Add configurable token storage to MCP auth #883
Conversation
Signed-off-by: Yuchen Zhang <[email protected]>
WalkthroughAdds secure token storage for MCP OAuth2: introduces async token storage interfaces and implementations (object-store and in-memory), integrates token storage into OAuth2AuthCodeFlowProvider and MCPOAuth2Provider with lazy object-store resolution via a builder, updates config/registration, adds docs and tests. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User
participant Client as MCP Client
participant MCPProv as MCPOAuth2Provider
participant Flow as OAuth2AuthCodeFlowProvider
participant Store as TokenStorage
participant Obj as ObjectStore
Note over MCPProv,Flow: Init & config
MCPProv->>MCPProv: read config.token_storage_object_store
alt object-store configured but not resolved
MCPProv->>MCPProv: defer resolution until first auth
else no object-store configured
MCPProv->>Store: create InMemoryTokenStorage
end
MCPProv->>Flow: instantiate Flow (pass token_storage if ready)
Note over Client,Flow: Authentication
Client->>MCPProv: authenticate()
MCPProv->>Flow: authenticate()
alt storage available
Flow->>Store: retrieve(user_id)
alt valid token
Store-->>Flow: AuthResult
Flow-->>MCPProv: return AuthResult
else missing or expired
Flow->>Flow: attempt refresh / interactive flow
alt refresh/flow success
Flow->>Store: store(user_id, AuthResult)
Flow-->>MCPProv: AuthResult
else failure
Flow-->>MCPProv: Auth failure
end
end
else no storage
Flow->>Flow: in-memory handling
Flow-->>MCPProv: AuthResult
end
Note over MCPProv,Obj: Lazy object-store resolution on first auth
MCPProv->>Obj: builder.get_object_store(name)
alt success
MCPProv->>Store: create ObjectStoreTokenStorage(Obj)
MCPProv->>Flow: inject storage
else failure
MCPProv->>Store: fallback InMemoryTokenStorage
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Suggested labels
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
🧰 Additional context used📓 Path-based instructions (5)**/*.{py,yaml,yml}📄 CodeRabbit inference engine (.cursor/rules/nat-test-llm.mdc)
Files:
**/*.py📄 CodeRabbit inference engine (.cursor/rules/nat-test-llm.mdc)
Files:
tests/**/*.py📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Files:
⚙️ CodeRabbit configuration file
Files:
{tests/**/*.py,examples/*/tests/**/*.py}📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Files:
**/*⚙️ CodeRabbit configuration file
Files:
🧬 Code graph analysis (1)tests/nat/authentication/test_oauth_exchanger.py (1)
🪛 Ruff (0.13.2)tests/nat/authentication/test_oauth_exchanger.py179-179: Possible hardcoded password assigned to argument: "token" (S106) 230-230: Possible hardcoded password assigned to argument: "token" (S106) 🔇 Additional comments (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: Yuchen Zhang <[email protected]>
…oken-storage Signed-off-by: Yuchen Zhang <[email protected]>
Signed-off-by: Yuchen Zhang <[email protected]>
Signed-off-by: Yuchen Zhang <[email protected]>
Signed-off-by: Yuchen Zhang <[email protected]>
…oken-storage Signed-off-by: Yuchen Zhang <[email protected]>
Signed-off-by: Yuchen Zhang <[email protected]>
|
@CodeRabbit review full |
|
@yczhang-nv: I'll perform a full review of the PR changes. ✅ Actions performedFull review triggered. |
coderabbitai
bot
added
feature request
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.py (1)
177-179: Uselogger.exceptionwhen swallowing the errorPer our logging guideline, when catching an exception and not re-raising, call
logger.exceptionto capture the stack trace instead oflogger.error(..., exc_info=True). Please adjust accordingly. As per coding guidelines.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
docs/source/workflows/mcp/index.md(1 hunks)docs/source/workflows/mcp/mcp-auth-token-storage.md(1 hunks)docs/source/workflows/mcp/mcp-auth.md(2 hunks)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py(7 hunks)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider_config.py(1 hunks)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/register.py(1 hunks)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.py(1 hunks)packages/nvidia_nat_mcp/src/nat/plugins/mcp/client_base.py(0 hunks)src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py(5 hunks)
💤 Files with no reviewable changes (1)
- packages/nvidia_nat_mcp/src/nat/plugins/mcp/client_base.py
🧰 Additional context used
📓 Path-based instructions (4)
**/*
⚙️ CodeRabbit configuration file
**/*: # Code Review Instructions
- Ensure the code follows best practices and coding standards. - For Python code, follow
PEP 20 and
PEP 8 for style guidelines.- Check for security vulnerabilities and potential issues. - Python methods should use type hints for all parameters and return values.
Example:def my_function(param1: int, param2: str) -> bool: pass- For Python exception handling, ensure proper stack trace preservation:
- When re-raising exceptions: use bare
raisestatements to maintain the original stack trace,
and uselogger.error()(notlogger.exception()) to avoid duplicate stack trace output.- When catching and logging exceptions without re-raising: always use
logger.exception()
to capture the full stack trace information.Documentation Review Instructions - Verify that documentation and comments are clear and comprehensive. - Verify that the documentation doesn't contain any TODOs, FIXMEs or placeholder text like "lorem ipsum". - Verify that the documentation doesn't contain any offensive or outdated terms. - Verify that documentation and comments are free of spelling mistakes, ensure the documentation doesn't contain any
words listed in the
ci/vale/styles/config/vocabularies/nat/reject.txtfile, words that might appear to be
spelling mistakes but are listed in theci/vale/styles/config/vocabularies/nat/accept.txtfile are OK.Misc. - All code (except .mdc files that contain Cursor rules) should be licensed under the Apache License 2.0,
and should contain an Apache License 2.0 header comment at the top of each file.
- Confirm that copyright years are up-to date whenever a file is changed.
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/register.pydocs/source/workflows/mcp/mcp-auth.mddocs/source/workflows/mcp/mcp-auth-token-storage.mdpackages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider_config.pypackages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.pydocs/source/workflows/mcp/index.mdpackages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.pysrc/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
packages/**/*
⚙️ CodeRabbit configuration file
packages/**/*: - This directory contains optional plugin packages for the toolkit, each should contain apyproject.tomlfile. - Thepyproject.tomlfile should declare a dependency onnvidia-nator another package with a name starting
withnvidia-nat-. This dependency should be declared using~=<version>, and the version should be a two
digit version (ex:~=1.0).
- Not all packages contain Python code, if they do they should also contain their own set of tests, in a
tests/directory at the same level as thepyproject.tomlfile.
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/register.pypackages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider_config.pypackages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.pypackages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py
docs/source/**/*
⚙️ CodeRabbit configuration file
This directory contains the source code for the documentation. All documentation should be written in Markdown format. Any image files should be placed in the
docs/source/_staticdirectory.
Files:
docs/source/workflows/mcp/mcp-auth.mddocs/source/workflows/mcp/mcp-auth-token-storage.mddocs/source/workflows/mcp/index.md
src/nat/**/*
⚙️ CodeRabbit configuration file
This directory contains the core functionality of the toolkit. Changes should prioritize backward compatibility.
Files:
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
🪛 Ruff (0.13.2)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.py
174-174: Consider moving this statement to an else block
(TRY300)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py
393-393: Abstract raise to an inner function
(TRY301)
393-393: Avoid specifying long messages outside the exception class
(TRY003)
398-398: Do not catch blind exception: Exception
(BLE001)
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
85-85: Unused method argument: kwargs
(ARG002)
91-91: Avoid specifying long messages outside the exception class
(TRY003)
127-127: Avoid specifying long messages outside the exception class
(TRY003)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: CI Pipeline / Check
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
Outdated
Show resolved
Hide resolved
Signed-off-by: Yuchen Zhang <[email protected]>
Signed-off-by: Yuchen Zhang <[email protected]>
Signed-off-by: Yuchen Zhang <[email protected]>
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py (1)
288-318: Add a type hint forbuilder.Public APIs must expose complete type hints. Please annotate the
builderparameter (and import the corresponding type underTYPE_CHECKING) so callers know which builder interface is expected.-from nat.plugins.mcp.auth.auth_provider_config import MCPOAuth2ProviderConfig +from nat.plugins.mcp.auth.auth_provider_config import MCPOAuth2ProviderConfig +from typing import TYPE_CHECKING + +if TYPE_CHECKING: + from nat.builder.builder import Builder @@ - def __init__(self, config: MCPOAuth2ProviderConfig, builder=None): + def __init__(self, config: MCPOAuth2ProviderConfig, builder: "Builder | None" = None):As per coding guidelines.
♻️ Duplicate comments (1)
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py (1)
87-95: GuardContext.get()before accessing it.Calling
Context.get()unconditionally still raisesRuntimeErrorwhenever no NAT context is active—even when a caller suppliesuser_id. That regresses previously working flows and matches the outstanding review note. Wrap the lookup in atry/except RuntimeErrorand only inspect cookies when the context is available.- context = Context.get() - if user_id is None and hasattr(context, "metadata") and hasattr( - context.metadata, "cookies") and context.metadata.cookies is not None: + context = None + if user_id is None: + try: + context = Context.get() + except RuntimeError: + context = None + + if user_id is None and context and hasattr(context, "metadata") and hasattr( + context.metadata, "cookies") and context.metadata.cookies is not None:
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py(7 hunks)src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py(5 hunks)tests/nat/mcp/test_mcp_token_storage.py(1 hunks)
🧰 Additional context used
📓 Path-based instructions (10)
**/*.{py,yaml,yml}
📄 CodeRabbit inference engine (.cursor/rules/nat-test-llm.mdc)
**/*.{py,yaml,yml}: Configure response_seq as a list of strings; values cycle per call, and [] yields an empty string.
Configure delay_ms to inject per-call artificial latency in milliseconds for nat_test_llm.
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.pysrc/nat/authentication/oauth2/oauth2_auth_code_flow_provider.pytests/nat/mcp/test_mcp_token_storage.py
**/*.py
📄 CodeRabbit inference engine (.cursor/rules/nat-test-llm.mdc)
**/*.py: Programmatic use: create TestLLMConfig(response_seq=[...], delay_ms=...), add with builder.add_llm("", cfg).
When retrieving the test LLM wrapper, use builder.get_llm(name, wrapper_type=LLMFrameworkEnum.) and call the framework’s method (e.g., ainvoke, achat, call).
**/*.py: In code comments/identifiers use NAT abbreviations as specified: nat for API namespace/CLI, nvidia-nat for package name, NAT for env var prefixes; do not use these abbreviations in documentation
Follow PEP 20 and PEP 8; run yapf with column_limit=120; use 4-space indentation; end files with a single trailing newline
Run ruff check --fix as linter (not formatter) using pyproject.toml config; fix warnings unless explicitly ignored
Respect naming: snake_case for functions/variables, PascalCase for classes, UPPER_CASE for constants
Treat pyright warnings as errors during development
Exception handling: use bare raise to re-raise; log with logger.error() when re-raising to avoid duplicate stack traces; use logger.exception() when catching without re-raising
Provide Google-style docstrings for every public module, class, function, and CLI command; first line concise and ending with a period; surround code entities with backticks
Validate and sanitize all user input, especially in web or CLI interfaces
Prefer httpx with SSL verification enabled by default and follow OWASP Top-10 recommendations
Use async/await for I/O-bound work; profile CPU-heavy paths with cProfile or mprof before optimizing; cache expensive computations with functools.lru_cache or external cache; leverage NumPy vectorized operations when beneficial
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.pysrc/nat/authentication/oauth2/oauth2_auth_code_flow_provider.pytests/nat/mcp/test_mcp_token_storage.py
packages/*/src/**/*.py
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Importable Python code inside packages must live under packages//src/
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py
{src/**/*.py,packages/*/src/**/*.py}
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
All public APIs must have Python 3.11+ type hints on parameters and return values; prefer typing/collections.abc abstractions; use typing.Annotated when useful
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.pysrc/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
**/*
⚙️ CodeRabbit configuration file
**/*: # Code Review Instructions
- Ensure the code follows best practices and coding standards. - For Python code, follow
PEP 20 and
PEP 8 for style guidelines.- Check for security vulnerabilities and potential issues. - Python methods should use type hints for all parameters and return values.
Example:def my_function(param1: int, param2: str) -> bool: pass- For Python exception handling, ensure proper stack trace preservation:
- When re-raising exceptions: use bare
raisestatements to maintain the original stack trace,
and uselogger.error()(notlogger.exception()) to avoid duplicate stack trace output.- When catching and logging exceptions without re-raising: always use
logger.exception()
to capture the full stack trace information.Documentation Review Instructions - Verify that documentation and comments are clear and comprehensive. - Verify that the documentation doesn't contain any TODOs, FIXMEs or placeholder text like "lorem ipsum". - Verify that the documentation doesn't contain any offensive or outdated terms. - Verify that documentation and comments are free of spelling mistakes, ensure the documentation doesn't contain any
words listed in the
ci/vale/styles/config/vocabularies/nat/reject.txtfile, words that might appear to be
spelling mistakes but are listed in theci/vale/styles/config/vocabularies/nat/accept.txtfile are OK.Misc. - All code (except .mdc files that contain Cursor rules) should be licensed under the Apache License 2.0,
and should contain an Apache License 2.0 header comment at the top of each file.
- Confirm that copyright years are up-to date whenever a file is changed.
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.pysrc/nat/authentication/oauth2/oauth2_auth_code_flow_provider.pytests/nat/mcp/test_mcp_token_storage.py
packages/**/*
⚙️ CodeRabbit configuration file
packages/**/*: - This directory contains optional plugin packages for the toolkit, each should contain apyproject.tomlfile. - Thepyproject.tomlfile should declare a dependency onnvidia-nator another package with a name starting
withnvidia-nat-. This dependency should be declared using~=<version>, and the version should be a two
digit version (ex:~=1.0).
- Not all packages contain Python code, if they do they should also contain their own set of tests, in a
tests/directory at the same level as thepyproject.tomlfile.
Files:
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py
src/**/*.py
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
All importable Python code must live under src/ (or packages//src/)
Files:
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
src/nat/**/*
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Changes in src/nat should prioritize backward compatibility
Files:
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
⚙️ CodeRabbit configuration file
This directory contains the core functionality of the toolkit. Changes should prioritize backward compatibility.
Files:
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
tests/**/*.py
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Unit tests reside under tests/ and should use markers defined in pyproject.toml (e.g., integration)
Files:
tests/nat/mcp/test_mcp_token_storage.py
⚙️ CodeRabbit configuration file
tests/**/*.py: - Ensure that tests are comprehensive, cover edge cases, and validate the functionality of the code. - Test functions should be named using thetest_prefix, using snake_case. - Any frequently repeated code should be extracted into pytest fixtures. - Pytest fixtures should define the name argument when applying the pytest.fixture decorator. The fixture
function being decorated should be named using thefixture_prefix, using snake_case. Example:
@pytest.fixture(name="my_fixture")
def fixture_my_fixture():
pass
Files:
tests/nat/mcp/test_mcp_token_storage.py
{tests/**/*.py,examples/*/tests/**/*.py}
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
{tests/**/*.py,examples/*/tests/**/*.py}: Use pytest (with pytest-asyncio for async); name test files test_*.py; test functions start with test_; extract repeated code into fixtures; fixtures must set name in decorator and be named with fixture_ prefix
Mock external services with pytest_httpserver or unittest.mock; do not hit live endpoints
Mark expensive tests with @pytest.mark.slow or @pytest.mark.integration
Files:
tests/nat/mcp/test_mcp_token_storage.py
🧬 Code graph analysis (3)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py (4)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider_config.py (1)
MCPOAuth2ProviderConfig(23-84)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.py (2)
InMemoryTokenStorage(207-265)ObjectStoreTokenStorage(86-204)src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py (3)
_set_custom_auth_callback(81-84)OAuth2AuthCodeFlowProvider(37-140)authenticate(86-140)src/nat/builder/builder.py (1)
get_object_store_client(174-175)
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py (3)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.py (7)
InMemoryTokenStorage(207-265)store(45-53)store(121-156)store(229-237)retrieve(56-66)retrieve(158-179)retrieve(239-249)src/nat/data_models/authentication.py (4)
AuthenticatedContext(66-77)AuthResult(194-245)is_expired(206-210)BearerTokenCred(158-165)src/nat/builder/context.py (5)
Context(115-299)get(111-112)get(289-299)metadata(87-90)metadata(149-158)
tests/nat/mcp/test_mcp_token_storage.py (5)
src/nat/data_models/authentication.py (2)
AuthResult(194-245)BearerTokenCred(158-165)src/nat/object_store/models.py (1)
ObjectStoreItem(21-38)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py (2)
MCPOAuth2Provider(285-430)_nat_oauth2_authenticate(382-430)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/token_storage.py (2)
InMemoryTokenStorage(207-265)ObjectStoreTokenStorage(86-204)packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider_config.py (1)
MCPOAuth2ProviderConfig(23-84)
🪛 Ruff (0.13.2)
packages/nvidia_nat_mcp/src/nat/plugins/mcp/auth/auth_provider.py
397-397: Abstract raise to an inner function
(TRY301)
397-397: Avoid specifying long messages outside the exception class
(TRY003)
402-402: Do not catch blind exception: Exception
(BLE001)
src/nat/authentication/oauth2/oauth2_auth_code_flow_provider.py
86-86: Unused method argument: kwargs
(ARG002)
92-92: Avoid specifying long messages outside the exception class
(TRY003)
125-125: Avoid specifying long messages outside the exception class
(TRY003)
tests/nat/mcp/test_mcp_token_storage.py
275-275: Unused method argument: sample_auth_result
(ARG002)
314-314: Possible hardcoded password assigned to: "token_storage_object_store"
(S105)
322-322: Possible hardcoded password assigned to: "_token_storage_object_store_name"
(S105)
327-327: Possible hardcoded password assigned to: "token_storage_object_store"
(S105)
338-338: Possible hardcoded password assigned to argument: "token_url"
(S106)
340-340: Possible hardcoded password assigned to argument: "client_secret"
(S106)
|
@yczhang-nv looks good. we may need to add more doc to show how to use custom storage but that can be done in a separate PR. |
Signed-off-by: Yuchen Zhang <[email protected]>
coderabbitai
bot
added
the
external
yczhang-nv
removed
the
external
|
/merge |
Enable optional token storage for MCP OAuth2 with in-memory or external object-store backends (e.g., S3/MinIO), which are persistent and also more secure. Also enabled users to implement their own external object-store interface. Closes AIQ-1965 ## By Submitting this PR I confirm: - I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md). - We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license. - Any contribution which contains commits that are not Signed-Off will not be accepted. - When the PR is ready for review, new or existing tests cover these changes. - When the PR is ready for review, the documentation is up to date with these changes. ## Summary by CodeRabbit - New Features - Secure token storage for MCP OAuth2: in-memory default with optional external object-store backing, persistent across restarts, multi-user isolation, automatic refresh, and graceful fallback. - Documentation - Added “Secure Token Storage” guide with examples and deployment guidance; MCP auth docs and index updated to reference it. - Tests - Extensive tests covering token storage backends, key hashing/serialization, provider integration, lazy object-store resolution, and persistence. Authors: - Yuchen Zhang (https://github.com/yczhang-nv) Approvers: - Eric Evans II (https://github.com/ericevans-nv) URL: NVIDIA#883 Signed-off-by: Yuchen Zhang <[email protected]>
5 participants
Description
Enable optional token storage for MCP OAuth2 with in-memory or external object-store backends (e.g., S3/MinIO), which are persistent and also more secure. Also enabled users to implement their own external object-store interface.
Closes AIQ-1965
By Submitting this PR I confirm:
Summary by CodeRabbit
New Features
Documentation
Tests