feat(mcp): G6.3 Streamable HTTP 服務、鑑權與單實例 - #20
Merged
Merged
Conversation
- feat(mcp): mebular serve（/mcp、/healthz、OAuth well-known、/authorize PKCE、/token、/register、/token/revoke） - feat(mcp): 認證 none/bearer(tokensFile sha256)/oauth(內置最小 AS+RS，EdDSA JWT)；每 tool scope 校驗（401/403） - feat(mcp): .mebular/lock 單實例（O_EXCL + PID 存活 + 陳舊回收）；非環回無 TLS/auth fail-closed（MCP_INSECURE_CONFIG） - feat(cli): token grant|list|revoke - test(mcp): scripts/verify-mcp-http.mjs（真實 MCP client + 原生 fetch：/mcp、bearer/scope、PKCE、lock 爭用、fail-closed） - ci: build-test-lint job 增 HTTP MCP 步驟 對應 goal-v0.1.md G6.3 與 project-status.md D42。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
G6.3 Streamable HTTP + 鉴权 + 单实例
mebular serve以 Streamable HTTP 暴露 MCP，含认证分层、OAuth 最小 AS+RS、单实例锁与非环回 fail-closed。变更
packages/mcp/src/serve.mjs：Nodehttp/https+ SDKWebStandardStreamableHTTPServerTransport（Node↔Web Request/Response 桥接）。POST /mcp、GET /healthz；OAuth 时/.well-known/oauth-protected-resource、/.well-known/oauth-authorization-server、/jwks、/authorize(PKCE S256)、/token(authorization_code/refresh_token/client_credentials)、/register、/token/revoke。none/bearer（tokensFileJSON 存sha256(token)，0600）/oauth（EdDSA JWT，audience 绑定${issuer}/mcp，access 15min、refresh 30d 轮换）。tools/call按工具映射（import/sync=admin、write=write、其余=read）；无/坏 token→401，scope 不足→403 +WWW-Authenticate: insufficient_scope。<home>/lockO_EXCL + PID 存活 + 陈旧回收；被占MCP_STORAGE_LOCKED。auth != none，否则MCP_INSECURE_CONFIG拒绝启动。--port 0）。mebular token grant|list|revoke。验证（E1）
npm run verify:mcp:http（真实@modelcontextprotocol/client+ 原生fetch）→ 退出码 0：/healthz、真实 clientPOST /mcptools/list+call、无 token 401、错 scope 403、bearer 正确 token 成功、well-known/jwks、PKCE 授权码流程（错误 verifier 400、正确发 token、用 token 调 /mcp）、双实例 lock 争用被拒、非环回无 TLS fail-closed。npm run build && npm run test:coverage && npm run lint全绿（50 套件/377 用例）；npm run verify0–6 全过。决策：D42。