agentmods.dev

auth

auth is a cursor rule for Cursor from marcushojww/tableau-mcp-v2. It costs 0 tokens per session (878 once invoked), scanned A, a copy of auth, Apache-2.0.

A set of coding rules for handling authentication in a Tableau server application. Authentication is the process of checking who a user is and what access they have.

In plain words
What is it for?
Use it when working on Tableau session authentication, OAuth login, access-token validation, and the server request chain.
Why use it?
It gives authentication code a defined structure, making the supported login methods and middleware order clear.

Cursor rule for Cursor

not rated 0 4mo ago A scan 0 tokens copy · 100% Apache-2.0
View the source file marcushojww/tableau-mcp-v2
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/marcushojww/tableau-mcp-v2/auth
Clone the repo
git clone --depth 1 https://github.com/marcushojww/tableau-mcp-v2

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for auth

README.md
[![agentmods](https://agentmods.dev/badge/rules/marcushojww/tableau-mcp-v2/auth.svg)](https://agentmods.dev/rules/marcushojww/tableau-mcp-v2/auth)
Your own site
<a href="https://agentmods.dev/rules/marcushojww/tableau-mcp-v2/auth"><img src="https://agentmods.dev/badge/rules/marcushojww/tableau-mcp-v2/auth.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 878 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00878
Opus 5 $0.00000 $0.00439
Sonnet 5 $0.00000 $0.00176
Haiku 4.5 $0.00000 $0.00088

Measured 4d ago against content hash 8d49ceb6fc28, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to auth — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.cursor/rules/auth.mdc · 87 lines

How it starts

The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Auth Standards

Three Auth Paths

1. Passthrough Auth

  • Header x-tableau-auth or cookie workgroup_session_id
  • Validated via RestApi.authenticatedServerMethods.getCurrentServerSession()
  • Optional session caching via ExpiringMap (configurable interval)
  • Location: src/server/passthroughAuthMiddleware.ts
  • Enabled when config.enablePassthroughAuth is true
  • MCP scopes NOT enforced (no way to verify original token scopes)

2. Embedded OAuth (PKCE)

  • JWE-encrypted MCP access tokens signed with server's private key
  • Contains embedded Tableau access/refresh tokens
  • EmbeddedAccessTokenValidator validates via jose
  • Location: src/server/oauth/provider.ts, accessTokenValidator.ts, token.ts, authorize.ts, callback.ts

3. Tableau Cloud OAuth

  • Tableau Cloud JWT Bearer tokens
  • TableauAccessTokenValidator validates JWT claims
  • Location: src/server/oauth/provider.ts, accessTokenValidator.ts

Middleware Chain Order (express.ts)

handlePingRequest
  → passthroughAuthMiddleware (if enabled)
    → oauthProvider.authMiddleware
      → validateProtocolVersion
        → createMcpServer

Auth Info Flow

req.auth
  → getTableauAuthInfo(req.auth)
    → TableauAuthInfo (discriminated union: 'X-Tableau-Auth' | 'Bearer' | 'Passthrough')
      → TableauRequestHandlerExtra.tableauAuthInfo
        → useRestApi() (handles sign-in, token setup, sign-out lifecycle)

TableauAuthInfo Type (src/server/oauth/schemas.ts)

Discriminated union on type field:

  • 'X-Tableau-Auth' — username, server, siteId?, userId?, accessToken?, refreshToken?
  • 'Bearer' — username, server, siteId, userId?, raw (the JWT string)
  • 'Passthrough' — username, userId, server, siteId, raw (the session token)

REST API Auth Lifecycle (src/restApiInstance.ts)

useRestApi() is the single entry point for all authenticated API calls:

  • Creates a fresh RestApi instance per call
  • Routes to correct auth method based on tableauAuthInfo.type and config.auth
  • Auth methods: pat, direct-trust, uat, oauth
  • PAT/direct-trust sessions are ephemeral (signed out after use)
  • OAuth/passthrough sessions are long-lived (NOT signed out)
  • Accepts jwtScopes for direct-trust/UAT token generation

Read the full file on GitHub · 87 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 87 lines · 0 tokens per session scan A 8d49ceb6fc28

Subscribe to this mod's changes

auth is a cursor rule published in the GitHub repository marcushojww/tableau-mcp-v2 (0 stars, last pushed 4mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 878 tokens. A static security scan graded it A with 0 findings. It is 100% identical to auth, differing in 0 lines, and is treated as a copy.

Backend and APIsSecurity
Related

Other cursor rules, from other repositories

angular-20

This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.

angular/angular · 0 tokens

dev-standard

Apache Superset development standards and guidelines for Cursor IDE.

apache/superset · 1,147 tokens

cli-error-handling

CLI command error handling patterns.

prisma/orm · 0 tokens

prefer-direct-imports-over-module-mocks

Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.

prisma/orm · 0 tokens

control-plane-descriptors

Control plane descriptor and instance implementation patterns.

prisma/orm · 0 tokens

family-instance-domain-actions

Family instance domain action implementation patterns.

prisma/orm · 0 tokens