feat(mcp): Add session state-based JWT token propagation for MCP tools#3675

Open

timof1308 wants to merge 11 commits intogoogle:mainfrom

timof1308:feature/secure-token-handling

Commits on Dec 16, 2025

feat: implement secure token handling via request_state
timof1308
committed
feat: Add warning for non-primitive state values that may not serialize correctly into headers.
timof1308
committed
refactor: Introduce `HeaderProvider` type and modularize header generation logic in MCP tools.
timof1308
committed
feat: Add strict mode to `create_session_state_header_provider` to raise errors for non-primitive types and skip empty string values.
timof1308
committed
feat: Introduce `state_header_strict` config for strict state header type validation and add a test.
timof1308
committed
applied autoformat.sh
timof1308
committed
feat: Add RFC 7230 compliant header validation and sanitization
timof1308
committed
refactor: add future annotations import to types and internal modules.
timof1308
committed
refactor: Publicize header name validation, refine header name regex, and update header value sanitization to target control characters.
timof1308
committed
applied autoformat.sh
timof1308
committed
applied ./autoformat.sh
timof1308
committed