Authentication Authorization
JWT, OAuth2, SAML, session management, RBAC, ABAC, and MFA implementation
Install
$ agentstack add skill-cosmicstack-labs-mercury-agent-skills-authentication-authorization ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-cosmicstack-labs-mercury-agent-skills-authentication-authorization) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Authentication & Authorization
Implement secure auth in your applications.
Authentication Methods
| Method | Use Case | Security Level | |--------|----------|---------------| | Session/Cookie | Server-rendered apps | High (HTTP-only, secure flags) | | JWT | APIs, SPAs | Medium (stateless, revocable with blacklist) | | OAuth2 | Third-party login | High (delegate to providers) | | SAML | Enterprise SSO | High (enterprise identity) | | WebAuthn | Passwordless | Very high (biometric, hardware keys) |
JWT Best Practices
- Short expiry (15 min access, 7 day refresh)
- Store refresh tokens in HTTP-only cookies (not localStorage)
- Use RS256 (asymmetric) not HS256 in microservices
- Include minimal claims (sub, exp, iat, scope)
- Always validate signature + expiry + audience
Authorization Models
RBAC (Role-Based)
{
"roles": ["admin", "editor", "viewer"],
"permissions": {
"admin": ["read:*", "write:*", "delete:*"],
"editor": ["read:*", "write:*"],
"viewer": ["read:*"]
}
}ABAC (Attribute-Based)
Policy engine evaluates: user attributes + resource attributes + environment "Allow access if user.department == resource.department AND user.clearance >= resource.classification"
MFA Implementation
- TOTP (Google Authenticator) — standard
- SMS — least secure, avoid if possible
- Push notification — good UX
- Hardware keys (WebAuthn) — most secure
Enforcement
- Require MFA for admin actions
- Require MFA on new device login
- Remember device with a trust token (30 days max)
- Rate-limit MFA attempts
Session Management
- Rotate session ID on login
- Invalidate on password change
- Show active sessions to user (allow remote logout)
- Absolute session timeout (24h) + idle timeout (2h)
- Log all auth events (login, logout, failure, MFA)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: cosmicstack-labs
- Source: cosmicstack-labs/mercury-agent-skills
- License: MIT
- Homepage: https://skills.mercuryagent.sh
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.