pomerium / pomerium / 29417408848

53%

Build Type

push

github

Committed by web-flow

Commit Message

feat(mcp): add recommended iss flow metadata to authorization flows (#6496)

## Summary

The incoming MCP spec for 2026-07-28 indicates the authorization servers
SHOULD explicitly include the issuer in the authorization flows as per
RFC 9207.

We return the pomerium host as the issuer and validate remote issuers
when oauth bridging with the upstream mcp server is required.


## Related issues


[ENG-4204](https://linear.app/pomerium/issue/ENG-4204/mcp-support-for-iss-in-authorization-server)

## User Explanation

Pomerium returns its host as the issuer during authorization flows.

## AI disclosure

opus 4.8 was used to update DESIGN.md and some of the e2e tests.

## Checklist

- [X] reference any related issues
- [X] updated unit tests
- [X] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [X] disclosed AI usage (or wrote "none") per AI_POLICY.md
- [X] ready for review

Coverage Stats

22 of 38 new or added lines in 5 files covered. (57.89%)

25 existing lines in 5 files now uncovered.

37012 of 70846 relevant lines covered (52.24%)

460.89 hits per line