# `ExMCP.Security.TokenHandler`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/security/token_handler.ex#L1)

Handles outbound credential isolation and exact-origin trust classification.

`:trusted_origins` entries are exact HTTP(S) origins: scheme, normalized
host, and effective port must all match. The explicitly broader
`:trusted_hosts` policy exists for loopback compatibility and deployments
that intentionally trust every scheme and port on a host.

# `check_token_passthrough`

```elixir
@spec check_token_passthrough(String.t(), [{String.t(), String.t()}], map()) ::
  {:ok, [{String.t(), String.t()}]}
```

Removes credential headers unless the target matches the configured trust
policy.

# `classify_url`

```elixir
@spec classify_url(String.t(), [String.t()] | map()) :: :internal | :external
```

Classifies a URL against exact origins or a complete security config.

Passing a list applies exact-origin semantics. Passing a map additionally
applies its explicitly broad `:trusted_hosts` entries.

# `extract_origin`

```elixir
@spec extract_origin(String.t()) :: {:ok, String.t()} | {:error, :invalid_uri}
```

Extracts a canonical `scheme://host:port` origin.

# `strip_sensitive_headers`

```elixir
@spec strip_sensitive_headers([{String.t(), String.t()}], :internal | :external) :: [
  {String.t(), String.t()}
]
```

Strips sensitive headers from targets outside the trust boundary.

---

*Consult [api-reference.md](api-reference.md) for complete listing*