---
summary: "Fix `ctx.auth.token` strip in `toAuthContext` ([#121](https://github.com/cyanheads/mcp-ts-core/issues/121)) — typed `token?: string` on `AuthContext`, forwarded by `withAuthInfo` and the ALS bridge so handlers can relay the bearer upstream."
breaking: false
---

# 0.8.18 — 2026-05-06

`toAuthContext` mapped `AuthInfo` → public `AuthContext` but silently dropped `info.token`, so `ctx.auth.token` was always `undefined` even though `claimParser.buildAuthInfoFromClaims()` set it from the verified JWT and the jwt/oauth strategies populated it. Tool handlers needing PAT pass-through / on-behalf-of forwarding had no public API path to the validated bearer (`authContext` ALS isn't re-exported), and the `[key: string]: unknown` index signature on `AuthContext` made `ctx.auth.token` compile cleanly — hiding the bug from typecheck and `createMockContext({ auth: { token } })` unit tests.

## Fixed

- **`ctx.auth.token` reaches handlers** ([#121](https://github.com/cyanheads/mcp-ts-core/issues/121)) — `toAuthContext` in `src/utils/internal/requestContext.ts` now spreads `info.token` when present. Covers both call sites: `withAuthInfo` (initial request context, including auto-task `callerAuth` capture) and the ALS bridge in `createRequestContext` (handler-created child contexts). Logger pino-redact paths (`token`, `*.token`, `*.*.token`) already mask the field, so naive `ctx.log.info({ auth: ctx.auth })` doesn't leak the bearer.

## Changed

- **`AuthContext.token`** — typed `token?: string` on the public interface. Consumers no longer need the `(ctx.auth as { token?: string }).token` cast.
- **Dependency bumps:** `hono` `^4.12.17` → `^4.12.18` (security release: GHSA-p77w-8qqv-26rm cache leakage, GHSA-qp7p-654g-cw7p `hono/jsx` CSS injection, GHSA-hm8q-7f3q-5f36 JWT `NumericDate`; framework doesn't use the affected surfaces, but the bumped peer floor protects downstream consumers); `chrono-node` `^2.9.0` → `^2.9.1`; `@opentelemetry/sdk-node` / `exporter-trace-otlp-http` / `exporter-metrics-otlp-http` / `instrumentation-http` `^0.216.0` → `^0.217.0`; `@opentelemetry/instrumentation-pino` `^0.62.0` → `^0.63.0`.
