mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
codex/cli-test-lifecycle-cleanup
5 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Pietro Zullo
|
fda92d4ebb |
test(python): add integration tests for resource subscriptions (#1007)
Tests the full subscribe -> update -> notification flow: - Client subscribes, server updates via tool, client receives notification - Client unsubscribes, server updates, no notification received Adds subscribable resource (data://live) and set_live_data tool to primitive server. |
||
|
Pietro Zullo
|
d789a92b4b |
feat(server): Bearer Token authentication for Python MCP server (#841)
* Fix DNS rebinding protection for cloud/proxy deployments
- Add host/port parameters to MCPServer.__init__() and pass to FastMCP
- Default host to "0.0.0.0" (cloud-friendly, disables DNS protection)
- "127.0.0.1" auto-enables DNS protection (handled by FastMCP)
- run() can override host/port, falls back to __init__ values
- Add comprehensive docstring to __init__() explaining parameters
- Update documentation
This fixes 421 Misdirected Request errors when running behind reverse
proxies (Cloudflare, nginx, etc.) where the Host header doesn't match
the auto-configured allowed_hosts for localhost.
* Fix DNS rebinding protection for cloud/proxy deployments
- Add host/port parameters to MCPServer.__init__() and pass to FastMCP
- Default host to "0.0.0.0" (cloud-friendly, disables DNS protection)
- "127.0.0.1" auto-enables DNS protection (handled by FastMCP)
- run() can override host/port and reconfigures DNS protection accordingly
- Rebuild app when host changes in run() to apply new security settings
- Add comprehensive docstring to __init__() explaining parameters
- Add unit tests for host/port configuration and run() overrides
- Update documentation
This fixes 421 Misdirected Request errors when running behind reverse
proxies (Cloudflare, nginx, etc.) where the Host header doesn't match
the auto-configured allowed_hosts for localhost.
* ruff lint
* Bump mcp minimum version to 1.23.0
Required for TransportSecuritySettings and DNS rebinding protection
auto-configuration feature that was added in v1.23.0.
* feat(server): add bearer token authentication for Python MCP server
Add HTTP-layer bearer token authentication that returns proper 401 responses.
- BearerAuthProvider: abstract base class with verify_token() method
- AccessToken: model with token, claims, and scopes fields
- AuthMiddleware: Starlette middleware returning HTTP 401 for invalid tokens
- get_access_token() / require_auth(): context helpers for tools
Usage:
```python
class MyAuth(BearerAuthProvider):
async def verify_token(self, token: str) -> AccessToken | None:
if token != "secret":
return None
return AccessToken(token=token, claims={"user": "alice"})
server = MCPServer(name="my-server", auth=MyAuth())
```
Closes #840
* autogenerate docs
* test(server): add unit and integration tests for bearer token auth
Unit tests:
- AccessToken model creation and serialization
- BearerAuthProvider abstract class and subclassing
- get_access_token/require_auth context helpers
- AuthMiddleware 401 responses, path exclusion, CORS
Integration tests:
- MCPClient connecting to bearer auth server with valid token
- Connection failure with invalid/missing token
- Tool access to user claims and scopes
* fix(server): address code review feedback for bearer auth
- Fix CORS security: allow_credentials=False with allow_origins=["*"]
- Remove dead try/except import for auth module
- Remove PII (email) from debug logs
- Add comment explaining broad exception handling in verify_token
- Add /openmcp.json to docs excluded paths list
- Remove set_access_token from public API (internal only)
- Create AuthenticationError instead of using ValueError
- Skip middleware tests on older httpx versions (TestClient compat)
* docs: update API documentation for auth module
* fix(server): address Copilot review feedback
- Fix bearer.mdx: require_auth raises AuthenticationError, not ValueError
- Fix API docs: claims and scopes are optional with defaults, not required
- Remove deprecated SSE transport from bearer_auth_server.py test server
* autogenerate docs
* fix(server): address renvins review feedback
- Improve bearer.mdx claims documentation with explanation and examples
- Remove unnecessary cast() for AuthMiddleware in server.py
- Refactor auth tests to use pytest fixtures for cleaner setup/teardown
* docs(auth): clarify that all MCP endpoints are automatically protected
- Add "What Gets Protected" section explaining automatic protection
- Clarify that get_access_token/require_auth are for accessing token data, not protection
- Update examples to show proper usage pattern
- Improve Note at bottom to be clearer
* fix(auth): prevent path prefix bypass in auth middleware
Security fix: Use exact path matching or segment-based prefix matching
instead of simple startswith() to prevent auth bypass attacks.
Before: /docs-secret would bypass auth because it starts with /docs
After: Only /docs and /docs/* bypass auth, /docs-secret requires auth
Added tests for path matching security edge cases.
* refactor(auth): update import paths for authentication components
- Changed import statements in multiple documentation files and source files to reflect the new structure, moving authentication-related imports to the `auth` submodule.
- Updated examples to ensure clarity and consistency in usage patterns for `BearerAuthProvider`, `AccessToken`, `get_access_token`, and `require_auth`.
|
||
|
Luigi Pederzani
|
b45d9663ec |
feat(python): introduce roots support in MCPClient and Server (#751)
* fix(python): expose client capabilities to MCP servers Add list_roots_callback support to Python connectors to properly advertise the roots capability during MCP initialization handshake. Previously, the Python library was not exposing any client capabilities because the list_roots_callback was not being passed to ClientSession. This fix ensures the roots capability is always advertised, bringing the Python library in line with the TypeScript implementation. Changes: - Add roots and list_roots_callback params to BaseConnector - Add get_roots() and set_roots() methods for managing roots - Pass list_roots_callback to ClientSession in all connectors - Export Root type from connectors module - Update unit tests to expect list_roots_callback parameter Closes MCP-1063 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(python): add roots and list_roots_callback params to connectors - Add roots and list_roots_callback parameters to StdioConnector, HttpConnector, and SandboxConnector constructors - Add comprehensive unit tests for client capabilities exposure - Tests verify roots capability, get_roots(), set_roots(), and that all callbacks are correctly passed to ClientSession 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: fix import sorting and update API documentation - Fix import sorting in test_client_capabilities.py (ruff) - Regenerate API documentation for updated connector classes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(python): add list_roots() method to server Context Allow MCP servers to request the list of roots from connected clients via ctx.list_roots(). This follows the same pattern as ctx.sample() and ctx.elicit() for server-to-client requests. * feat(python): add roots params to MCPClient and config - Add roots and list_roots_callback parameters to MCPClient.__init__, from_dict(), and from_config_file() methods - Update create_connector_from_config() to pass roots params to all connector types (Stdio, HTTP, Sandbox) - Allows clients to configure roots at the MCPClient level and have them propagate to all sessions * test(python): add get_client_roots tool to primitive server Add a tool that demonstrates the roots capability by requesting and returning the list of roots from the connected client. Used for integration testing of the roots feature. * test(python): add integration tests for roots capability Add comprehensive integration tests for the roots feature: - test_roots_capability: Verify server can request/receive roots - test_roots_empty_by_default: Verify empty roots when not provided - test_roots_with_custom_callback: Verify custom callback precedence - test_set_roots_updates_server_view: Verify dynamic root updates * test(python): update unit tests for roots parameters Update mock assertions in test_client.py to expect the new roots and list_roots_callback parameters in create_connector_from_config calls. * ci(python): add roots to primitive tests and README badge - Add roots to CI workflow primitive test matrix - Add roots to PR comment report primitives list - Add Roots badge to README Primitives row * feat(docs): enhance MCP client and server documentation for roots feature - Added `roots` and `list_roots_callback` parameters to MCP client initialization documentation. - Updated `create_connector_from_config` documentation to include new parameters. - Introduced `list_roots` method documentation in server context, detailing its usage and return values. - Improved overall clarity and completeness of API reference for better developer guidance. * feat(python): add get_client_roots tool to context example - Introduced a new tool, `get_client_roots`, to the context example, demonstrating how to retrieve and display the list of roots exposed by the client. - Updated documentation to include the new tool and its functionality, enhancing the example's coverage of context features. * feat(docs): add roots documentation for client and server - Introduced new documentation for the `roots` feature, detailing how clients can expose file system roots to MCP servers and how servers can access these roots. - Added examples for configuring roots in the MCP client and using the `list_roots()` method in the server context. - Enhanced overall clarity and usability of the documentation to support developers in implementing the roots functionality. --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: pietrozullo <pietro.zullo@gmail.com> |
||
|
Vincenzo Reina
|
aca5f9c040 |
feat(python): Adapt OAuth to 2.1 version from new MCP spec (#518)
* feat: Add PRM in the metadata discovery * fix: fallback anyway to PRM * feat: Implement complete discovery logic * feat: Final implementation of CIMD * feat: Implement PKCE * feat: Add scope from WWW-Authenticate * feat: Add all URLs possible styles * feat: Update tests and example * docs: Update docs * fix: linting * docs: update API documentation * fix: correct typos in OAuth metadata and error messages - Updated the comment in ProtectedResourceMetadata to use the correct abbreviation (PRM). - Fixed a typo in the OAuthAuthenticationError message regarding code challenge support. - Corrected the comment for legacy client paths to use "pre-registered" instead of "pre-reggistered". * feat: restructure authentication documentation and add new methods - Updated the authentication section in to group authentication methods under a new Authentication category with an icon. - Removed the old file and replaced it with new documentation files for Bearer Token, Custom Auth, and OAuth 2.1. - Introduced an overview page for authentication methods, detailing usage and configuration for each method. - Enhanced security best practices and examples for each authentication type to improve clarity and usability. * refactor: improve debug logging for OAuth metadata discovery - Updated debug messages to provide clearer context by specifying the issuer or host being queried during OAuth and OpenID Connect metadata discovery. - Enhanced error logging to remove redundant information, focusing on the failure reason without repeating the URL. * fix: correct abbreviation in ProtectedResourceMetadata documentation - Updated the abbreviation from PRC to PRM in the ProtectedResourceMetadata section to ensure accuracy in the documentation. * fix(oauth): correct RFC 8414 well-known URL construction for path-based issuers The OAuth metadata discovery was incorrectly constructing .well-known URLs by appending to the issuer instead of inserting between host and path. RFC 8414 specifies that for an issuer like https://github.com/login/oauth, the .well-known URL should be: https://github.com/.well-known/oauth-authorization-server/login/oauth We were incorrectly building: https://github.com/login/oauth/.well-known/oauth-authorization-server This fix: - Implements correct RFC 8414 URL construction (insert between host/path) - Supports OpenID Connect style as fallback (append to issuer) - Removes GitHub-specific hardcode since discovery now works correctly - Adds documentation comments explaining the two standards Ref: https://www.rfc-editor.org/rfc/rfc8414.html#section-3 * chore: oauth examples * docs: enhance OAuth endpoint discovery documentation - Updated the OAuth documentation to clarify how `mcp-use` discovers OAuth endpoints using both OAuth 2.0 and OpenID Connect standards. - Added a table detailing the URL construction methods for each standard. - Included examples for better understanding and a note on fallback behavior when the issuer has no path. * response to bs codeql * fix: update API URL Updated the GitHub API URL in the configuration to the correct endpoint for OAuth operations. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: pietrozullo <pietro.zullo@gmail.com> |
||
|
Pietro Zullo
|
be9942a4d4 |
feat/python/server (#559)
* feat: server first implementation * docs: docs for server and images * chore: locked langchain dependencies in pyproject.toml (#321) * python/release/1.3.13 * catch uvicorn logs && log session id * fix debug logic * docs: logging update * fix: icon of elicitation * fix installation paths for local clones * docs: minor restructuring * docs: reorganization, killed non existing pages * docs: beta tag on server * chore: example servers * feat: inspector autopopulated and client only * feat: enhance MCP logging system with customizable formats and improved middleware * feat: implement weather alert and forecast tools in FastMCP example server * mcp path configurable * fix inspector * export as FastMCP too * chore: update fastmcp migration example * lock inspector version * type runner * unhide docs and remove dangers * migration diff * docs and context example * export context * logging improvement * pretty JSON RPC * autoConnect url param in inspecotr * move logging * type check * Server Router * show response logs * fallback tool name to function name in router registration * compatibility export * Introduced ty and prek as type checker and precommit engine respectively - moved ruff config in pyproject toml * add ty check * ty runs only on staged files * ty configuration fix * move startup info in logging * remove bug from action * update claude rules * fix resource serialization * comments on inspector errors * abstracted runner transports * remove redunant call for network * fix ip getter * add inspector mcp path * response limit logging * disable ty check in action * moved transport type to types * support sse * show transport type in logs * change default transport * refactored tests to use mcp server * removed fastmcp * file restructuring * test table * sampling, elicitation, tool disabling enabling * deprecte sse server side * simplified report * fix action * remove sse deprecated test * move tests files to allow for server integration tests * docs * reorg integration test files * api-reference-doxs * fix broken links * telemetry * remove feature useage from scarf |