API is configured.
         // Note: DELEGATION_STORAGE is only required for password/OAuth paths, not apikey vault.
         if (!userDid || !env.AGENTSHIELD_API_KEY) {
@@ -1987,7 +2015,20 @@ export class MCPICloudflareAgent extends McpAgent {
                     else {
                         // No password auth token found - check if delegation exists
                         // If delegation exists, tool can still execute without credential token
-                        if (delegationToken) {
+                        //
+                        // SECURITY (consent-approve auth-gate, Task B3): the delegation only
+                        // authorizes this tool if its OWN authorization type satisfies the
+                        // requirement. We are provably in the password branch (isPasswordAuth
+                        // above), so the effective requirement is "password" — fall back to it
+                        // when the tool uses the legacy `oauthProvider: "credentials"` shape
+                        // (authorization.type undefined). A mismatched delegation (e.g. an
+                        // anonymous `none` consent-only delegation — the demonstrated exploit
+                        // — or a legacy record with no persisted type → undefined) does NOT
+                        // satisfy it; fall through to OAuthRequiredError so the tool
+                        // re-challenges instead of executing on mere delegation presence.
+                        const requiredAuthType = protection.authorization?.type ?? "password";
+                        if (delegationToken &&
+                            authTypeSatisfies(delegationAuthorizationType, requiredAuthType)) {
                             if (this._environment === "development") {
                                 logger.debug("[MCPICloudflareAgent] No credential token found, but delegation exists - returning minimal context:", {
                                     tool: toolName,
@@ -2007,7 +2048,31 @@ export class MCPICloudflareAgent extends McpAgent {
                                 delegationToken,
                             };
                         }
-                        // No delegation token either - throw OAuthRequiredError to trigger auth flow
+                        if (delegationToken) {
+                            // A delegation WAS presented but its type does not satisfy the
+                            // password requirement — log the rejection before re-challenging.
+                            // NOT gated on development: this fires only on a rejection (so it
+                            // is low volume), and it is the only signal that explains why a
+                            // user is being re-challenged. Hiding it in production made the
+                            // exact loop this follow-up addresses undiagnosable.
+                            logger.warn("[MCPICloudflareAgent] Delegation present but auth-type does not satisfy password requirement - re-challenging:", {
+                                tool: toolName,
+                                requiredAuthType,
+                                delegationAuthorizationType: delegationAuthorizationType ?? null,
+                            });
+                            // Distinguish "re-authenticate and this resolves" from "no mint
+                            // can ever satisfy this". Diagnostic only — the authorization
+                            // decision above is unchanged.
+                            if (isUnsatisfiableAuthType(requiredAuthType)) {
+                                logger.warn("[MCPICloudflareAgent] MISCONFIGURATION: tool requires an authorization type no delegation mint can produce - this tool will re-challenge forever:", {
+                                    tool: toolName,
+                                    requiredAuthType,
+                                    mintableAuthTypes: [...MINTABLE_AUTH_TYPES],
+                                    hint: "Set the tool's authorization.type to one of the mintable types, or add mint support for the required type.",
+                                });
+                            }
+                        }
+                        // No (satisfying) delegation token - throw OAuthRequiredError to trigger auth flow
                         if (this._environment === "development") {
                             logger.warn("[MCPICloudflareAgent] No password auth token found, throwing OAuthRequiredError:", {
                                 tool: toolName,
@@ -2223,7 +2288,7 @@ export class MCPICloudflareAgent extends McpAgent {
                 projectId,
             });
             // Build context
-            return await contextBuilder.buildContext(toolName, userDid, sessionId, delegationToken, protection);
+            return await contextBuilder.buildContext(toolName, userDid, sessionId, delegationToken, protection, delegationAuthorizationType);
         }
         catch (error) {
             // Re-throw OAuthRequiredError so it can be handled by executeToolWithProof
@@ -3016,12 +3081,13 @@ export class MCPICloudflareAgent extends McpAgent {
      * @param data - Delegation data to store
      */
     async storeDelegationToStorage(data) {
-        const { sessionId, delegationToken, delegationId, userDid, agentDid } = data;
+        const { sessionId, delegationToken, delegationId, userDid, agentDid, authorizationType, } = data;
         const storageData = {
             delegationToken,
             delegationId,
             userDid,
             agentDid,
+            authorizationType,
             storedAt: Date.now(),
         };
         // Store with session key (primary for tool execution)