angee.agents.mcp_verifier

The agents addon's MCP bearer → actor verifier.

An agents.MCPServer.credential (an integrate.Credential) holds the bearer the agent presents to an internal MCP server. This verifier matches an inbound bearer to that credential and resolves it to the actor the tool bodies run under. It is named by ANGEE_MCP_ACTOR_VERIFIER (see agents.autoconfig); the base angee.mcp runtime calls it and has no knowledge of the catalogue.

resolve_actor

def resolve_actor(bearer: str) -> SubjectRef | None

Return the MCP actor for bearer, or None when no credential matches.

Credential material is encrypted at rest, so the bearer can't be queried by column: the candidate set is the (small, bounded) credentials backing MCP servers, compared by their decrypted secret_value() with a constant-time digest so the match leaks no timing. None (no admin fallback) lets FastMCP deny the request.