Metadata-Version: 2.5
Name: fastmcp-edge-byok
Version: 0.0.1
Summary: Bring-your-own-key credential broker for FastMCP servers (planned; this release only reserves the name).
Project-URL: Homepage, https://github.com/stephaneberle9/fastmcp-edge-byok
Project-URL: Repository, https://github.com/stephaneberle9/fastmcp-edge-byok
Author-email: Stephan Eberle <stephaneberle9@gmail.com>
License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 1 - Planning
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# fastmcp-edge-byok

> [!NOTE]
> Planned, not implemented. The releases published so far only reserve the
> package name on PyPI and contain no code.

`fastmcp-edge-byok` is meant to become a bring-your-own-key credential broker
for [FastMCP](https://gofastmcp.com) servers that front upstream
APIs, where each end user calls the upstream with a credential of their own,
such as a personal access token. After the inbound authentication has
identified the user, it will:

1. look up that user's upstream credential in a store built on
   [fastmcp-creds](https://github.com/stephaneberle9/fastmcp-creds), keyed by
   the user's identity;
2. inject the credential into the outbound upstream call;
3. answer with HTTP 401 and a pointer to the registration flow when the user
   has no credential registered yet;
4. write an audit entry per call that names the user and the credential, never
   the secret.

It is a credential broker, not a policy enforcement point: the upstream itself
authorizes each call through the user's own credential. For a server that uses
one shared service credential instead, see
[fastmcp-edge-authz](https://github.com/stephaneberle9/fastmcp-edge-authz).

## License

MIT
