feat(m7.3): MCP tenant-scoped bearer tokens (#92)

MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.
2026-06-30 15:27:21 +00:00
parent ac24ca766a
commit a3a96fe2cc
14 changed files with 622 additions and 35 deletions
@@ -46,6 +46,15 @@ pub fn build_router() -> Router {
        .route("/api/v1/sbom/diff", get(handlers::sbom_diff))
        .route("/api/v1/issues", get(handlers::list_issues))
        .route("/api/v1/scan-runs", get(handlers::list_scan_runs))
+        // MCP token management (per-tenant API tokens for the MCP server)
+        .route(
+            "/api/v1/mcp-tokens",
+            get(handlers::mcp_tokens::list_mcp_tokens).post(handlers::mcp_tokens::create_mcp_token),
+        )
+        .route(
+            "/api/v1/mcp-tokens/{id}",
+            delete(handlers::mcp_tokens::revoke_mcp_token),
+        )
        // Graph API endpoints
        .route("/api/v1/graph/{repo_id}", get(handlers::graph::get_graph))
        .route(