# mcp-toolbox configuration for CVE-2026-14537 reproduction.
#
# An MCP-enabled generic auth service protects the toolbox with OAuth scopes
# (authorizationServer points to the local OIDC stub started by
# reproduction_steps.sh). The tool "protected-tool" is protected ONLY through
# the MCP authorization model (tool-level scopesRequired) -- it has no legacy
# `authRequired` entry. On the /mcp endpoint the mcpAuthMiddleware rejects any
# request without a valid Bearer token (401), but on the legacy HTTP API
# (POST /api/tool/protected-tool/invoke, enabled with --enable-api) no MCP
# middleware runs and no scope check is performed, so v1.3.0-v1.4.0 execute
# the tool for completely unauthenticated remote callers.
sources:
  my-sqlite:
    type: sqlite
    database: ":memory:"
authServices:
  my-generic-auth:
    type: generic
    audience: test-audience
    authorizationServer: "http://127.0.0.1:8099"
    scopesRequired:
      - "read:files"
    mcpEnabled: true
tools:
  protected-tool:
    type: sqlite-execute-sql
    source: my-sqlite
    description: Execute arbitrary SQL on SQLite
    scopesRequired:
      - "execute:sql"
