~bigbes/sr-ht-dolt · parade

main · last commit 5 hours ago · ti41arbu

← Back to the parade

sr-ht-dolt-0qf.6 Wire /mcp into the daemon, config and README Past Stand

status: closed P2 task
bd reopen sr-ht-dolt-0qf.6
Created byEugene Blikh
Ownerbigbes@gmail.com
Created2026-08-12T20:11:47Z
Started2026-08-13T06:07:15Z
Updated2026-08-13T06:25:23Z
Closed2026-08-13T06:25:23Z
Description
Register the MCP handler in cmd/doltsrht/main.go with r.Handle("/mcp", …) before web.Register and outside its CSRF group (bearer surface, no Origin, no cookie), document [tokens.sr.ht]origin in config.example.ini, and describe the surface in README.md.
Design
docs/DESIGN.mcp.md §3, §10. Handle and not Mount: Mount rewrites the path to the empty remainder and claims /mcp/*. No mcp-enabled switch — a surface that is off in production is one nobody tests.
Acceptance criteria
An httptest boot proves /mcp answers a tools/list and that the CSRF guard does not touch it, while a browser POST to a web form still requires same origin.
Notes
Also amend authn/ctx.go's package doc: it still says 'the three authentication flows' and does not mention the bearer plane added in 6288fc1. The wiring commit is where that sentence becomes wrong in a way a reader can see.

Depends on

  • sr-ht-dolt-0qf.4 — mcpsrv: generic tools over the browse seam blocks closed
  • sr-ht-dolt-0qf.5 — mcpsrv: beads tools over the shared projection blocks closed
  • sr-ht-dolt-0qf — MCP surface: a read-only agent door to hosted databases parent-child closed

Depended on by

Nothing depends on this issue.

Prerequisite chain — everything this waits on, transitively

  • sr-ht-dolt-0qf.4 — mcpsrv: generic tools over the browse seam blocks closed
  • sr-ht-dolt-0qf — MCP surface: a read-only agent door to hosted databases parent-child closed
  • sr-ht-dolt-0qf.3 — mcpsrv: skeleton, Host allowlist, grant gate, list_databases blocks closed
  • sr-ht-dolt-0qf.2 — authn: the tokens.sr.ht bearer plane and core.GrantRead blocks closed
  • sr-ht-dolt-0qf.5 — mcpsrv: beads tools over the shared projection blocks closed
  • sr-ht-dolt-0qf.1 — Extract the beads projection into a root beads/ package blocks closed

No comments.

Close reason

Landed in 57adcc0: /mcp mounted on the web listener before web.Register and outside its CSRF group, bearer validator from [tokens.sr.ht] (absent = nil validator, daemon boots, working tokens refused), config.example.ini and README documented, authn/ctx.go now names four flows. Measured: anonymous tools/list POST to /mcp = 200 even with a foreign Origin; a cross-origin POST to /create = 403.
  • Eugene Blikh added under epic sr-ht-dolt-0qf · 2026-08-12T23:11:46Z
  • Eugene Blikh created the issue · 2026-08-12T23:11:46Z
  • Eugene Blikh added dependency on sr-ht-dolt-0qf.4 · 2026-08-12T23:12:56Z
  • Eugene Blikh added dependency on sr-ht-dolt-0qf.5 · 2026-08-12T23:12:57Z
  • Eugene Blikh updated notes to Also amend authn/ctx.go's package doc: it still says 'the three authentication flows' and does not mention the bearer plane added in 6288fc1. The wiring commit is where that sentence becomes wrong in a way a reader can see. · 2026-08-12T23:27:32Z
  • Eugene Blikh changed status to in_progress · 2026-08-13T09:07:14Z
  • Eugene Blikh closed the issue · 2026-08-13T09:25:23Z
    Landed in 57adcc0: /mcp mounted on the web listener before web.Register and outside its CSRF group, bearer validator from [tokens.sr.ht] (absent = nil validator, daemon boots, working tokens refused), config.example.ini and README documented, authn/ctx.go now names four flows. Measured: anonymous tools/list POST to /mcp = 200 even with a foreign Origin; a cross-origin POST to /create = 403.
Stored rows — what this pane was built from, as read
issues 1 row
id sr-ht-dolt-0qf.6
content_hash 60d5c474af1047fa392cd9d63c9cb26b0accfdf049c3f41f371722ea531999d1
title Wire /mcp into the daemon, config and README
description Register the MCP handler in cmd/doltsrht/main.go with r.Handle("/mcp", …) before web.Register and outside its CSRF group (bearer surface, no Origin, no cookie), document [tokens.sr.ht]origin in config.example.ini, and describe the surface in README.md.
design docs/DESIGN.mcp.md §3, §10. Handle and not Mount: Mount rewrites the path to the empty remainder and claims /mcp/*. No mcp-enabled switch — a surface that is off in production is one nobody tests.
acceptance_criteria An httptest boot proves /mcp answers a tools/list and that the CSRF guard does not touch it, while a browser POST to a web form still requires same origin.
notes Also amend authn/ctx.go's package doc: it still says 'the three authentication flows' and does not mention the bearer plane added in 6288fc1. The wiring commit is where that sentence becomes wrong in a way a reader can see.
status closed
priority 2
issue_type task
assignee NULL
estimated_minutes NULL
created_at 2026-08-12T20:11:47Z
created_by Eugene Blikh
owner bigbes@gmail.com
updated_at 2026-08-13T06:25:23Z
closed_at 2026-08-13T06:25:23Z
closed_by_session
external_ref NULL
spec_id
compaction_level 0
compacted_at NULL
compacted_at_commit NULL
original_size NULL
sender
ephemeral 0
wisp_type
pinned 0
is_template 0
mol_type
work_type
source_system
metadata �{}
source_repo
close_reason Landed in 57adcc0: /mcp mounted on the web listener before web.Register and outside its CSRF group, bearer validator from [tokens.sr.ht] (absent = nil validator, daemon boots, working tokens refused), config.example.ini and README documented, authn/ctx.go now names four flows. Measured: anonymous tools/list POST to /mcp = 200 even with a foreign Origin; a cross-origin POST to /create = 403.
event_kind
actor
target
payload
await_type
await_id
timeout_ns 0
waiters
hook_bead
role_bead
agent_state
last_activity NULL
role_type
rig
due_at NULL
defer_until NULL
no_history 0
started_at 2026-08-13T06:07:15Z
is_blocked 0
dependencies 3 rows
id 2f47f333-ffc0-5034-8f29-e2d752909357
issue_id sr-ht-dolt-0qf.6
type blocks
created_at 2026-08-12T23:12:56Z
created_by Eugene Blikh
metadata �{}
thread_id
depends_on_issue_id sr-ht-dolt-0qf.4
depends_on_wisp_id NULL
depends_on_external NULL
id c7b6a153-008a-5100-8739-82f8756417d5
issue_id sr-ht-dolt-0qf.6
type blocks
created_at 2026-08-12T23:12:57Z
created_by Eugene Blikh
metadata �{}
thread_id
depends_on_issue_id sr-ht-dolt-0qf.5
depends_on_wisp_id NULL
depends_on_external NULL
id c8edf5f3-6bf5-53cd-b71f-592e7509200a
issue_id sr-ht-dolt-0qf.6
type parent-child
created_at 2026-08-12T23:11:46Z
created_by Eugene Blikh
metadata �{}
thread_id
depends_on_issue_id sr-ht-dolt-0qf
depends_on_wisp_id NULL
depends_on_external NULL
events 4 rows
id 019ff79a-35ca-7382-a055-c714bae743d5
issue_id sr-ht-dolt-0qf.6
event_type created
actor Eugene Blikh
old_value
new_value
comment NULL
created_at 2026-08-12T23:11:46Z
id 019ff7a8-a6ed-700f-8c0c-d239f9bf438d
issue_id sr-ht-dolt-0qf.6
event_type updated
actor Eugene Blikh
old_value {"id":"sr-ht-dolt-0qf.6","title":"Wire /mcp into the daemon, config and README","description":"Register the MCP handler in cmd/doltsrht/main.go with r.Handle(\"/mcp\", …) before web.Register and outside its CSRF group (bearer surface, no Origin, no cookie), document [tokens.sr.ht]origin in config.example.ini, and describe the surface in README.md.","design":"docs/DESIGN.mcp.md §3, §10. Handle and not Mount: Mount rewrites the path to the empty remainder and claims /mcp/*. No mcp-enabled switch — a surface that is off in production is one nobody tests.","acceptance_criteria":"An httptest boot proves /mcp answers a tools/list and that the CSRF guard does not touch it, while a browser POST to a web form still requires same origin.","status":"open","priority":2,"issue_type":"task","owner":"bigbes@gmail.com","created_at":"2026-08-12T20:11:47Z","created_by":"Eugene Blikh","updated_at":"2026-08-12T20:11:47Z"}
new_value {"notes":"Also amend authn/ctx.go's package doc: it still says 'the three authentication flows' and does not mention the bearer plane added in 6288fc1. The wiring commit is where that sentence becomes wrong in a way a reader can see."}
comment NULL
created_at 2026-08-12T23:27:32Z
id 019ff9bb-61e6-7bbf-9998-27f8e78fbfad
issue_id sr-ht-dolt-0qf.6
event_type status_changed
actor Eugene Blikh
old_value {"id":"sr-ht-dolt-0qf.6","title":"Wire /mcp into the daemon, config and README","description":"Register the MCP handler in cmd/doltsrht/main.go with r.Handle(\"/mcp\", …) before web.Register and outside its CSRF group (bearer surface, no Origin, no cookie), document [tokens.sr.ht]origin in config.example.ini, and describe the surface in README.md.","design":"docs/DESIGN.mcp.md §3, §10. Handle and not Mount: Mount rewrites the path to the empty remainder and claims /mcp/*. No mcp-enabled switch — a surface that is off in production is one nobody tests.","acceptance_criteria":"An httptest boot proves /mcp answers a tools/list and that the CSRF guard does not touch it, while a browser POST to a web form still requires same origin.","notes":"Also amend authn/ctx.go's package doc: it still says 'the three authentication flows' and does not mention the bearer plane added in 6288fc1. The wiring commit is where that sentence becomes wrong in a way a reader can see.","status":"open","priority":2,"issue_type":"task","owner":"bigbes@gmail.com","created_at":"2026-08-12T20:11:47Z","created_by":"Eugene Blikh","updated_at":"2026-08-12T20:27:33Z"}
new_value {"status":"in_progress"}
comment NULL
created_at 2026-08-13T09:07:14Z
id 019ff9cb-fd64-7caa-8c35-bc9f53418f83
issue_id sr-ht-dolt-0qf.6
event_type closed
actor Eugene Blikh
old_value
new_value Landed in 57adcc0: /mcp mounted on the web listener before web.Register and outside its CSRF group, bearer validator from [tokens.sr.ht] (absent = nil validator, daemon boots, working tokens refused), config.example.ini and README documented, authn/ctx.go now names four flows. Measured: anonymous tools/list POST to /mcp = 200 even with a foreign Origin; a cross-origin POST to /create = 403.
comment NULL
created_at 2026-08-13T09:25:23Z