Skip to content

fix(server/auth): centralize tool scopes validation#3335

Merged
duwenxin99 merged 7 commits into
mainfrom
fix/auth-handler
Jun 3, 2026
Merged

fix(server/auth): centralize tool scopes validation#3335
duwenxin99 merged 7 commits into
mainfrom
fix/auth-handler

Conversation

@duwenxin99

@duwenxin99 duwenxin99 commented Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

All MCP protocol versions will validate auth token scopes to prevent authorization bypass through older protocol versions.

Reported by HE WEI (ギカク) @hewei-gikaku

@duwenxin99 duwenxin99 requested a review from a team as a code owner June 2, 2026 23:22
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jun 2, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request centralizes scope validation logic for MCP tool calls by introducing a new ValidateScopes utility function in internal/server/mcp/util along with comprehensive unit tests. This utility replaces inline validation logic across multiple versioned MCP handlers (v20241105, v20250326, v20250618, and v20251125). The review feedback suggests two improvements to the new utility: simplifying the mcpSvcName string variable to a boolean flag since the service name is unused, and using strings.Fields instead of strings.Split to parse token scopes more robustly.

Comment thread internal/server/mcp/util/auth.go Outdated
Comment thread internal/server/mcp/util/auth.go Outdated
averikitsch
averikitsch reviewed Jun 3, 2026
View reviewed changes
Comment thread internal/server/mcp/util/auth.go Outdated
@duwenxin99 duwenxin99 enabled auto-merge (squash) June 3, 2026 19:44
@duwenxin99 duwenxin99 disabled auto-merge June 3, 2026 19:45
@duwenxin99 duwenxin99 merged commit adce4ab into main Jun 3, 2026
24 checks passed
@duwenxin99 duwenxin99 deleted the fix/auth-handler branch June 3, 2026 19:49
@github-actions

github-actions Bot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

🧨 Preview deployments removed.

Cloudflare Pages environments for pr-3335 have been deleted.

@release-please release-please Bot mentioned this pull request Jun 3, 2026
Merged
Yuan325 added a commit that referenced this pull request Jun 4, 2026
@release-please @Yuan325
chore(main): release 1.4.0 (#3301)
d67cfbe 
🤖 I have created a release *beep* *boop*
---


##
[1.4.0](v1.3.0...v1.4.0)
(2026-06-04)


### Features

* **ci:** Add support for windows/arm64 binary distribution
([#3231](#3231))
([10abf3b](10abf3b))
* **datalineage:** Add Data Lineage integration
([#3285](#3285))
([19353c3](19353c3))
* **server:** Ignore unknown tools at startup with
`--ignore-unknown-tools` flag
([#3353](#3353))
([5f0304f](5f0304f))
* **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL
Postgres
([#3203](#3203))
([b514cbd](b514cbd))
* **tools/spanner-search-catalog:** Implement search_catalog tool
([#3140](#3140))
([defc086](defc086))


### Bug Fixes

* **auth/generic:** Enforce issuer presence in opaque token validation
([#3360](#3360))
([1d8df0d](1d8df0d))
* **auth:** Separate Google and Generic MCP OAuth verification
([#3341](#3341))
([dfd66ee](dfd66ee))
* **mcp:** Support annotations and metadata within Tools to earlier MCP
schemas ([#3300](#3300))
([9a88c72](9a88c72))
* **oracle:** Remove trailing semicolons from prebuilt tools
([#3215](#3215))
([fcad02d](fcad02d))
* **server/auth:** Centralize tool scopes validation
([#3335](#3335))
([adce4ab](adce4ab))
* **server:** Return null id for batch request rejection
([#3333](#3333))
([0b18d58](0b18d58))
* **source/dataplex:** Limit search results to pageSize
([#3323](#3323))
([905c1f6](905c1f6)),
closes [#3308](#3308)
* **telemetry:** Allow GCP project override
([#2960](#2960))
([3c83ba5](3c83ba5))
* **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query
([#3324](#3324))
([45df461](45df461))
* **tool/clickhouse:** Handle ignored ProcessParameters error
([#3340](#3340))
([ddfd887](ddfd887))
* **tools/clickhouse,tools/bigquery:** Validate identifier parameters to
prevent injection
([#3219](#3219))
([2f45f75](2f45f75))
* **tools/looker:** Escape filter values for unquoted parameters
([#3289](#3289))
([1711156](1711156))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
github-actions Bot pushed a commit that referenced this pull request Jun 4, 2026
@Yuan325 @release-please
deploy: chore(main): release 1.4.0 (#3301)
ecb70f9 
🤖 I have created a release *beep* *boop*
---

##
[1.4.0](v1.3.0...v1.4.0)
(2026-06-04)

### Features

* **ci:** Add support for windows/arm64 binary distribution
([#3231](#3231))
([10abf3b](10abf3b))
* **datalineage:** Add Data Lineage integration
([#3285](#3285))
([19353c3](19353c3))
* **server:** Ignore unknown tools at startup with
`--ignore-unknown-tools` flag
([#3353](#3353))
([5f0304f](5f0304f))
* **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL
Postgres
([#3203](#3203))
([b514cbd](b514cbd))
* **tools/spanner-search-catalog:** Implement search_catalog tool
([#3140](#3140))
([defc086](defc086))

### Bug Fixes

* **auth/generic:** Enforce issuer presence in opaque token validation
([#3360](#3360))
([1d8df0d](1d8df0d))
* **auth:** Separate Google and Generic MCP OAuth verification
([#3341](#3341))
([dfd66ee](dfd66ee))
* **mcp:** Support annotations and metadata within Tools to earlier MCP
schemas ([#3300](#3300))
([9a88c72](9a88c72))
* **oracle:** Remove trailing semicolons from prebuilt tools
([#3215](#3215))
([fcad02d](fcad02d))
* **server/auth:** Centralize tool scopes validation
([#3335](#3335))
([adce4ab](adce4ab))
* **server:** Return null id for batch request rejection
([#3333](#3333))
([0b18d58](0b18d58))
* **source/dataplex:** Limit search results to pageSize
([#3323](#3323))
([905c1f6](905c1f6)),
closes [#3308](#3308)
* **telemetry:** Allow GCP project override
([#2960](#2960))
([3c83ba5](3c83ba5))
* **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query
([#3324](#3324))
([45df461](45df461))
* **tool/clickhouse:** Handle ignored ProcessParameters error
([#3340](#3340))
([ddfd887](ddfd887))
* **tools/clickhouse,tools/bigquery:** Validate identifier parameters to
prevent injection
([#3219](#3219))
([2f45f75](2f45f75))
* **tools/looker:** Escape filter values for unquoted parameters
([#3289](#3289))
([1711156](1711156))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
github-actions Bot pushed a commit to renovate-bot/googleapis-_-genai-toolbox that referenced this pull request Jun 4, 2026
@renovate-bot @release-please
deploy: chore(main): release 1.4.0 (googleapis#3301)
9d882d4 
🤖 I have created a release *beep* *boop*
---

##
[1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0)
(2026-06-04)

### Features

* **ci:** Add support for windows/arm64 binary distribution
([googleapis#3231](googleapis#3231))
([10abf3b](googleapis@10abf3b))
* **datalineage:** Add Data Lineage integration
([googleapis#3285](googleapis#3285))
([19353c3](googleapis@19353c3))
* **server:** Ignore unknown tools at startup with
`--ignore-unknown-tools` flag
([googleapis#3353](googleapis#3353))
([5f0304f](googleapis@5f0304f))
* **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL
Postgres
([googleapis#3203](googleapis#3203))
([b514cbd](googleapis@b514cbd))
* **tools/spanner-search-catalog:** Implement search_catalog tool
([googleapis#3140](googleapis#3140))
([defc086](googleapis@defc086))

### Bug Fixes

* **auth/generic:** Enforce issuer presence in opaque token validation
([googleapis#3360](googleapis#3360))
([1d8df0d](googleapis@1d8df0d))
* **auth:** Separate Google and Generic MCP OAuth verification
([googleapis#3341](googleapis#3341))
([dfd66ee](googleapis@dfd66ee))
* **mcp:** Support annotations and metadata within Tools to earlier MCP
schemas ([googleapis#3300](googleapis#3300))
([9a88c72](googleapis@9a88c72))
* **oracle:** Remove trailing semicolons from prebuilt tools
([googleapis#3215](googleapis#3215))
([fcad02d](googleapis@fcad02d))
* **server/auth:** Centralize tool scopes validation
([googleapis#3335](googleapis#3335))
([adce4ab](googleapis@adce4ab))
* **server:** Return null id for batch request rejection
([googleapis#3333](googleapis#3333))
([0b18d58](googleapis@0b18d58))
* **source/dataplex:** Limit search results to pageSize
([googleapis#3323](googleapis#3323))
([905c1f6](googleapis@905c1f6)),
closes [googleapis#3308](googleapis#3308)
* **telemetry:** Allow GCP project override
([googleapis#2960](googleapis#2960))
([3c83ba5](googleapis@3c83ba5))
* **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query
([googleapis#3324](googleapis#3324))
([45df461](googleapis@45df461))
* **tool/clickhouse:** Handle ignored ProcessParameters error
([googleapis#3340](googleapis#3340))
([ddfd887](googleapis@ddfd887))
* **tools/clickhouse,tools/bigquery:** Validate identifier parameters to
prevent injection
([googleapis#3219](googleapis#3219))
([2f45f75](googleapis@2f45f75))
* **tools/looker:** Escape filter values for unquoted parameters
([googleapis#3289](googleapis#3289))
([1711156](googleapis@1711156))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
github-actions Bot pushed a commit to rodineyw/mcp-toolbox that referenced this pull request Jun 4, 2026
@pull @release-please
deploy: chore(main): release 1.4.0 (googleapis#3301)
0847296 
🤖 I have created a release *beep* *boop*
---

##
[1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0)
(2026-06-04)

### Features

* **ci:** Add support for windows/arm64 binary distribution
([googleapis#3231](googleapis#3231))
([10abf3b](googleapis@10abf3b))
* **datalineage:** Add Data Lineage integration
([googleapis#3285](googleapis#3285))
([19353c3](googleapis@19353c3))
* **server:** Ignore unknown tools at startup with
`--ignore-unknown-tools` flag
([googleapis#3353](googleapis#3353))
([5f0304f](googleapis@5f0304f))
* **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL
Postgres
([googleapis#3203](googleapis#3203))
([b514cbd](googleapis@b514cbd))
* **tools/spanner-search-catalog:** Implement search_catalog tool
([googleapis#3140](googleapis#3140))
([defc086](googleapis@defc086))

### Bug Fixes

* **auth/generic:** Enforce issuer presence in opaque token validation
([googleapis#3360](googleapis#3360))
([1d8df0d](googleapis@1d8df0d))
* **auth:** Separate Google and Generic MCP OAuth verification
([googleapis#3341](googleapis#3341))
([dfd66ee](googleapis@dfd66ee))
* **mcp:** Support annotations and metadata within Tools to earlier MCP
schemas ([googleapis#3300](googleapis#3300))
([9a88c72](googleapis@9a88c72))
* **oracle:** Remove trailing semicolons from prebuilt tools
([googleapis#3215](googleapis#3215))
([fcad02d](googleapis@fcad02d))
* **server/auth:** Centralize tool scopes validation
([googleapis#3335](googleapis#3335))
([adce4ab](googleapis@adce4ab))
* **server:** Return null id for batch request rejection
([googleapis#3333](googleapis#3333))
([0b18d58](googleapis@0b18d58))
* **source/dataplex:** Limit search results to pageSize
([googleapis#3323](googleapis#3323))
([905c1f6](googleapis@905c1f6)),
closes [googleapis#3308](googleapis#3308)
* **telemetry:** Allow GCP project override
([googleapis#2960](googleapis#2960))
([3c83ba5](googleapis@3c83ba5))
* **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query
([googleapis#3324](googleapis#3324))
([45df461](googleapis@45df461))
* **tool/clickhouse:** Handle ignored ProcessParameters error
([googleapis#3340](googleapis#3340))
([ddfd887](googleapis@ddfd887))
* **tools/clickhouse,tools/bigquery:** Validate identifier parameters to
prevent injection
([googleapis#3219](googleapis#3219))
([2f45f75](googleapis@2f45f75))
* **tools/looker:** Escape filter values for unquoted parameters
([googleapis#3289](googleapis#3289))
([1711156](googleapis@1711156))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
github-actions Bot pushed a commit to Jaleel-zhu/genai-toolbox that referenced this pull request Jun 4, 2026
@pull @release-please
deploy: chore(main): release 1.4.0 (googleapis#3301)
11cbf0f 
🤖 I have created a release *beep* *boop*
---

##
[1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0)
(2026-06-04)

### Features

* **ci:** Add support for windows/arm64 binary distribution
([googleapis#3231](googleapis#3231))
([10abf3b](googleapis@10abf3b))
* **datalineage:** Add Data Lineage integration
([googleapis#3285](googleapis#3285))
([19353c3](googleapis@19353c3))
* **server:** Ignore unknown tools at startup with
`--ignore-unknown-tools` flag
([googleapis#3353](googleapis#3353))
([5f0304f](googleapis@5f0304f))
* **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL
Postgres
([googleapis#3203](googleapis#3203))
([b514cbd](googleapis@b514cbd))
* **tools/spanner-search-catalog:** Implement search_catalog tool
([googleapis#3140](googleapis#3140))
([defc086](googleapis@defc086))

### Bug Fixes

* **auth/generic:** Enforce issuer presence in opaque token validation
([googleapis#3360](googleapis#3360))
([1d8df0d](googleapis@1d8df0d))
* **auth:** Separate Google and Generic MCP OAuth verification
([googleapis#3341](googleapis#3341))
([dfd66ee](googleapis@dfd66ee))
* **mcp:** Support annotations and metadata within Tools to earlier MCP
schemas ([googleapis#3300](googleapis#3300))
([9a88c72](googleapis@9a88c72))
* **oracle:** Remove trailing semicolons from prebuilt tools
([googleapis#3215](googleapis#3215))
([fcad02d](googleapis@fcad02d))
* **server/auth:** Centralize tool scopes validation
([googleapis#3335](googleapis#3335))
([adce4ab](googleapis@adce4ab))
* **server:** Return null id for batch request rejection
([googleapis#3333](googleapis#3333))
([0b18d58](googleapis@0b18d58))
* **source/dataplex:** Limit search results to pageSize
([googleapis#3323](googleapis#3323))
([905c1f6](googleapis@905c1f6)),
closes [googleapis#3308](googleapis#3308)
* **telemetry:** Allow GCP project override
([googleapis#2960](googleapis#2960))
([3c83ba5](googleapis@3c83ba5))
* **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query
([googleapis#3324](googleapis#3324))
([45df461](googleapis@45df461))
* **tool/clickhouse:** Handle ignored ProcessParameters error
([googleapis#3340](googleapis#3340))
([ddfd887](googleapis@ddfd887))
* **tools/clickhouse,tools/bigquery:** Validate identifier parameters to
prevent injection
([googleapis#3219](googleapis#3219))
([2f45f75](googleapis@2f45f75))
* **tools/looker:** Escape filter values for unquoted parameters
([googleapis#3289](googleapis#3289))
([1711156](googleapis@1711156))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
@BrewTestBot BrewTestBot mentioned this pull request Jun 4, 2026
Merged
github-actions Bot pushed a commit to pepe57/genai-toolbox that referenced this pull request Jun 5, 2026
@pull @release-please
deploy: chore(main): release 1.4.0 (googleapis#3301)
581f794 
🤖 I have created a release *beep* *boop*
---

##
[1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0)
(2026-06-04)

### Features

* **ci:** Add support for windows/arm64 binary distribution
([googleapis#3231](googleapis#3231))
([10abf3b](googleapis@10abf3b))
* **datalineage:** Add Data Lineage integration
([googleapis#3285](googleapis#3285))
([19353c3](googleapis@19353c3))
* **server:** Ignore unknown tools at startup with
`--ignore-unknown-tools` flag
([googleapis#3353](googleapis#3353))
([5f0304f](googleapis@5f0304f))
* **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL
Postgres
([googleapis#3203](googleapis#3203))
([b514cbd](googleapis@b514cbd))
* **tools/spanner-search-catalog:** Implement search_catalog tool
([googleapis#3140](googleapis#3140))
([defc086](googleapis@defc086))

### Bug Fixes

* **auth/generic:** Enforce issuer presence in opaque token validation
([googleapis#3360](googleapis#3360))
([1d8df0d](googleapis@1d8df0d))
* **auth:** Separate Google and Generic MCP OAuth verification
([googleapis#3341](googleapis#3341))
([dfd66ee](googleapis@dfd66ee))
* **mcp:** Support annotations and metadata within Tools to earlier MCP
schemas ([googleapis#3300](googleapis#3300))
([9a88c72](googleapis@9a88c72))
* **oracle:** Remove trailing semicolons from prebuilt tools
([googleapis#3215](googleapis#3215))
([fcad02d](googleapis@fcad02d))
* **server/auth:** Centralize tool scopes validation
([googleapis#3335](googleapis#3335))
([adce4ab](googleapis@adce4ab))
* **server:** Return null id for batch request rejection
([googleapis#3333](googleapis#3333))
([0b18d58](googleapis@0b18d58))
* **source/dataplex:** Limit search results to pageSize
([googleapis#3323](googleapis#3323))
([905c1f6](googleapis@905c1f6)),
closes [googleapis#3308](googleapis#3308)
* **telemetry:** Allow GCP project override
([googleapis#2960](googleapis#2960))
([3c83ba5](googleapis@3c83ba5))
* **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query
([googleapis#3324](googleapis#3324))
([45df461](googleapis@45df461))
* **tool/clickhouse:** Handle ignored ProcessParameters error
([googleapis#3340](googleapis#3340))
([ddfd887](googleapis@ddfd887))
* **tools/clickhouse,tools/bigquery:** Validate identifier parameters to
prevent injection
([googleapis#3219](googleapis#3219))
([2f45f75](googleapis@2f45f75))
* **tools/looker:** Escape filter values for unquoted parameters
([googleapis#3289](googleapis#3289))
([1711156](googleapis@1711156))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@averikitsch averikitsch averikitsch approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@Yuan325 Yuan325

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@duwenxin99 @averikitsch @Yuan325