fix(rest/python): verify request signatures per RFC 9421 instead of accepting everything - #122

Merged

damaz91 merged 9 commits into

Universal-Commerce-Protocol:mainfrom

vishkaty:feat/rfc9421-signatures

Aug 3, 2026

Commits on Aug 3, 2026

feat(python/server): add RFC 9421 signature module with RFC test vectors

katyalai
authored and
damaz91
committed
fix(python/server): verify request signatures instead of accepting everything

katyalai
authored and
damaz91
committed
feat(python/client): sign happy-path requests with an ephemeral key

katyalai
authored and
damaz91
committed
docs(python): document request-signature verification and demo flags

katyalai
authored and
damaz91
committed
test(python/server): self-review hardening + full coverage for the verifier

vishkaty
authored and
damaz91
committed
feat(python/server): align key discovery with merged ucp#566

vishkaty
authored and
damaz91
committed
feat(python/server): verify signatures on the MCP transport route too

katyalai
authored and
damaz91
committed
style: apply ruff-format to signing.py

katyalai
authored and
damaz91
committed
fix(rest/python): normalize client authority and document server DNS rebinding
damaz91
committed