5e0be03d18
feat: add OAuth 2.1 authentication for stdio mode
...
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
Add PKCE and device flow OAuth support for stdio mode, enabling
browser-based authentication as an alternative to PATs.
Flow priority (security-ordered):
1. PKCE + browser auto-open (native)
2. PKCE + URL elicitation (Docker with bound port)
3. Device flow fallback (more phishable, last resort)
Key changes:
- internal/oauth: self-contained OAuth manager with PKCE and device flow
- internal/buildinfo: build-time OAuth credential injection via ldflags
- BearerAuthTransport: added TokenProvider for dynamic token resolution
- OAuth middleware intercepts tools/call to trigger lazy authentication
- Scope-based tool filtering using existing SupportedScopes
- PAT remains optional when OAuth credentials are configured
Security:
- PKCE S256 prevents code interception
- State parameter prevents CSRF
- Callback binds to 127.0.0.1 only
- URL elicitation for sensitive URLs (never exposed to LLM)
- Tokens stored in memory only, never persisted to disk
- ReadHeaderTimeout prevents Slowloris on callback server
- html/template auto-escaping prevents XSS in callback pages
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-03-09 13:14:21 +01:00
48a2a05651
Use configured --gh-host as oauth authorization server ( #2046 )
...
When configured with a `--gh-host` argument, construct the OAuth Authorization Server URL from this host, rather than defaulting to `https://github.com/login/oauth `
Co-authored-by: Adam Holt < 4619+omgitsads@users.noreply.github.com >
Co-authored-by: atharva1051 <53966412+atharva1051@users.noreply.github.com >
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
2026-02-24 10:52:19 +01:00
c38802ac80
rename to --exclude-tools
2026-02-18 17:13:41 +01:00
9c8f96f6bf
add header support in http entry point
2026-02-18 17:13:41 +01:00
08231a2aeb
Add support for custom middleware in the correct order. ( #2026 )
...
* Add support for custom middleware in the correct order.
* Switch this up to be more clear on what it's doing
2026-02-18 14:43:59 +01:00
efe9d40b58
Token scopes context ( #1997 )
...
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
* Move scope storage into its own context key, separately from token info.
This allows us to provide scopes seperately in the remote server, where
we have scopes before we do the auth.
* Skip token extraction if token info already exists in context.
This is to avoid redundant token extraction in remote setup where token info may have already been extracted earlier in the request lifecycle.
* Check for existing scopes in context before fetching from GitHub API in scope challenge middleware
* Return error type for unknown tools in inventory builder and handle it in HTTP handler
2026-02-16 14:10:28 +01:00
505d5dc33a
refactor: modernize code with modernize and intrange
2026-02-12 12:58:49 +01:00
bbc675abe9
Make schema cache an opinionated default for HTTP handlers
...
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com >
2026-02-11 11:32:07 +01:00
ed30a1dee8
Co-locate WithSchemaCache with other With functions
...
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com >
2026-02-11 11:32:07 +01:00
ff00c689b0
Add shared SchemaCache for streamable-http server
...
Create a shared mcp.SchemaCache in RunHTTPServer and pass it through
to each per-request MCP Server via ServerOptions. This avoids repeated
JSON schema reflection and resolution when a new Server is created for
every request in stateless mode, matching the pattern used by the
remote server.
2026-02-11 11:32:07 +01:00
bc02fd7354
fix test
2026-02-10 12:55:24 +01:00
858966005f
fix ff hangover from old code
2026-02-10 12:55:24 +01:00
aa302209b0
Add Streamable HTTP mode ( #1849 )
...
Adds new `http` command supporting Streamable HTTP support, OAuth Metadata handler and Scope filtering.
Co-authored-by: kerobbi <kerobbi@github.com >
Co-authored-by: Matt Holloway <mattdholloway@github.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 15:33:41 +01:00
Sam Morrow