Sam Morrow
5e0be03d18
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
Add PKCE and device flow OAuth support for stdio mode, enabling browser-based authentication as an alternative to PATs. Flow priority (security-ordered): 1. PKCE + browser auto-open (native) 2. PKCE + URL elicitation (Docker with bound port) 3. Device flow fallback (more phishable, last resort) Key changes: - internal/oauth: self-contained OAuth manager with PKCE and device flow - internal/buildinfo: build-time OAuth credential injection via ldflags - BearerAuthTransport: added TokenProvider for dynamic token resolution - OAuth middleware intercepts tools/call to trigger lazy authentication - Scope-based tool filtering using existing SupportedScopes - PAT remains optional when OAuth credentials are configured Security: - PKCE S256 prevents code interception - State parameter prevents CSRF - Callback binds to 127.0.0.1 only - URL elicitation for sensitive URLs (never exposed to LLM) - Tokens stored in memory only, never persisted to disk - ReadHeaderTimeout prevents Slowloris on callback server - html/template auto-escaping prevents XSS in callback pages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
53 lines
2.2 KiB
Docker
53 lines
2.2 KiB
Docker
FROM node:20-alpine@sha256:09e2b3d9726018aecf269bd35325f46bf75046a643a66d28360ec71132750ec8 AS ui-build
|
|
WORKDIR /app
|
|
COPY ui/package*.json ./ui/
|
|
RUN cd ui && npm ci
|
|
COPY ui/ ./ui/
|
|
# Create output directory and build - vite outputs directly to pkg/github/ui_dist/
|
|
RUN mkdir -p ./pkg/github/ui_dist && \
|
|
cd ui && npm run build
|
|
|
|
FROM golang:1.25.7-alpine@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS build
|
|
ARG VERSION="dev"
|
|
|
|
# Set the working directory
|
|
WORKDIR /build
|
|
|
|
# Install git
|
|
RUN --mount=type=cache,target=/var/cache/apk \
|
|
apk add git
|
|
|
|
# Copy source code (including ui_dist placeholder)
|
|
COPY . .
|
|
|
|
# Copy built UI assets over the placeholder
|
|
COPY --from=ui-build /app/pkg/github/ui_dist/* ./pkg/github/ui_dist/
|
|
|
|
# Build the server. OAuth credentials are injected via build secrets to avoid
|
|
# leaking them in image history. Secrets are read at build time only.
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=secret,id=oauth_client_id \
|
|
--mount=type=secret,id=oauth_client_secret \
|
|
export OAUTH_CLIENT_ID="$(cat /run/secrets/oauth_client_id 2>/dev/null || echo '')" && \
|
|
export OAUTH_CLIENT_SECRET="$(cat /run/secrets/oauth_client_secret 2>/dev/null || echo '')" && \
|
|
CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION} -X main.commit=$(git rev-parse HEAD) -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ) -X github.com/github/github-mcp-server/internal/buildinfo.OAuthClientID=${OAUTH_CLIENT_ID} -X github.com/github/github-mcp-server/internal/buildinfo.OAuthClientSecret=${OAUTH_CLIENT_SECRET}" \
|
|
-o /bin/github-mcp-server ./cmd/github-mcp-server
|
|
|
|
# Make a stage to run the app
|
|
FROM gcr.io/distroless/base-debian12@sha256:937c7eaaf6f3f2d38a1f8c4aeff326f0c56e4593ea152e9e8f74d976dde52f56
|
|
|
|
# Add required MCP server annotation
|
|
LABEL io.modelcontextprotocol.server.name="io.github.github/github-mcp-server"
|
|
|
|
# Set the working directory
|
|
WORKDIR /server
|
|
# Copy the binary from the build stage
|
|
COPY --from=build /bin/github-mcp-server .
|
|
# Expose the default port
|
|
EXPOSE 8082
|
|
# Set the entrypoint to the server binary
|
|
ENTRYPOINT ["/server/github-mcp-server"]
|
|
# Default arguments for ENTRYPOINT
|
|
CMD ["stdio"]
|