oauthproto

Jul 20, 2026

Changes in this version

+ const TokenEndpointAuthMethodClientSecretBasic

+ const TokenEndpointAuthMethodClientSecretPost

Jun 30, 2026

Changes in this version

+ const TokenTypeIDJAG

type RedirectURIPolicy

+ const RedirectURIPolicyAllowHTTP

Jun 23, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 16, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 10, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 10, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 4, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 3, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type DynamicClientRegistrationRequest

+ SoftwareID string

May 22, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 21, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 20, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 19, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const GrantTypeJWTBearer

May 12, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 11, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 7, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ToolHiveClientMetadataDocumentURL

+ func IsClientIDMetadataDocumentURL(clientID string) bool

+ func NewDefaultDCRClient() *http.Client

+ func NewHTTPClient() *http.Client

type AuthorizationServerMetadata

+ ClientIDMetadataDocumentSupported bool

+ func FetchAuthorizationServerMetadataFromURL(ctx context.Context, discoveryURL string, expectedIssuer string, ...) (*AuthorizationServerMetadata, error)

+ type UserAgentTransport struct

+ Base http.RoundTripper

+ func (t *UserAgentTransport) RoundTrip(req *http.Request) (*http.Response, error)

Apr 30, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ var ErrRegistrationEndpointMissing = errors.New("authorization server metadata missing registration_endpoint")

type AuthorizationServerMetadata

+ func FetchAuthorizationServerMetadata(ctx context.Context, issuer string, client *http.Client) (*AuthorizationServerMetadata, error)

Apr 29, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 28, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const GrantTypeAuthorizationCode

+ const GrantTypeRefreshToken

+ const GrantTypeTokenExchange

+ const MaxRedirectURILength

+ const PKCEMethodS256

+ const ResponseTypeCode

+ const TokenEndpointAuthMethodNone

+ const TokenTypeAccessToken

+ const TokenTypeIDToken

+ const TokenTypeJWT

+ const ToolHiveMCPClientName

+ const UserAgent

+ const WellKnownOAuthResourcePath

+ const WellKnownOAuthServerPath

+ const WellKnownOIDCPath

+ var ErrMissingAuthorizationEndpoint = errors.New("missing authorization_endpoint")

+ var ErrMissingIssuer = errors.New("missing issuer")

+ var ErrMissingJWKSURI = errors.New("missing jwks_uri")

+ var ErrMissingResponseTypesSupported = errors.New("missing response_types_supported")

+ var ErrMissingTokenEndpoint = errors.New("missing token_endpoint")

+ func DefaultHTTPClient() *http.Client

+ func IsLoopbackHost(host string) bool

+ func NewFormRequest(ctx context.Context, endpoint string, data url.Values, ...) (*http.Request, error)

+ func Redact(value string) string

+ func ValidateRedirectURI(uri string, policy RedirectURIPolicy) error

+ type AuthorizationServerMetadata struct

+ AuthorizationEndpoint string

+ CodeChallengeMethodsSupported []string

+ GrantTypesSupported []string

+ IntrospectionEndpoint string

+ Issuer string

+ JWKSURI string

+ RegistrationEndpoint string

+ ResponseTypesSupported []string

+ ScopesSupported []string

+ TokenEndpoint string

+ TokenEndpointAuthMethodsSupported []string

+ UserinfoEndpoint string

+ type DynamicClientRegistrationRequest struct

+ ClientName string

+ GrantTypes []string

+ RedirectURIs []string

+ ResponseTypes []string

+ Scopes ScopeList

+ TokenEndpointAuthMethod string

+ type DynamicClientRegistrationResponse struct

+ ClientID string

+ ClientIDIssuedAt int64

+ ClientName string

+ ClientSecret string

+ ClientSecretExpiresAt int64

+ GrantTypes []string

+ RedirectURIs []string

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ ResponseTypes []string

+ Scopes ScopeList

+ TokenEndpointAuthMethod string

+ func RegisterClientDynamically(ctx context.Context, registrationEndpoint string, ...) (*DynamicClientRegistrationResponse, error)

+ type OIDCDiscoveryDocument struct

+ ClaimsSupported []string

+ IDTokenSigningAlgValuesSupported []string

+ SubjectTypesSupported []string

+ func (d *OIDCDiscoveryDocument) SupportsGrantType(grantType string) bool

+ func (d *OIDCDiscoveryDocument) SupportsPKCE() bool

+ func (d *OIDCDiscoveryDocument) Validate(isOIDC bool) error

+ type RedirectURIPolicy int

+ const RedirectURIPolicyAllowPrivateSchemes

+ const RedirectURIPolicyStrict

+ type ScopeList []string

+ func (s *ScopeList) UnmarshalJSON(data []byte) error

+ func (s ScopeList) MarshalJSON() ([]byte, error)

+ type TokenResponse struct

+ IssuedTokenType string

+ Scope string

+ Token *oauth2.Token

+ func DoTokenRequest(client *http.Client, req *http.Request) (*TokenResponse, error)

+ func ParseTokenResponse(resp *http.Response, body []byte) (*TokenResponse, error)