providers: the definition of mercury (Mercury MCP server, dynamic client)

[tarsyang]

What

A provider definition for mercury, the hosted MCP server of Mercury (https://mcp.mercury.com/mcp).

Field	Value
client	dynamic (the operator registers a client for each authorization, RFC 7591, and passes its client_id to oauth/begin)
authorize	https://mcp.mercury.com/authorize, fixed resource=https://mcp.mercury.com/mcp, allowed scope
token	https://mcp.mercury.com/token, client_auth none, form body, fixed resource=https://mcp.mercury.com/mcp
pkce	S256
revoke	none (the authorization server metadata has no revocation_endpoint)
public	scope, expires_in, token_type
api (forward)	mcp.mercury.com, exact /mcp

The values are those of the server metadata, read 2026-10-05:

• GET https://mcp.mercury.com/.well-known/oauth-protected-resource: resource https://mcp.mercury.com/mcp, authorization_servers ["https://mcp.mercury.com/"].
• GET https://mcp.mercury.com/.well-known/oauth-authorization-server: authorization_endpoint /authorize, token_endpoint /token, registration_endpoint /register, code_challenge_methods_supported ["S256"], token_endpoint_auth_methods_supported ["client_secret_basic", "none"], no revocation_endpoint.

The token, authorization and registration addresses share the host of the forward rule; the rule allows the exact path /mcp only, so none of them is reachable through forward (token_and_revocation_addresses_are_not_reachable_by_forward covers the token and authorization addresses, and every_provider_reaches_only_its_own_hosts now denies /token, /register and /mcp/other).

Release

A node refuses oauth/begin for a provider without a definition (provider_unknown), and POST /v1/config refuses a configuration that names one, so the definition takes effect with the release that carries it. No release is cut here and the crate versions are unchanged: the version bump, predecessors.json and the tag belong to the release.

Checks

Check	Result
CI check (pinned toolchain: fmt, clippy, tests, vectors, secret-access)	passed
cargo test -p credential-enclave (local)	213 passed
cargo test -p credential-enclave-host (local)	56 passed

Not run: a live authorization against Mercury (it needs a Mercury account).

[entry-sanio]

Reviewed against the metadata of the server and the rules of enclave.md sections 6 and 7.

The values. Read again today from https://mcp.mercury.com/.well-known/oauth-protected-resource and https://mcp.mercury.com/.well-known/oauth-authorization-server: the resource is https://mcp.mercury.com/mcp, the authorization, token and registration addresses are /authorize, /token and /register of that host, code_challenge_methods_supported is ["S256"], token_endpoint_auth_methods_supported includes none, and there is no revocation_endpoint. The definition states exactly these. It differs from the definition of granola in three values only: the authorization address, the token address and the host of api (with the resource that follows from it).

The address check. The token, authorization and registration addresses are on the host of the forward rule, so what keeps them out of reach of forward is that the rule is the exact path /mcp and no prefix. The load check refuses a definition whose api list reaches its token address, and every_provider_reaches_only_its_own_hosts now denies /token, /register and /mcp/other.

Checks. On b677e49 with the toolchain of rust-toolchain.toml (1.98.1): cargo fmt --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo test --workspace --locked, the vector check and scripts/secret-access.sh --check pass. The tables of the tests and of docs/enclave.md 6.2, 6.4 and 7 carry the same row.

Not covered by this review, as the description says: a live authorization against Mercury.

The definition takes effect with the release that carries it. The version of the crates, predecessors.json and the tag follow in the release.