Chetan Sarva 59873342e9 fix: memory leak in external OAuth 2.1 session storage ...

In external OAuth 2.1 mode, skip session storage entirely.
The access token arrives fresh with every request from the external
provider, there's no refresh_token, and the mcp_session_id is
ephemeral (new UUID per request in stateless mode). Storing these
transient tokens creates unbounded dict growth (memory leak) with
entries that are never cleaned up or reused.

Credit to @ljagiello in PR #383
Co-authored-by: lukasz@jagiello.org

2026-01-30 10:17:22 -05:00

32 KiB

Raw Blame History

View Raw