mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
codex/cli-test-lifecycle-cleanup
2 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Luigi Pederzani
|
6b2db4a2b0 |
docs: reorganize docs and examples around MCP Servers + MCP Apps (#1363)
Reshape docs, examples, and indexes to mirror the README narrative:
MCP Servers + MCP Apps are primary; MCP Agent and MCP Client are
present but secondary. Remove duplicated concepts, deprecated pages,
and stale examples; add redirects for removed paths.
Docs
- Rewrite home/index.mdx: tagline + MCP Server / MCP App split cards,
quickstart tabs, MCP Apps widget snippet, Templates teaser, Inspector,
Deploy, Agent+Client in a collapsed accordion.
- New home/templates.mdx gallery (Chart Builder, Diagram Builder, Slide
Deck, Maps Explorer, Widget Gallery, and more) with demo URLs and
deploy buttons, mirroring the README.
- Simplify python/typescript welcome.mdx: drop duplicated "What is MCP?"
/ "Why mcp-use?" (single pointer to home/mcp101); server-first Next
Steps; fix broken Python links.
- docs.json: Home product reshaped (Welcome, MCP Apps, Templates, Dev
Tools + CLI reference, Concepts, Libraries, Misc). Python
Integrations collapsed into MCP Agents → LLM Adapters.
fastapi_mount added to Python MCP Server Overview. TS MCP Apps adds
creating-mcp-apps-server; OAuth Providers gets keycloak + custom.
Empty API Reference, misrouted Community, and Blog tabs removed from
TS SDK.
- Delete: ui-widgets.mdx, mcp-ui-resources.mdx,
comparison-with-other-implementations.mdx, api-reference.mdx (empty),
typescript/development/security.mdx, python/blog/middleware.mdx,
python/server/auth/index.mdx.
- Redirects: old paths → current equivalents.
- CLI reference: new "What's New" card group (HMR, --tunnel, skills
add, generate-types); cross-link from `start` to Tunneling guide.
Examples
- Rewrite libraries/typescript/.../examples/server/ui/mcp-ui/ as a
programmatic MCP Apps widget gallery (welcome-card, quick-poll,
task-card) using server.uiResource({ type: "mcpApps", htmlTemplate }).
Removes deprecated UIResource / rawHtml / remoteDom patterns.
- Delete empty server/ui/apps-sdk/.
- Fix stale docs URL in server/ui/mcp-apps/apps-sdk/index.ts.
- Update examples/README.md and TS examples README: add Templates
pointer (github.com/mcp-use/mcp-use#templates + docs/home/templates),
list previously-missing examples (mcp-apps, files, model-context,
middleware, session-management, better-auth, Python orphans), flag
apps-sdk as legacy.
|
||
|
Pietro Zullo
|
d789a92b4b |
feat(server): Bearer Token authentication for Python MCP server (#841)
* Fix DNS rebinding protection for cloud/proxy deployments
- Add host/port parameters to MCPServer.__init__() and pass to FastMCP
- Default host to "0.0.0.0" (cloud-friendly, disables DNS protection)
- "127.0.0.1" auto-enables DNS protection (handled by FastMCP)
- run() can override host/port, falls back to __init__ values
- Add comprehensive docstring to __init__() explaining parameters
- Update documentation
This fixes 421 Misdirected Request errors when running behind reverse
proxies (Cloudflare, nginx, etc.) where the Host header doesn't match
the auto-configured allowed_hosts for localhost.
* Fix DNS rebinding protection for cloud/proxy deployments
- Add host/port parameters to MCPServer.__init__() and pass to FastMCP
- Default host to "0.0.0.0" (cloud-friendly, disables DNS protection)
- "127.0.0.1" auto-enables DNS protection (handled by FastMCP)
- run() can override host/port and reconfigures DNS protection accordingly
- Rebuild app when host changes in run() to apply new security settings
- Add comprehensive docstring to __init__() explaining parameters
- Add unit tests for host/port configuration and run() overrides
- Update documentation
This fixes 421 Misdirected Request errors when running behind reverse
proxies (Cloudflare, nginx, etc.) where the Host header doesn't match
the auto-configured allowed_hosts for localhost.
* ruff lint
* Bump mcp minimum version to 1.23.0
Required for TransportSecuritySettings and DNS rebinding protection
auto-configuration feature that was added in v1.23.0.
* feat(server): add bearer token authentication for Python MCP server
Add HTTP-layer bearer token authentication that returns proper 401 responses.
- BearerAuthProvider: abstract base class with verify_token() method
- AccessToken: model with token, claims, and scopes fields
- AuthMiddleware: Starlette middleware returning HTTP 401 for invalid tokens
- get_access_token() / require_auth(): context helpers for tools
Usage:
```python
class MyAuth(BearerAuthProvider):
async def verify_token(self, token: str) -> AccessToken | None:
if token != "secret":
return None
return AccessToken(token=token, claims={"user": "alice"})
server = MCPServer(name="my-server", auth=MyAuth())
```
Closes #840
* autogenerate docs
* test(server): add unit and integration tests for bearer token auth
Unit tests:
- AccessToken model creation and serialization
- BearerAuthProvider abstract class and subclassing
- get_access_token/require_auth context helpers
- AuthMiddleware 401 responses, path exclusion, CORS
Integration tests:
- MCPClient connecting to bearer auth server with valid token
- Connection failure with invalid/missing token
- Tool access to user claims and scopes
* fix(server): address code review feedback for bearer auth
- Fix CORS security: allow_credentials=False with allow_origins=["*"]
- Remove dead try/except import for auth module
- Remove PII (email) from debug logs
- Add comment explaining broad exception handling in verify_token
- Add /openmcp.json to docs excluded paths list
- Remove set_access_token from public API (internal only)
- Create AuthenticationError instead of using ValueError
- Skip middleware tests on older httpx versions (TestClient compat)
* docs: update API documentation for auth module
* fix(server): address Copilot review feedback
- Fix bearer.mdx: require_auth raises AuthenticationError, not ValueError
- Fix API docs: claims and scopes are optional with defaults, not required
- Remove deprecated SSE transport from bearer_auth_server.py test server
* autogenerate docs
* fix(server): address renvins review feedback
- Improve bearer.mdx claims documentation with explanation and examples
- Remove unnecessary cast() for AuthMiddleware in server.py
- Refactor auth tests to use pytest fixtures for cleaner setup/teardown
* docs(auth): clarify that all MCP endpoints are automatically protected
- Add "What Gets Protected" section explaining automatic protection
- Clarify that get_access_token/require_auth are for accessing token data, not protection
- Update examples to show proper usage pattern
- Improve Note at bottom to be clearer
* fix(auth): prevent path prefix bypass in auth middleware
Security fix: Use exact path matching or segment-based prefix matching
instead of simple startswith() to prevent auth bypass attacks.
Before: /docs-secret would bypass auth because it starts with /docs
After: Only /docs and /docs/* bypass auth, /docs-secret requires auth
Added tests for path matching security edge cases.
* refactor(auth): update import paths for authentication components
- Changed import statements in multiple documentation files and source files to reflect the new structure, moving authentication-related imports to the `auth` submodule.
- Updated examples to ensure clarity and consistency in usage patterns for `BearerAuthProvider`, `AccessToken`, `get_access_token`, and `require_auth`.
|