@kya-os/mcp-i 1.6.11 → 1.6.12

package/dist/runtime/utils/tools.js

@@ -9,6 +9,7 @@ const auth_handshake_1 = require("../auth-handshake");
 const session_1 = require("../session");
 const request_context_1 = require("../request-context");
 const proof_batch_queue_1 = require("../proof-batch-queue");
+const mcp_i_core_1 = require("@kya-os/mcp-i-core");
 const rawRuntimeConfigPath = typeof RUNTIME_CONFIG_PATH !== "undefined" ? RUNTIME_CONFIG_PATH : undefined;
 // Single-parse to match single-stringify from webpack DefinePlugin
 const runtimeConfigPath = rawRuntimeConfigPath
@@ -510,9 +511,13 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                 }
                 // Check if authorization method matches current tool requirements
                 // This prevents stale delegations from working after tool auth method changes
-                if (verifyResult.authorized && toolProtection.authorization) {
+                // NOTE: Authorization validation only applies when credential is present (AgentShield API verifier).
+                // KV/Memory verifiers don't return credential data, so we skip auth method validation for them.
+                if (verifyResult.authorized &&
+                    toolProtection.authorization &&
+                    verifyResult.credential) {
                     const toolAuth = toolProtection.authorization;
-                    const delegationAuth = verifyResult.credential?.authorization;
+                    const delegationAuth = verifyResult.credential.authorization;
                     // If tool requires authorization but credential doesn't have auth data, reject
                     // This prevents bypassing auth checks with incomplete credential data
                     if (!delegationAuth) {
@@ -543,28 +548,8 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                             isError: true,
                         };
                     }
-                    // Compare authorization types
-                    let authMatches = delegationAuth.type === toolAuth.type;
-                    // For OAuth, also compare provider (undefined in toolAuth means "any provider acceptable")
-                    if (authMatches &&
-                        delegationAuth.type === "oauth" &&
-                        toolAuth.type === "oauth") {
-                        // If tool doesn't specify a provider, any provider is acceptable
-                        if (toolAuth.provider) {
-                            authMatches = delegationAuth.provider === toolAuth.provider;
-                        }
-                    }
-                    // For credential, also compare credentialType (undefined in toolAuth means "any type acceptable")
-                    if (authMatches &&
-                        delegationAuth.type === "credential" &&
-                        toolAuth.type === "credential") {
-                        // If tool doesn't specify a credential type, any type is acceptable
-                        if (toolAuth.credentialType) {
-                            authMatches =
-                                delegationAuth.credentialType === toolAuth.credentialType;
-                        }
-                    }
-                    if (!authMatches) {
+                    // Compare authorization types using the helper function
+                    if (!(0, mcp_i_core_1.authorizationMatches)(delegationAuth, toolAuth)) {
                         if (identityConfig?.debug) {
                             console.error(`[MCPI] Tool "${name}" blocked - authorization method mismatch`);
                         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i",
-  "version": "1.6.11",
+  "version": "1.6.12",
   "description": "The TypeScript MCP framework with identity features built-in",
   "type": "commonjs",
   "main": "dist/index.js",