Sharang ParnerkarandClaude Fable 5
02c7552725
CI / Check (push) Skipped
CI / Check (pull_request) Successful in 5m44s
CI / Detect Changes (pull_request) Skipped
CI / Deploy Agent (pull_request) Skipped
CI / Deploy Dashboard (pull_request) Skipped
CI / Deploy Docs (pull_request) Skipped
CI / Deploy MCP (pull_request) Skipped
Root cause (found while wiring the breakpilot MCP loop, A): every MCP tool call over Streamable HTTP failed with '-32603 no tenant context — bearer middleware not in chain'. The bearer middleware sets the tenant in a tokio task_local scoped around the request, but rmcp's StreamableHttpService spawns the session's tool-serving task (tower.rs: 'spawn a task to serve the session'), and task_locals do NOT cross tokio::spawn. So initialize/tools-list worked but every real tool call (list_findings, oscal_assessment, ...) failed — meaning the loop never worked over HTTP and breakpilot's client fell back to demo data. Fix: bind the tenant to the per-session server instance instead of a per-request task_local. rmcp calls the service factory in the request task (before the spawn) and still inside the middleware's scope, so the factory reads the bearer-set tenant once and bakes it into ComplianceMcpServer; tool_db() then reads self.tenant_id. stdio passes its synthetic tenant the same way. No tool-handler changes; the middleware still validates (and can revoke) the token per request. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>