{"repo":"NousResearch/hermes-agent","public_id":"109422","display_label":"MCP OAuth identity isolation across multiplexed profiles","summary":"These issues and pull requests concern a bug where multiplexed profiles sharing an OAuth or mTLS MCP server URL could silently adopt each other's authenticated connections or identities. The work focuses on isolating OAuth connections, sessions, and served-profile status per profile.","subsystem":null,"counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":2,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":110193},"resolution":{"state":"resolved","by":"pr-110193"},"freshness":{"state":"verified","last_verified_at":"2026-09-13T22:41:01+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":109422,"pr_number":110193,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":109422,"pr_number":110271,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":109429,"pr_number":110193,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":109901,"pr_number":110271,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":110166,"pr_number":110271,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":109422,"title":"Multiplexed profiles sharing an OAuth MCP server URL silently adopt each other's authenticated identity","url":null,"state":"closed"},{"kind":"pr","number":109428,"title":"fix(mcp): isolate OAuth connections by profile (fixes #109422)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"630a4eb3a100","number":0},{"kind":"pr","value":"#110193","number":110193}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":109430,"title":"fix(mcp): isolate OAuth connections by profile","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#109428","number":109428},{"kind":"pr","value":"#109422","number":109422}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":110021,"title":"fix(mcp): a profile no longer adopts another profile's OAuth connection (#109422, salvage #109428)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"630a4eb3a100","number":0},{"kind":"pr","value":"#110193","number":110193}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":110193,"title":"MCP connections authenticated by OAuth or mTLS are no longer adopted across multiplexed profiles (#109422, #109429; salvage #109428, #109434, #110021)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_mcp_multiplex_connection_keys.py","tools/mcp_tool_registration.py","website/docs/reference/mcp-config-reference.md","website/docs/user-guide/multi-profile-gateways.md"]},{"kind":"pr","number":110271,"title":"Multiplexed profiles keep their own sessions, MCP identities and served-profile status (post-merge reviews on #108294/#108352; salvage #109428 #109434 #109483 #110167 #109930)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["gateway/run.py","gateway/run_adapters.py","gateway/run_notifications.py","gateway/run_profile_reconcile.py","gateway/run_turn.py","gateway/session.py","gateway/session_recovery.py","gateway/status.py","hermes_cli/gateway.py","hermes_cli/gateway_migrate.py","hermes_cli/gateway_multiplex_served.py","hermes_cli/goals.py","hermes_cli/update_inventory.py","hermes_cli/web_routers/mcp.py","tests/gateway/test_multiplex_adapter_registry.py","tests/gateway/test_multiplex_lifecycle.py","tests/gateway/test_multiplex_mcp_discovery.py","tests/gateway/test_multiplex_secondary_port_binding_env.py","tests/gateway/test_multiplex_session_db_profile_scope.py","tests/hermes_cli/test_gateway_migrate_multiplex.py","tests/hermes_cli/test_gateway_multiplex_served_record.py","tests/hermes_cli/test_gateway_multiplex_status.py","tests/hermes_cli/test_goals.py","tests/hermes_cli/test_pooled_served_profile_backend_unscoped.py","tests/hermes_cli/test_served_profile_mirror_platforms.py","tests/hermes_cli/test_update_inventory.py","tests/hermes_cli/test_web_server.py","tests/hermes_cli/test_web_server_profile_unification.py","tests/tools/test_mcp_multiplex_connection_keys.py","tests/tui_gateway/test_launch_db_home_override_race.py","tools/mcp_tool.py","tools/mcp_tool_discovery.py","tools/mcp_tool_handlers.py","tools/mcp_tool_registration.py","tui_gateway/agent_callbacks.py","tui_gateway/methods_prompt.py","tui_gateway/session_notifications.py","website/docs/user-guide/multi-profile-gateways.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}