Package io.meeds.mcp.server.plugin

Class McpServerOauthOpaqueTokenIntrospector

java.lang.Object

io.meeds.mcp.server.plugin.McpServerOauthOpaqueTokenIntrospector

All Implemented Interfaces:

org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector

@Component
public class McpServerOauthOpaqueTokenIntrospector
extends Object
implements org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector

Constructor Summary

Constructors

Constructor	Description
McpServerOauthOpaqueTokenIntrospector()

Method Summary

Modifier and Type	Method	Description
org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector	getDelegate()
org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal	introspect(String token)	Validates an opaque access token before anything under /mcp runs.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

McpServerOauthOpaqueTokenIntrospector

public McpServerOauthOpaqueTokenIntrospector()

Method Details

introspect

public org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal introspect(String token)

Validates an opaque access token before anything under /mcp runs.

validateMcpAudience(OAuth2AuthenticatedPrincipal) is the enforcement point of the MCP access gate on the request path, and covers the whole surface — initialize, tools/list, tools/call and the SSE stream alike. Being here also means it is re-evaluated on every request, so narrowing the audience takes a user's access away at once instead of at the expiry of a token already issued to them. One residual: an SSE stream already open when the audience narrows is not re-introspected, so server-to-client notifications keep flowing on it until it drops. Every new request, on that session or any other, is refused.

Specified by:

introspect in interface org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector

Parameters:

token - the opaque bearer token presented by the caller

Returns:

the authenticated principal, carrying its scope authorities

getDelegate

public org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector getDelegate()

Returns:

the Spring introspector doing the actual call to the authorization server's introspection endpoint, built lazily because the internal client secret it authenticates with is generated on first use