dguiducci
6d299472e3
Re-architects MCP from one owner table + agent-written registration into an admin-curated catalog with two runtimes unioned per session, surfaced in the UI as "Connectors" (mcp/schema stays neutral, §0.1). Two runtimes behind one seam (§7): - Global runtime: shared, stateless connectors (web-search, Tavily…) on the HOST, connected at boot from mcp_global_servers, access-filtered per user via mcp_global_access. - Per-user runtime: a user's activated connectors run INSIDE their container, started at first login from mcp_user_servers and living until restart (§9); docker exec -i children die via kill_on_drop when the UserContext drops. - McpProvider trait (mcp/provider.rs): the session round-loop never learns which runtime owns a server. McpManager implements it directly (inert ownerless bundle); UserMcpView implements global ∪ user with an accessible_global snapshot. Both share McpManager::connect_all; McpServerSpec + global_row_spec/user_row_spec turn a DB row into a connectable spec. - mcp-client: McpServerConfig.launch_in runs a stdio command inside a container via docker exec -i (set at runtime, never parsed from config). Authorization is a capability on the role, not `if role==admin` (§0.1/§14): role_capabilities table + db/role_capabilities.rs — register_remote and register_local_from_catalog are self-service (seeded on every new role), while register_local_script and manage_catalog are admin-only. admin holds every capability by construction. This removes the agent-facing register_mcp/delete_mcp tools and the mcp kinds of list_items/toggle_item, closing the §14 RCE vector. Schema: - Registry: mcp_catalog (vetted templates — schema only, no live creds), mcp_global_servers + mcp_global_access, role_capabilities. - Owner: mcp_user_servers (per-user activations; api_key encrypted at rest, catalog_name a bare TEXT snapshot, never an owner→registry FK). - Drops the old owner table mcp_servers. API + UI: src/frontend/api/mcp.rs (admin catalog/global/access + user available/activate/activated, all capability-gated via require_cap); web/components/connectors.js (<connectors-page>) renders the user view always and the admin view for role_id === 'admin'. Deferred: interactive per-user auth (OAuth callback / QR / SSH elicitation, §15) — only none/api_key wired; no boot seed of catalog presets; per-(user, session) MCP grant model still open.
35 lines
1.2 KiB
Rust
35 lines
1.2 KiB
Rust
use std::collections::HashMap;
|
|
|
|
use serde::Deserialize;
|
|
|
|
#[derive(Debug, Deserialize, Clone)]
|
|
pub struct McpServerConfig {
|
|
pub name: String,
|
|
pub transport: McpTransport,
|
|
/// stdio only: the executable to spawn.
|
|
pub command: Option<String>,
|
|
/// stdio only: arguments passed to the command.
|
|
pub args: Option<Vec<String>>,
|
|
/// stdio only: extra environment variables (values support `${VAR}` interpolation).
|
|
pub env: Option<HashMap<String, String>>,
|
|
/// http only: base URL of the MCP server.
|
|
pub url: Option<String>,
|
|
/// http only: API key sent as `Authorization: Bearer <key>` (supports `${VAR}` interpolation).
|
|
pub api_key: Option<String>,
|
|
/// stdio only: when `Some(container)`, the command runs INSIDE that Docker
|
|
/// container via `docker exec -i` instead of on the host. Set at runtime by
|
|
/// the manager (per-user connectors, blueprint §7), never parsed from config.
|
|
#[serde(skip)]
|
|
pub launch_in: Option<String>,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, Clone)]
|
|
#[serde(rename_all = "snake_case")]
|
|
pub enum McpTransport {
|
|
Stdio,
|
|
/// Streamable HTTP (remote MCP servers — previously called SSE).
|
|
Http,
|
|
/// Alias kept for backwards compatibility.
|
|
Sse,
|
|
}
|