src/http.js shares one MCP server instance and calls setAccessToken per request (same class as GHSA-345p-7cg4-v4c7)

[dickhardt]

MCPHttpServer in src/http.js creates one HelloMCPServer and calls setAccessToken / setJWTPayload on it per request. Two concurrent requests with different tokens race on authManager state, so one caller's tool call can run with another caller's token. This is the same class of bug as GHSA-345p-7cg4-v4c7 (cross-client data leak via shared server/transport reuse in @modelcontextprotocol/sdk ≤1.25.3), but it lives in this repo; the SDK bump to 1.30.0 on chore/deps-latest does not fix it.

Fix would be a per-request auth context (AsyncLocalStorage, already used in src/log.js) or a per-request server instance. Related: src/mcp_router.js reads the private Server._requestHandlers map; a move to the MCP SDK v2 split packages (@modelcontextprotocol/server 2.0.0) would need a public handler registry or the SDK's StreamableHTTPServerTransport.

admin-mcp is slated for deprecation in favour of exposing the Admin APIs as an AAuth resource, so the fix may be to retire the service rather than patch it. Decide which.

Found during the Node 24 / dependency upgrade, 2026-09-06 (see chore/deps-prune branch)