The MCP 2026-07-28 spec makes audience validation a MUST for resource servers. verifyAccessToken rejects a token whose aud names another resource, but accepts one carrying no aud at all, because Socket's introspection endpoint returns only active, client_id, scope, and exp. Defaulting to strict today would reject every live OAuth request.
SOCKET_OAUTH_REQUIRE_AUDIENCE opts a deployment into requiring the claim. Once the authorization server reports aud at introspection, flip that default to on and drop the accept-when-absent branch in lib/oauth.ts.
Blocked on the authorization-server change landing and deploying.
The MCP 2026-07-28 spec makes audience validation a MUST for resource servers.
verifyAccessTokenrejects a token whoseaudnames another resource, but accepts one carrying noaudat all, because Socket's introspection endpoint returns onlyactive,client_id,scope, andexp. Defaulting to strict today would reject every live OAuth request.SOCKET_OAUTH_REQUIRE_AUDIENCEopts a deployment into requiring the claim. Once the authorization server reportsaudat introspection, flip that default to on and drop the accept-when-absent branch inlib/oauth.ts.Blocked on the authorization-server change landing and deploying.