OAuth Permission Expansion & Consent Review Gate

Compare two local OAuth app manifests and produce a fail-closed permission, publisher and redirect-URI expansion review before human consent.

This downloadable local package turns authorized buyer-supplied files into a fixed, reproducible review packet. It includes an installable Python CLI, a local stdio MCP adapter and a companion Agent Skill.

Outputs

result.json, permission-delta.csv, redirect-uri-delta.csv, issues.jsonl, OAUTH_CONSENT_REVIEW.md and evidence-receipt.json

The core is deterministic, rejects unsafe paths and malformed inputs, never overwrites an existing packet, escapes formula-active CSV cells and binds each input and output with SHA-256. Processing stays local. No API key, login, upload, telemetry or live external action is included.

Best for

SaaS builders, IT administrators and security consultants reviewing OAuth app changes

Requirements

Windows 11 and Python 3.11–3.14; authorized local evidence files in the documented schemas; optional mcp==2.2.0 for the local MCP adapter.

Limitations

No tenant login, token inspection, publisher attestation, consent grant, revocation, malware detection, runtime behavior analysis or security certification. Demand and sales are not guaranteed; this is a one-time local V1.