Repository navigation
feat(mcp): add an MCP server for AI agents, gated by idp:mcp - #72
Merged
Merged
Conversation
Agents such as Claude Code and Codex connect to /api/mcp, sign in through OAuth with dynamic client registration limited to agents, and act with the person's own permissions. Creating applications now inserts the client under the RBAC write lock instead of through the provider's session-only endpoint.
- Agent clients no longer get openid, and a sign-in without a resource gets a token for the MCP server, so an agent registration cannot read profiles or sign people in elsewhere. GET and POST authorization requests are rewritten. - create_application returns the new client's credentials even when the person cannot read applications; update and delete need read access. - Agents are pruned after 60 days without use, recorded on their consent, instead of when they hold no refresh token. - diagnose_application applies each resource's scope policy.
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 2 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
/api/mcp, an MCP server. Claude Code, Codex, Gemini CLI, VS Code and hosted connectors can connect to it and read or change this identity provider for you: debug an app that can't sign people in, register or edit apps, and set up roles, permissions and who holds them.idp:mcp, a new built-in permission (migration0022). Only people who hold it can use the server. Nobody has it yet except Master Admin; give it to a role.idp:mcpaway, or disconnecting the agent, ends access on the next request.idp:mcpare stopped there with a "Back to the agent" button.Setup is one command, for example:
Tools
idp:mcpwhoami,get_server_info,inspect_tokenidp:applications:readlist_applications,get_application,diagnose_applicationidp:applications:writecreate_application,rotate_application_secret; with read alsoupdate_application,delete_applicationidp:people:readsearch_peopleidp:users:readlist_users,get_user; withidp:roles:readalsoexplain_accessidp:roles:read/idp:permissions:readlist_roles,get_role/list_permissionsidp:roles:write/idp:roles:assign/idp:permissions:writelist_audit_eventsdiagnose_applicationis the main debugging tool: it lists bad settings, and given the authorization URL an app sends, it says what/oauth2/authorizewould answer and why (wrong redirect URI with the near miss, scopes, PKCE, resource links and their scope policy).How agents sign in
Standard MCP authorization: protected resource metadata at
/.well-known/oauth-protected-resource/api/mcp, aWWW-Authenticatechallenge, and the authorization server metadata also served at the RFC 8414 paths agents try first.Agents register themselves through Better Auth's dynamic client registration. It is now on, but only for agents:
http://localhost,127.0.0.1or[::1](any port), or exactly to a hosted agent's callback page. Someone who tricks you into approving their client cannot collect the code.idp:mcpandoffline_access. Noopenid, so no ID token and no UserInfo. Agents that ask for more (Codex asks for every listed scope) get only these. A sign-in withoutresourcegets a token for the MCP server, so these tokens work nowhere else./api/mcp, valid 5 minutes. Refresh tokens last 30 days and survive signing out of the website.Other change: creating an application
createOidcClientFnused the provider'sadminCreateOAuthClient, which needs a browser session (an MCP call has none) and writes outside the RBAC lock, followed by a recheck. Both the page and the MCP tool now usecreateOidcClient, which inserts the row under the lock, in the provider's format, the same way update, rotate and delete already work. I replaced the integration test about the old recheck window with one showing nothing is inserted until the lock is held. The test for a key taken in the meantime still passes.Decisions for you
claude.ai,claude.com,chatgpt.com,vscode.dev) are allowed so Claude Desktop, claude.ai and ChatGPT connectors work. The code goes to their servers, so we rely on them tying the sign-in to the right user. Remove them fromHOSTED_MCP_CALLBACKSif you want loopback only.cursor://anysphere…callback, which Better Auth refuses as an invalid app scheme.create_applicationandrotate_application_secretgo back to the agent once, like on the page.Testing
vp check,vp test(331 passed),vp run buildwith the bundle check, and a smoke test of the production bundle.rate-limit"bounds server token traffic", which fails the same way on unmodifiedmainwhen the suites share a database and passes on its own.codex mcp login(it asked for every scope and was narrowed), thencodex execcalledwhoami,list_applications,get_server_infoandlist_roles.claude mcp login→✔ Connected;claude -pcreated an app and diagnosed a broken authorize URL correctly.Review
GPT-6.1-sol (high) reviewed the first commit. It found no critical or high issues, and five medium ones:
openid+claims, noresource) and read name and email from UserInfo. Fixed: noopenidfor agents, andresourcedefaults to the MCP server, for GET and POST.create_applicationcould create the app but lose its one-time secret for someone who can write but not read applications. Fixed.diagnose_applicationignored a resource's scope policy and could call a failing request fine. Fixed, with a test.