TraconMcpSecurityOptions

Namespace Tracon · Assembly Tracon.Abstractions.dll

The security boundary applied to stored MCP server definitions.

public sealed class TraconMcpSecurityOptions

Inheritance

object ← TraconMcpSecurityOptions

Inherited Members

object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Remarks

Read from the Tracon:Mcp configuration section, the same section as the MCP package’s own connection settings.

This type lives in the abstractions package on purpose: the rule is enforced in two places that do not see each other — the endpoint that saves a server definition (Tracon.AspNetCore) and the transport that resolves the key at connection time (Tracon.Mcp). One shared type keeps the two from drifting apart.

Constructors

TraconMcpSecurityOptions()

public TraconMcpSecurityOptions()

Fields

SectionName

Gets the configuration section name.

public const string SectionName = "Tracon:Mcp"

Field Value

string

Properties

AllowedConfigurationPrefix

Gets or sets the only prefix under which a configuration key may be referenced by an MCP server definition. Default is "Tracon:McpSecrets:".

public string AllowedConfigurationPrefix { get; set; }

Property Value

string

Remarks

Covers both key-name fields a definition carries: authorizationConfigurationKey and oauthClientSecretConfigurationKey.

A security boundary, not a convenience default — the same reason as TraconTenantProviderOptions.AllowedConfigurationPrefix. A definition never carries a secret value, only the name of the key the value is read from. Without this restriction that name could point at any configuration key in the application, and its value would be sent to the remote MCP server as an Authorization header.