Repository navigation

[security] Add MCP elicitation for secure preview token handling - #57

Open

mattpodwysocki wants to merge 27 commits into

mainfrom

add-preview-token-elicitation

Open

[security] Add MCP elicitation for secure preview token handling#57
mattpodwysocki wants to merge 27 commits into
mainfrom
add-preview-token-elicitation

Commits on Jan 13, 2026
- Add MCP elicitation for secure preview token handling
  
  mattpodwysocki
  and
  claude
  committed
  19cf40f
- Fix: Ensure preview tokens are created as public tokens (pk.*)
  
  mattpodwysocki
  and
  claude
  committed
  2b81c67
- Fix: Use only public scopes to create public tokens (pk.*)
  
  mattpodwysocki
  and
  claude
  committed
  0e68743
- Fix: Check client elicitation capability before using elicitInput()
  
  mattpodwysocki
  and
  claude
  committed
  f51feff
- Docs: Clarify varying MCP elicitation support across clients
  
  mattpodwysocki
  and
  claude
  committed
  ec35e38
- Docs: Update elicitation support status for Cursor and VS Code
  
  mattpodwysocki
  and
  claude
  committed
  b9a2246
- Docs: Add Goose elicitation bug report and documentation
  
  mattpodwysocki
  and
  claude
  committed
  c974bcc
- Docs: Link to filed Goose elicitation bug issue
  
  mattpodwysocki
  and
  claude
  committed
  ffdc83a
- Remove redundant Goose bug report file
  
  mattpodwysocki
  and
  claude
  committed
  08b2460
- Tests: Add unit tests for elicitation and token storage
  
  mattpodwysocki
  and
  claude
  committed
  3c6f8a6
Commits on Jan 14, 2026
- Docs: Confirm Claude Code does not support elicitation yet
  
  mattpodwysocki
  and
  claude
  committed
  90cbd1b
Commits on Jan 15, 2026
- Add elicitation support to style_comparison_tool
  mattpodwysocki
  committed
  1e3e9e7
Commits on Jul 31, 2026
Commits on Aug 4, 2026
- Address PR #57 review feedback: useCustomToken fallback and cache-key trust
  mattpodwysocki
  committed
  848963c
Commits on Aug 5, 2026
- Fix cross-session elicitation hijack: stop relying on this.server
  mattpodwysocki
  committed
  a92ebac
- Add CHANGELOG entry for cross-session elicitation hijack fix
  mattpodwysocki
  committed
  dbfcea2
Commits on Aug 10, 2026
- Merge remote-tracking branch 'origin/main' into add-preview-token-elicitation
  mattpodwysocki
  committed
  8d64169
Commits on Aug 12, 2026
- Address more PR #57 review feedback: CHANGELOG framing, jwtUtils docs
  mattpodwysocki
  committed
  c2f49b5
- Fix resource-exhaustion gaps in elicitation flow found in offline review
  mattpodwysocki
  committed
  25fc3ef
Commits on Aug 14, 2026
- Fix two security regressions and several correctness bugs in elicitation flow found in adversarial review
  mattpodwysocki
  committed
  de3a2ee
- Redesign preview-token "provide" flow to use MCP URL-mode elicitation
  mattpodwysocki
  committed
  95a77d7
Commits on Aug 15, 2026
- Flip ENABLE_LOCAL_URL_ELICITATION to opt-in, default disabled
  mattpodwysocki
  committed
  1ee7462

Commits

Commits on Jan 13, 2026

Commits on Jan 14, 2026

Commits on Jan 15, 2026

Commits on Jul 31, 2026

Commits on Aug 4, 2026

Commits on Aug 5, 2026

Commits on Aug 10, 2026

Commits on Aug 12, 2026

Commits on Aug 14, 2026

Commits on Aug 15, 2026