SigNozCAUTION

const secret = "never-log-this-token"

"sk_live_suggestioncanary123456",

"sk_live_detailcanary123456",

"sk_live_detailhintcanary123456",

.goreleaser.yaml

AGENTS.md

"169.254.169.254", // SSRF target blocked once an allowlist is set

server --url http://127.0.0.1:<port>/mcp \

{"http://0.0.0.0:3301", "not allowed"},

return &localHTTPTestServer{URL: "http://127.0.0.1", handler: handler}

url:  "https://1.1.1.1:443",

want: "https://1.1.1.1",

never print or persist credentials, report which fields round-tripped server-side, and prefer

Since tokens are self-contained encrypted blobs, any server instance with the same `OAUTH_TOKEN_SECRET` can validate any token. No sticky sessions or shared state needed. The only requirement is that

The Streamable HTTP transport runs stateless (`WithStateLess(true)`; see [architecture.md](architecture.md)) — no `Mcp-Session-Id` is issued and there is no server-owned session lifecycle to report. T

This is materially different from the post-decrypt OAuth paths (`handleAuthorizationCodeGrant`, `handleRefreshTokenGrant`, `issueTokenPair`), where `signozURL` comes out of an encrypted token the **se

- `README.md`: supported protocol-era/transport table, `server/discover` and legacy initialize behavior, stateless POST-only endpoint, no session ID, and unchanged client configuration.

internal/docs/assets/corpus.gob.gz

When OAuth is enabled, the middleware first tries to decrypt an `Authorization` Bearer token as a server-issued OAuth access token; a valid one unwraps to a stored API key forwarded via `SIGNOZ-API-KE

finds it. Use read-only queries and never persist credentials.

assigning viewer access or creating/revoking credentials.

read-only, avoid logging credentials, and report whether a real recognized

- Do not retry or route around the policy. Ask the user for explicit approval after disclosing the risk. If approved, keep the routing suite non-executing and run only a separately identified read-onl