Tin Chi Lo 0d9c3cf97b fix(mcp): keep out-of-contract upstream error bodies out of client responses ... The token and DCR relays serve unauthenticated OAuth clients, so only the RFC 6749/7591 error fields may cross the trust boundary. A rejection body outside those contracts (HTML error page, proxy banner, stack trace) is now logged server-side, bounded, and the client response names only the upstream status. Addresses the Veria information-exposure finding		2026-07-13 15:13:39 -07:00
..
mcp_server	fix(mcp): keep out-of-contract upstream error bodies out of client responses	2026-07-13 15:13:39 -07:00