Documentation
¶
Overview ¶
Package mcp implements the `apic mcp` subcommand.
It serves the apic config-manipulation tool set over MCP for AI agents, across stdio, HTTP and WebSocket transports. Network transports are fail-closed: they require a bearer token and TLS unless explicitly opted out of on a loopback bind, and the `ws` transport additionally requires an explicit Origin policy (--ws-origin or --ws-allow-any-origin).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrMCPTokenTooShort = errors.New("mcp: auth token must be at least 16 bytes")
ErrMCPTokenTooShort is returned when the configured MCP bearer token is shorter than minMCPTokenLen bytes. Surfaced before the server listens.
var ErrWSOriginPolicyRequired = errors.New(
"mcp: --transport ws requires an explicit Origin policy: pass --ws-origin <origin> " +
"(repeatable) to allowlist browser origins, or --ws-allow-any-origin to disable " +
"the SEC-0008 Origin check for a non-browser client")
ErrWSOriginPolicyRequired is returned when --transport ws is asked for without an Origin policy. SEC-0008's gate is fail-closed: an empty allowlist refuses every upgrade, so serving `ws` with neither flag set would bind a listener that can never complete a handshake. Naming both flags in a static message keeps the operator's next move unambiguous.
This is a deliberate behaviour change (v0.19.0): `apic mcp --transport ws` used to pass mcpx.WithWSAllowAnyOrigin(true) unconditionally, so the only way to run it was with Origin checking off and no way to turn it on.
Functions ¶
Types ¶
This section is empty.
Source Files