{"repo":"NousResearch/hermes-agent","public_id":"109429","display_label":"MCP connection identity isolation for mTLS and OAuth","summary":"These issues and PRs address a bug where mTLS client certificates were excluded from MCP connection identity, causing authenticated connections to leak across multiplexed profiles. The work involves including mTLS credentials in connection identity and isolating mTLS and OAuth connections within their respective profile scopes.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":110193,"merged_at":"2026-09-13T21:38:21+00:00"},"resolution":{"state":"resolved","by":"pr-110193"},"freshness":{"state":"verified","last_verified_at":"2026-09-13T21:38:21+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":109422,"pr_number":110193,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-13T21:38:21+00:00"},{"issue_number":109429,"pr_number":110193,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-13T21:38:21+00:00"}],"members":[{"kind":"issue","number":109429,"title":"mTLS client certs excluded from MCP connection identity - same cross-profile leak shape as #109422","url":null,"state":"closed"},{"kind":"pr","number":109434,"title":"fix(mcp): include mTLS credentials in connection identity","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"630a4eb3a100","number":0},{"kind":"pr","value":"#110193","number":110193}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":109437,"title":"fix(mcp): isolate mTLS connections across profile scopes (#109429)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#109434","number":109434}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":110193,"title":"MCP connections authenticated by OAuth or mTLS are no longer adopted across multiplexed profiles (#109422, #109429; salvage #109428, #109434, #110021)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_mcp_multiplex_connection_keys.py","tools/mcp_tool_registration.py","website/docs/reference/mcp-config-reference.md","website/docs/user-guide/multi-profile-gateways.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}