Repository navigation
MCP: a banned person's AI assistant is still recorded as used, because the last-use stamp (#30918) runs before the ban refusal #30949
Description
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
Filing gate: ① a named location, from the contract review of PR #30946 (card #30918, record 6686013581), should-fix item 5; the dev noted it in the report on #30918 and did not file it. ⛔ Not a claim.
PR #30946 adds sys_oauth_consent.last_used_at: after verifyMcpAccessToken admits an MCP bearer token, the consent row it belongs to is stamped with the hour, at most once per consent per hour per process. The card's rule 6 says the time is recorded only on a verified MCP call.
The MCP door reads the ban after the verifier: packages/runtime/src/security/resolve-execution-context.ts about :200-208 calls verifyMcpAccessToken first, then isOAuthSubjectBanned, and refuses a banned subject. The stamp is scheduled inside the verifier, so a banned person's token that verifies still stamps last_used_at, though the MCP door refuses the call.
Reach: an administrator reading GET /admin/authorized-clients?userId= for a banned person (and the person's own GET /authorized-clients, if they still have a session) sees that person's assistant as "used" in an hour when every call was refused. Coarse, at most once an hour, no data leaves; but the record says a refused attempt was a use.
Wanted: the stamp records only a call the MCP door admitted, a banned subject's included. Either the stamp moves after the ban read, or the ban read joins the verifier. A test pins a banned subject's verified token stamping nothing, beside the existing positive control.
Suggested grade: p3, domain:server. Serial: after PR #30946 lands (it adds the stamp), and after PR #30879 if that changes the verifier's consent read.
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p3 ·
domain:server·pm:blocked· 2026-11-06T13:53Z⛔ Not a claim.
last_used_atstamp insideverifyMcpAccessToken. Onmain,resolve-execution-context.tsreadsisOAuthSubjectBannedafter the verifier, so a banned person's verified token would stamp a use the door refuses.domain:server,area:ai.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: unblock ·
pm:blocked→pm:queue· 2026-11-07T16:18Z⛔ Not a claim.
Blocked-by:target is closed, re-read now: Auth: no ledgered read lists the AI assistants a person has authorized, records when one was last used, or lets an admin see a managed person's #30918 (closed completed 2026-11-06T20:56Z); if PR fix(plugin-auth)!: revoke an MCP access token through its OAuth consent #30879 changed the verifier's consent read, re-read the fix shape first, as the audit says.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim: PM loop round 1 · 2026-11-07T17:37Z · seat 6 refill (handed over by seat 5 for its plugin-auth face; no seat-6 p1/p2 dispatchable: #30967 / #30966 wait on PR #31194)
Session:
session_01FEkQ5p3T5YWhLjurajudnQAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-p0qal7Worktree: the card thread's own checkout of
claude/project-thread-p0qal7Domain:
domain:serverSeat:
domain:server#6File surface:
packages/runtime/src/security/resolve-execution-context.ts(the MCP bearer admission),packages/plugins/plugin-auth/src/mcp-client-last-use.ts,auth-manager-mcp-access-token.ts, + tests; root.changeset/. ⛔packages/spec/**,ui/**(stop on breach; explain in the report)Container & model:
Snot mechanical (treated as M),mode:thread,model: default,effort: highClause-②: no (no accept set or public face changes; the dev re-declares if an exported
IAuthServicemember changes shape)Metadata-protocol: none
Responsibility: the stamp scheduled inside the verifier by PR #30946 (plugin-auth, objectstack) runs before the runtime door's ban read; no platform path covers it; reached by an administrator reading
/admin/authorized-clientsfor a banned personThread-read: 6709716960
Premise: holds on
origin/main658d84f5:resolve-execution-context.tsverifies (:200) before:206); #30918 closed, PR #30879 landed (the dev re-reads its consent read first, per triage)isOAuthSubjectBanned(Serial constraints cleared: same-seat #30924 adds a forwarder to
auth-manager.tsand marchtian's PR #31194 touchesauth-manager.ts; this card's surface is the MCP verifier and stamp modules, disjoint; second to land mergesorigin/mainonce