Skip to content

fix: return 405 for unsupported MCP methods #398

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ricky-7-Yan wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: return 405 for unsupported MCP methods #398

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions actionagent/config/routes.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,9 @@
# dashboard API key rather than a session, so it sits outside the api
# namespace's session-authenticated controllers.
post "mcp", to: "api/mcp#create"
match "mcp", to: ->(_env) { [ 405, { "Allow" => "POST" }, [] ] },
via: [ :get, :delete ],
constraints: ->(request) { request.delete? || !request.format.html? }

# Everything else under the mount is a client-side route: render the
# dashboard and let the browser resolve it. Anchored last so it can only
Expand Down
19 changes: 19 additions & 0 deletions actionagent/test/engine_integration_test.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,25 @@ def setup
assert_includes response.body, "active-agent-dashboard"
end

test "mcp endpoint rejects unsupported transport methods" do
get "/activeagents/mcp", headers: { "Accept" => "text/event-stream" }

assert_response :method_not_allowed
assert_equal "POST", response.headers["Allow"]

delete "/activeagents/mcp"

assert_response :method_not_allowed
assert_equal "POST", response.headers["Allow"]
end

test "mcp dashboard route still renders for browsers" do
get "/activeagents/mcp", headers: { "Accept" => "text/html" }

assert_response :success
assert_includes response.body, "active-agent-dashboard"
end

test "dashboard refuses unauthenticated access in production when no auth is configured" do
Rails.env.stub(:local?, false) do
get "/activeagents/console/traces"
Expand Down