Commit Graph

13 Commits

Author SHA1 Message Date
RossTarrant d0320b870d Allow browser-based MCP clients via CORS and cross-origin bypass 2026-04-21 16:31:01 +02:00
Sam Morrow a24c0be254 refactor: migrate MCP Apps from insiders mode to feature flag
Rebase PR #2282 onto main (post-#2332) and unify feature flag
allowlists into a single source of truth.

- Add MCPAppsFeatureFlag, AllowedFeatureFlags, InsidersFeatureFlags,
  and ResolveFeatureFlags in feature_flags.go
- AllowedFeatureFlags includes all user-controllable flags (MCP Apps +
  granular), InsidersFeatureFlags only includes MCPAppsFeatureFlag
- HeaderAllowedFeatureFlags() now delegates to AllowedFeatureFlags
- Builder uses feature checker instead of insidersMode bool
- Remove InsidersOnly field from ServerTool and WithInsidersMode from
  Builder
- HTTP feature checker uses ResolveFeatureFlags for per-request
  resolution with insiders expansion
- Tool handlers check MCPAppsFeatureFlag via IsFeatureEnabled instead
  of InsidersMode

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-16 11:41:19 +02:00
Matt Holloway efcaead5b5 feat(http): update knownFeatureFlags to use HeaderAllowedFeatureFlags() and add tests for feature flag validation 2026-04-15 17:36:32 +02:00
Matt Holloway 3cf4124dcf feat(http): implement HeaderAllowedFeatureFlags for X-MCP-Features header validation 2026-04-15 17:36:32 +02:00
Sam Morrow 372c874f30 feat(http): enforce static CLI flags as upper bound for per-request filtering
The HTTP server now respects the same static CLI flags as the stdio
server: --toolsets, --tools, --exclude-tools, --read-only,
--dynamic-toolsets, and --insiders.

A static inventory is built once at startup from these flags, producing
a pre-filtered tool/resource/prompt universe. Per-request headers
(X-MCP-Toolsets, X-MCP-Tools, etc.) can only narrow within these
bounds, never expand beyond them. When no static flags are set, the
existing behavior is preserved — headers have full access to all
toolsets.

Fixes #2156

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-13 14:50:24 +02:00
Matt Holloway dd239d8443 Initial OSS logging adapter for http (#2008)
* initial logging stack for http

* add metrics adapter

* fix linter issues

* make log fields generic

* Update pkg/github/server_test.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Remove unused SlogMetrics adapter

The slog-based metrics adapter was never used — OSS always uses
NoopMetrics and the remote server has its own DataDog-backed adapter.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update pkg/github/dependencies.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fmt

* change to use slog

* address feedback

* rename noop adapter to noop sink

* Update pkg/http/server.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* [WIP] [WIP] Address feedback on OSS logging adapter for http implementation (#2264)

* Initial plan

* Fix BaseDeps.Logger and BaseDeps.Metrics to return safe defaults when Obsv is nil

Agent-Logs-Url: https://github.com/github/github-mcp-server/sessions/53221b0b-abb4-4138-a147-3ce9e13b379a

Co-authored-by: mattdholloway <918573+mattdholloway@users.noreply.github.com>

* Fix nil metrics in server.go by passing metrics.NewNoopMetrics() to NewExporters

Agent-Logs-Url: https://github.com/github/github-mcp-server/sessions/53221b0b-abb4-4138-a147-3ce9e13b379a

Co-authored-by: mattdholloway <918573+mattdholloway@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mattdholloway <918573+mattdholloway@users.noreply.github.com>
Co-authored-by: Matt Holloway <mattdholloway@github.com>

* replace nil with stubs

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
2026-03-31 13:10:22 +01:00
copilot-swe-agent[bot] 74507a00ab Use translation strings for server name/title override
Instead of new CLI flags (--server-name, --server-title), reuse the
existing string override mechanism that already supports tool title/
description overrides throughout the codebase.

Users can now configure the server name and title via:
  - GITHUB_MCP_SERVER_NAME / GITHUB_MCP_SERVER_TITLE env vars
  - "SERVER_NAME" / "SERVER_TITLE" keys in github-mcp-server-config.json

This is consistent with how all other user-visible strings are
overridden (e.g. GITHUB_MCP_TOOL_GET_ME_USER_TITLE). No new struct
fields or CLI flags are needed.

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-03-16 15:03:13 +01:00
copilot-swe-agent[bot] 0fda6f1509 Add configurable server name and title via env/flag
Allows users running multiple GitHub MCP Server instances (e.g., for
github.com and GitHub Enterprise Server) to override the server name and
title in the MCP initialization response.

- Add --server-name / GITHUB_SERVER_NAME flag+env to override name
- Add --server-title / GITHUB_SERVER_TITLE flag+env to override title
- Defaults remain "github-mcp-server" and "GitHub MCP Server"
- Applies to both stdio and HTTP server modes
- Add tests for default and custom name/title

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-03-16 15:03:13 +01:00
Atharva Patil 48a2a05651 Use configured --gh-host as oauth authorization server (#2046)
When configured with a `--gh-host` argument, construct the OAuth Authorization Server URL from this host, rather than defaulting to `https://github.com/login/oauth`

Co-authored-by: Adam Holt < 4619+omgitsads@users.noreply.github.com>
Co-authored-by: atharva1051 <53966412+atharva1051@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
2026-02-24 10:52:19 +01:00
copilot-swe-agent[bot] bbc675abe9 Make schema cache an opinionated default for HTTP handlers
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-02-11 11:32:07 +01:00
Sam Morrow ff00c689b0 Add shared SchemaCache for streamable-http server
Create a shared mcp.SchemaCache in RunHTTPServer and pass it through
to each per-request MCP Server via ServerOptions. This avoids repeated
JSON schema reflection and resolution when a new Server is created for
every request in stateless mode, matching the pattern used by the
remote server.
2026-02-11 11:32:07 +01:00
Matt Holloway 858966005f fix ff hangover from old code 2026-02-10 12:55:24 +01:00
Adam Holt aa302209b0 Add Streamable HTTP mode (#1849)
Adds new `http` command supporting Streamable HTTP support, OAuth Metadata handler and Scope filtering.

Co-authored-by: kerobbi <kerobbi@github.com>
Co-authored-by: Matt Holloway <mattdholloway@github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-02-06 15:33:41 +01:00