@sendinel/mcp-server 1.0.90 → 1.0.91

package/build/audit.js

@@ -36,6 +36,7 @@ export async function logAudit(opts) {
         resource_id: opts.resourceId ?? null,
         details: {
             ...(opts.details ?? {}),
+            ...(context?.actorType === 'synchronex_scoped_jwt' ? { kid: context.kid ?? null } : {}),
             ...(context?.workspaceId ? { workspace_id: context.workspaceId } : {}),
             // #4004: same actor + agent identity the dashboard records in api_usage. Only fields known for
             // this request are written; nothing is defaulted.

package/build/auth.d.ts

@@ -8,6 +8,7 @@ export interface ApiKeyInfo {
     authMethod?: 'api_key' | 'scoped_jwt';
     actsAsUserId?: string | null;
     workspaceId?: string | null;
+    kid?: string | null;
 }
 export declare class McpAuthenticationError extends Error {
     readonly status: 401 | 403 | 503;

package/build/auth.js

@@ -1,3 +1,4 @@
+import { decodeProtectedHeader, errors } from 'jose';
 import { adminDb } from './db.js';
 import { ALL_TOOL_GROUPS } from './server.js';
 import { looksLikeScopedJwt, scopedJwtVerificationEnabled, verifyScopedToken, } from './scoped-token.js';
@@ -82,7 +83,15 @@ export async function authenticateBearer(token, overrideProjectId) {
         try {
             claims = await verifyScopedToken(token);
         }
-        catch {
+        catch (error) {
+            let kid = null;
+            try {
+                const header = decodeProtectedHeader(token);
+                kid = typeof header.kid === 'string' ? header.kid.slice(0, 64) : null;
+            }
+            catch { /* Unreadable headers have an unknown key id. */ }
+            const code = error instanceof errors.JOSEError ? error.code : null;
+            console.warn('[scoped-jwt] verification failed', { kid, code });
             throw new McpAuthenticationError('Invalid or expired token', 401, 'INVALID_SCOPED_TOKEN');
         }
         if (claims.scope === 'data'
@@ -107,6 +116,7 @@ export async function authenticateBearer(token, overrideProjectId) {
             action: 'mcp.authenticate',
             resource_type: 'mcp_transport',
             details: {
+                kid: claims.kid ?? null,
                 workspace_id: claims.workspaceId,
                 token_scope: claims.scope,
             },
@@ -120,6 +130,7 @@ export async function authenticateBearer(token, overrideProjectId) {
             authMethod: 'scoped_jwt',
             actsAsUserId: claims.userId,
             workspaceId: claims.workspaceId,
+            kid: claims.kid,
         };
     }
     let info = await validateKey(token);

package/build/db.d.ts

@@ -44,6 +44,7 @@ export declare function runWithClient<T>(client: any, fn: () => Promise<T>, requ
     agentLabel?: string | null;
     keyId?: string | null;
     workspaceId?: string | null;
+    kid?: string | null;
     v1Caller?: V1Caller;
 }): Promise<T>;
 export declare function runWithToolContext<T>(toolGroup: string, toolName: string, fn: () => Promise<T> | T): Promise<T>;
@@ -65,6 +66,7 @@ export declare function requestContext(): {
     agentLabel?: string | null;
     keyId?: string | null;
     workspaceId?: string | null;
+    kid?: string | null;
     v1Caller?: V1Caller;
 } | undefined;
 export declare function projectClientForWriteback(): any | null;

package/build/db.js

@@ -75,6 +75,7 @@ export function requestContext() {
             agentLabel: ctx.agentLabel,
             keyId: ctx.keyId,
             workspaceId: ctx.workspaceId,
+            kid: ctx.kid,
             v1Caller: ctx.v1Caller,
         }
         : undefined;

package/build/index.js

@@ -115,6 +115,7 @@ async function runHttp() {
             actorId: info.actsAsUserId ?? null,
             authKind: info.authMethod === 'scoped_jwt' ? 'scoped_jwt' : 'api_key',
             workspaceId: info.workspaceId ?? null,
+            kid: info.kid ?? null,
         });
     });
     app.get('/health', (_req, res) => res.json({ ok: true }));

package/build/scoped-token.d.ts

@@ -1,6 +1,7 @@
 export declare const SCOPED_TOKEN_SCOPES: readonly ['data', 'service:provision'];
 export type ScopedTokenScope = (typeof SCOPED_TOKEN_SCOPES)[number];
 export type ScopedTokenClaims = {
+    kid: string | null;
     userId: string;
     projectId: string | null;
     workspaceId: string | null;

package/build/scoped-token.js

@@ -1,4 +1,4 @@
-import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
 const ISSUER = 'synchronex';
 const AUDIENCE = 'sendinel';
 const ALGORITHM = 'RS256';
@@ -50,7 +50,9 @@ export async function verifyScopedToken(token) {
     if (payload.workspace_id !== null && payload.workspace_id !== undefined && typeof payload.workspace_id !== 'string') {
         throw new Error('Scoped token workspace claim is invalid');
     }
+    const { kid } = decodeProtectedHeader(token);
     return {
+        kid: typeof kid === 'string' ? kid : null,
         userId,
         projectId,
         workspaceId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.90",
+  "version": "1.0.91",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",