Fix findings from Maycon's AI review pass

- Redact Authorization/X-Admin-Secret/Cookie before the per-request debug
  log — it was writing tenant JWTs, the Truvera API key (passthrough mode),
  and the admin revoke secret to stderr/CloudWatch in plaintext on every
  request. The top-priority finding.
- Extend the per-request session re-auth check (added in an earlier pass)
  from JWT-only to passthrough mode too. It was gated on
  authConfig?.mode === "jwt", so a reused Mcp-Session-Id in passthrough mode
  skipped auth entirely — a leaked session ID rode the original client's
  Truvera API key indefinitely, exactly the gap the code comment claimed
  was closed. Added a mirrored test suite for passthrough alongside the
  existing JWT one.
- Drop the full tool name/description list from the unauthenticated
  /health response, keeping toolCount (which docs and an e2e test already
  depend on). /health has to stay unauthenticated for load balancers and
  uptime monitors, but it doesn't need to hand an unauthenticated caller
  the entire tool surface (delegation, credential issuance, AP2 payment
  tools) up front.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: mike-parkhill

packages/mcp-shared/src/transport/http/index.test.ts

@@ -266,4 +266,95 @@ describe("startHTTPTransport JWT session reuse", () => {
     expect(res.status).not.toBe(401);
     expect(res.status).not.toBe(403);
   });
+});
+
+describe("startHTTPTransport passthrough session reuse", () => {
+  let server: http.Server | undefined;
+  let baseUrl: string;
+  // Passthrough auth resolution has no crypto step, so these tests run back
+  // to back within a few ms — fast enough that a stale keep-alive socket from
+  // the previous test's (now-closed) server can still be sitting in fetch's
+  // connection pool if consecutive tests reuse the exact same port. Starting
+  // each test's port search well above the last one avoids that collision.
+  let nextPort = 41300;
+
+  async function start() {
+    const port = await findNextAvailablePort(nextPort);
+    nextPort = port + 10;
+    server = await startHTTPTransport({
+      serverFactory: () => ({ server: new McpServer({ name: "test-service", version: "0.0.0" }) }),
+      MCP_PORT: port,
+      BUILD_INFO: { timestamp: "2026-01-01T00:00:00Z", buildNumber: 1, version: "0.0.0-test" },
+      tools: [],
+      serviceName: "test-service",
+      authConfig: { mode: "passthrough" },
+    });
+    baseUrl = `http://127.0.0.1:${port}`;
+  }
+
+  afterEach(async () => {
+    if (!server) return;
+    await new Promise<void>((resolve) => server!.close(() => resolve()));
+    server = undefined;
+  });
+
+  async function initialize(apiKey: string) {
+    return fetch(`${baseUrl}/mcp`, {
+      method: "POST",
+      headers: {
+        accept: "application/json, text/event-stream",
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "test", version: "0.0.0" } },
+      }),
+    });
+  }
+
+  function reuseSession(sessionId: string, headers: Record<string, string> = {}) {
+    return fetch(`${baseUrl}/mcp`, {
+      method: "POST",
+      headers: {
+        accept: "application/json, text/event-stream",
+        "content-type": "application/json",
+        "mcp-session-id": sessionId,
+        ...headers,
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }),
+    });
+  }
+
+  it("rejects reuse of a session with no Authorization header", async () => {
+    await start();
+    const initRes = await initialize("client-a-key");
+    expect(initRes.status).toBe(200);
+    const sessionId = initRes.headers.get("mcp-session-id")!;
+    expect(sessionId).toBeTruthy();
+
+    const res = await reuseSession(sessionId);
+    expect(res.status).toBe(401);
+  });
+
+  it("rejects reuse of a session with a different client's API key", async () => {
+    await start();
+    const initRes = await initialize("client-a-key");
+    const sessionId = initRes.headers.get("mcp-session-id")!;
+
+    const res = await reuseSession(sessionId, { authorization: "Bearer client-b-key" });
+    expect(res.status).toBe(403);
+  });
+
+  it("allows reuse of a session with the same client's API key", async () => {
+    await start();
+    const initRes = await initialize("client-a-key");
+    const sessionId = initRes.headers.get("mcp-session-id")!;
+
+    const res = await reuseSession(sessionId, { authorization: "Bearer client-a-key" });
+    expect(res.status).not.toBe(401);
+    expect(res.status).not.toBe(403);
+  });
 });

packages/mcp-shared/src/transport/http/index.ts

@@ -48,6 +48,16 @@ async function readJsonBody(req: IncomingMessage): Promise<unknown> {
   return data ? JSON.parse(data) : undefined;
 }
 
+const SENSITIVE_HEADERS = new Set(["authorization", "x-admin-secret", "cookie"]);
+
+function redactHeaders(headers: IncomingMessage["headers"]): Record<string, unknown> {
+  const redacted: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    redacted[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? "[redacted]" : value;
+  }
+  return redacted;
+}
+
 function secretsMatch(provided: string, expected: string): boolean {
   const providedBuf = Buffer.from(provided);
   const expectedBuf = Buffer.from(expected);
@@ -203,11 +213,14 @@ export async function startHTTPTransport({
   }
 
   const httpServer = http.createServer(async (req: IncomingMessage, res: ServerResponse) => {
-    // Debug: Log all incoming requests
+    // Debug: Log all incoming requests. Headers are redacted — Authorization
+    // carries the tenant JWT or Truvera API key, X-Admin-Secret the revoke
+    // secret; logging those in the clear hands out live credentials to
+    // anyone with log access.
     console.error("[DEBUG] Incoming request:", {
       method: req.method,
       url: req.url,
-      headers: req.headers
+      headers: redactHeaders(req.headers)
     });
 
     // Enable CORS
@@ -222,7 +235,11 @@ export async function startHTTPTransport({
       return;
     }
 
-    // Health check endpoint
+    // Health check endpoint. Deliberately unauthenticated (load balancers and
+    // uptime monitors hit this with no credentials) — so it must not leak
+    // anything beyond "the service is up". Tool names/descriptions map the
+    // whole attack surface (delegation, credential issuance, AP2 payment
+    // tools) to anyone who can reach this port; toolCount alone doesn't.
     if (req.method === "GET" && req.url === "/health") {
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({
@@ -232,7 +249,6 @@ export async function startHTTPTransport({
         buildNumber: BUILD_INFO.buildNumber,
         buildTime: BUILD_INFO.timestamp,
         toolCount: tools.length,
-        tools: tools.map((t) => ({ name: t.name, description: t.description ?? null })),
       }));
       return;
     }
@@ -317,13 +333,15 @@ export async function startHTTPTransport({
       let server: McpServer | undefined;
       let initializedSessionId: string | undefined;
       if (sessionId && typeof sessionId === "string" && transports[sessionId]) {
-        // Existing session: reuse transport and server. In JWT mode, re-check
-        // auth on every request rather than only at session creation — otherwise
-        // a session outlives its token's revocation (POST /admin/revoke-tenant
-        // would have no effect until the client reconnects) and a leaked/guessed
-        // Mcp-Session-Id would grant access with no Authorization header at all.
+        // Existing session: reuse transport and server. In jwt/passthrough mode,
+        // re-check auth on every request rather than only at session creation —
+        // otherwise a session outlives its token's revocation (POST
+        // /admin/revoke-tenant would have no effect until the client
+        // reconnects) and a leaked/guessed Mcp-Session-Id would grant access
+        // (riding the original client's JWT or API key) with no Authorization
+        // header at all.
         const session = transports[sessionId];
-        if (authConfig?.mode === "jwt") {
+        if (authConfig?.mode === "jwt" || authConfig?.mode === "passthrough") {
           let requestAuthContext;
           try {
             requestAuthContext = await resolveAuthContext(req, authConfig);
@@ -335,13 +353,16 @@ export async function startHTTPTransport({
             }
             throw err;
           }
-          if (
-            requestAuthContext.mode !== "jwt" ||
-            session.authContext.mode !== "jwt" ||
-            requestAuthContext.tenantId !== session.authContext.tenantId
-          ) {
+          const credentialsMatch =
+            (requestAuthContext.mode === "jwt" &&
+              session.authContext.mode === "jwt" &&
+              requestAuthContext.tenantId === session.authContext.tenantId) ||
+            (requestAuthContext.mode === "passthrough" &&
+              session.authContext.mode === "passthrough" &&
+              requestAuthContext.apiKey === session.authContext.apiKey);
+          if (!credentialsMatch) {
             res.writeHead(403, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Token does not match this session's tenant" }));
+            res.end(JSON.stringify({ error: "Credentials do not match this session" }));
             return;
           }
         }