From 3693fdb2f41485dc3740b6a47eb563724a770723 Mon Sep 17 00:00:00 2001
From: Polylane Automation <automation@nominal.ai>
Date: Sat, 20 Jun 2026 13:15:00 +0000
Subject: [PATCH] mcp: add 30s timeouts to remaining unguarded API fetches

---
 apps/mcp/src/auth.ts  | 1 +
 apps/mcp/src/index.ts | 1 +
 2 files changed, 2 insertions(+)

diff --git a/apps/mcp/src/auth.ts b/apps/mcp/src/auth.ts
index 7bd3b946..7bf6bc1b 100644
--- a/apps/mcp/src/auth.ts
+++ b/apps/mcp/src/auth.ts
@@ -103,6 +103,7 @@ export async function validateOAuthToken(
 			headers: {
 				Authorization: `Bearer ${token}`,
 			},
+			signal: AbortSignal.timeout(30_000),
 		})
 
 		if (!sessionResponse.ok) {
diff --git a/apps/mcp/src/index.ts b/apps/mcp/src/index.ts
index 846064e1..45731982 100644
--- a/apps/mcp/src/index.ts
+++ b/apps/mcp/src/index.ts
@@ -89,6 +89,7 @@ app.get("/.well-known/oauth-authorization-server", async (c) => {
 		// Fetch the authorization server metadata from the main API
 		const response = await fetch(
 			`${apiUrl}/.well-known/oauth-authorization-server`,
+			{ signal: AbortSignal.timeout(30_000) },
 		)
 
 		if (!response.ok) {