Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5bc5a25

Browse files
dannykoppingdannykopping
committed
feat: external auth MCP URL & allow/denylist
1 parent e4346f3 commit 5bc5a25

File tree

9 files changed

+80
-0
lines changed

9 files changed

+80
-0
lines changed

‎cli/server.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2717,6 +2717,12 @@ func parseExternalAuthProvidersFromEnv(prefix string, environ []string) ([]coder
27172717
provider.DisplayName = v.Value
27182718
case "DISPLAY_ICON":
27192719
provider.DisplayIcon = v.Value
2720+
case "MCP_URL":
2721+
provider.MCPURL = v.Value
2722+
case "MCP_TOOL_ALLOWLIST":
2723+
provider.MCPToolAllowlist = v.Value
2724+
case "MCP_TOOL_DENYLIST":
2725+
provider.MCPToolDenylist = v.Value
27202726
}
27212727
providers[providerNum] = provider
27222728
}

‎coderd/apidoc/docs.go

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/externalauth/externalauth.go

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,17 @@ type Config struct {
8181
// AppInstallationsURL is an API endpoint that returns a list of
8282
// installations for the user. This is used for GitHub Apps.
8383
AppInstallationsURL string
84+
// MCPURL is the endpoint that clients must use to communicate with the associated
85+
// MCP server.
86+
MCPURL string
87+
// MCPToolAllowlistPattern is a [regexp.Regexp] to match tools which are explicitly allowed to be
88+
// injected into Coder AI Bridge upstream requests.
89+
// In the case of conflicts, [MCPToolDenylistPattern] overrides items evaluated by this list.
90+
MCPToolAllowlistPattern *regexp.Regexp
91+
// MCPToolAllowlistPattern is a [regexp.Regexp] to match tools which are explicitly NOT allowed to be
92+
// injected into Coder AI Bridge upstream requests.
93+
// In the case of conflicts, items evaluated by this list override [MCPToolAllowlistPattern].
94+
MCPToolDenylistPattern *regexp.Regexp
8495
}
8596

8697
// GenerateTokenExtra generates the extra token data to store in the database.
@@ -608,6 +619,21 @@ func ConvertConfig(instrument *promoauth.Factory, entries []codersdk.ExternalAut
608619
instrumented = instrument.NewGithub(entry.ID, oauthConfig)
609620
}
610621

622+
var mcpToolAllow *regexp.Regexp
623+
var mcpToolDeny *regexp.Regexp
624+
if entry.MCPToolAllowlist != "" {
625+
mcpToolAllow, err = regexp.Compile(entry.MCPToolAllowlist)
626+
if err != nil {
627+
return nil, xerrors.Errorf("compile MCP tool allowlist for external auth provider %q: %w", entry.ID, entry.MCPToolAllowlist)
628+
}
629+
}
630+
if entry.MCPToolDenylist != "" {
631+
mcpToolDeny, err = regexp.Compile(entry.MCPToolDenylist)
632+
if err != nil {
633+
return nil, xerrors.Errorf("compile MCP tool denylist for external auth provider %q: %w", entry.ID, entry.MCPToolDenylist)
634+
}
635+
}
636+
611637
cfg := &Config{
612638
InstrumentedOAuth2Config: instrumented,
613639
ID: entry.ID,
@@ -620,6 +646,9 @@ func ConvertConfig(instrument *promoauth.Factory, entries []codersdk.ExternalAut
620646
DisplayName: entry.DisplayName,
621647
DisplayIcon: entry.DisplayIcon,
622648
ExtraTokenKeys: entry.ExtraTokenKeys,
649+
MCPURL: entry.MCPURL,
650+
MCPToolAllowlistPattern: mcpToolAllow,
651+
MCPToolDenylistPattern: mcpToolDeny,
623652
}
624653

625654
if entry.DeviceFlow {

‎codersdk/deployment.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,9 @@ type ExternalAuthConfig struct {
737737
ExtraTokenKeys []string `json:"-" yaml:"extra_token_keys"`
738738
DeviceFlow bool `json:"device_flow" yaml:"device_flow"`
739739
DeviceCodeURL string `json:"device_code_url" yaml:"device_code_url"`
740+
MCPURL string `json:"mcp_url" yaml:"mcp_url"`
741+
MCPToolAllowlist string `json:"mcp_tool_allowlist" yaml:"mcp_tool_allowlist"`
742+
MCPToolDenylist string `json:"mcp_tool_denylist" yaml:"mcp_tool_denylist"`
740743
// Regex allows API requesters to match an auth config by
741744
// a string (e.g. coder.com) instead of by it's type.
742745
//

‎docs/reference/api/general.md

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/reference/api/schemas.md

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎site/src/api/typesGenerated.ts

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎site/src/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ const meta: Meta<typeof ExternalAuthSettingsPageView> = {
2323
device_code_url: "",
2424
display_icon: "",
2525
display_name: "GitHub",
26+
mcp_url: "",
27+
mcp_tool_allowlist: "",
28+
mcp_tool_denylist: "",
2629
},
2730
],
2831
},

0 commit comments

Comments
 (0)