config

package
v2.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 3, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Index

Constants

View Source 
const LocalIdentityProvider = "mcphub:local"
View Source 
const LocalMFAACR = "urn:mcphub:auth:password-totp"
View Source 
const PermissionGroupProvider = "mcphub:permissions"

Variables

This section is empty.

Functions

func AdminEncryptionKey 

func AdminEncryptionKey(admin AdminConfig) ([]byte, error)

func ApprovalNeedsStepUp 

func ApprovalNeedsStepUp(policies []ToolApprovalPolicy) bool

func ApprovalQuorum 

func ApprovalQuorum(policies []ToolApprovalPolicy) int

func ArgumentValue 

func ArgumentValue(object any, pointer string) (any, bool)

ArgumentValue follows object-key JSON Pointers, matching resource policies.

func CanReviewApproval 

func CanReviewApproval(policies []ToolApprovalPolicy, reviewer, requester string, arguments json.RawMessage, decision bool) bool

Every matching policy must allow this reviewer; grants within a policy are alternatives. Subjects come from the same verified issuer as the requester.

func CheckToolResources 

func CheckToolResources(rules []ResourceRule, arguments json.RawMessage) (json.RawMessage, error)

CheckToolResources requires every matching constraint. Object keys use JSON pointer escaping; a leaf may be a string or a non-empty array of strings. Return normalized JSON so the upstream cannot interpret duplicate keys differently from the values that passed authorization. Numbers retain precision.

func CredentialPolicy added in v2.1.0 

func CredentialPolicy(endpoint string, c *CredentialConfig) string

func HeaderMap 

func HeaderMap(headers map[string]string) http.Header

func ToolEffect 

func ToolEffect(rules []ToolRule, name string) string

Unclassified tools require approval. A write rule takes precedence over every read rule, so a broader rule cannot weaken an explicit write classification.

func ValidVaultPath added in v2.1.0 

func ValidVaultPath(value string) bool

func ValidateToolRules 

func ValidateToolRules(source string, rules []ToolRule) error

Types

type AdminConfig 

type AdminConfig struct {
	RequestRetention Duration         `yaml:"request_retention"`
	Approvals        ApprovalSettings `yaml:"approvals"`
	Enabled          bool             `yaml:"enabled"`
	Mode             string           `yaml:"mode"`
	PublicURL        string           `yaml:"public_url"`
	ClientID         string           `yaml:"client_id"`
	ClientSecretEnv  string           `yaml:"client_secret_env"`
	RequiredScopes   []string         `yaml:"required_scopes"`
	DatabaseDriver   string           `yaml:"database_driver"`
	DatabaseDSNEnv   string           `yaml:"database_dsn_env"`
	Listen           string           `yaml:"listen"`
	DatabasePath     string           `yaml:"database_path"`
	EncryptionKeyEnv string           `yaml:"encryption_key_env"`
}

func (AdminConfig) Driver 

func (admin AdminConfig) Driver() string

func (AdminConfig) Remote 

func (admin AdminConfig) Remote() bool

func (AdminConfig) RequestRetentionDuration added in v2.2.0 

func (admin AdminConfig) RequestRetentionDuration() time.Duration

type ApprovalArchive 

type ApprovalArchive struct {
	URL        string `yaml:"url"`
	SigningKey string `yaml:"signing_key"`
	KeyID      string `yaml:"key_id"`
}

type ApprovalGrant 

type ApprovalGrant struct {
	Subjects  []string       `yaml:"subjects" json:"subjects"`
	Resources []ResourceRule `yaml:"resources" json:"resources,omitempty"`
}

type ApprovalRiskRule 

type ApprovalRiskRule struct {
	Resources         []ResourceRule `yaml:"resources" json:"resources"`
	RequiredApprovals int            `yaml:"required_approvals" json:"required_approvals"`
	RequireStepUp     bool           `yaml:"require_step_up" json:"require_step_up,omitempty"`
}

type ApprovalSettings 

type ApprovalSettings struct {
	PolicyChanges   PolicyChangeSettings `yaml:"policy_changes"`
	Notifications   ApprovalWebhook      `yaml:"notifications"`
	AuditArchive    ApprovalArchive      `yaml:"audit_archive"`
	RequiredScopes  []string             `yaml:"required_scopes"`
	PendingTTL      Duration             `yaml:"pending_ttl"`
	ExecutionTTL    Duration             `yaml:"execution_ttl"`
	Retention       Duration             `yaml:"retention"`
	StepUpACRValues []string             `yaml:"step_up_acr_values"`
}

func (ApprovalSettings) ExecuteDuration 

func (s ApprovalSettings) ExecuteDuration() time.Duration

func (ApprovalSettings) RetainDuration 

func (s ApprovalSettings) RetainDuration() time.Duration

func (ApprovalSettings) Scopes 

func (s ApprovalSettings) Scopes() []string

func (ApprovalSettings) Validate 

func (s ApprovalSettings) Validate() error

func (ApprovalSettings) WaitDuration 

func (s ApprovalSettings) WaitDuration() time.Duration

type ApprovalWebhook 

type ApprovalWebhook struct {
	URL    string `yaml:"url"`
	Secret string `yaml:"secret"`
}

type AuthConfig 

type AuthConfig struct {
	EnterpriseMembershipMaxAge Duration   `yaml:"enterprise_membership_max_age"`
	Mode                       string     `yaml:"mode"`
	Issuer                     string     `yaml:"issuer"`
	SSO                        *SSOConfig `yaml:"sso"`
}

func (AuthConfig) Builtin added in v2.3.0 

func (a AuthConfig) Builtin() bool

type BackendConfig 

type BackendConfig struct {
	Credentials        *CredentialConfig `yaml:"credentials"`
	EndpointUID        string            `yaml:"-"`
	RequireClientGrant bool              `yaml:"require_client_grant"`
	RateLimit          ratelimit.Config  `yaml:"rate_limit"`
	ID                 string            `yaml:"id"`
	URL                string            `yaml:"url"`
	Required           bool              `yaml:"required"`
	RequiredScopes     []string          `yaml:"required_scopes"`
	PublishedTools     []string          `yaml:"published_tools"`
	ToolRules          []ToolRule        `yaml:"tool_rules"`
	RequestTimeout     Duration          `yaml:"request_timeout"`
	AllowInsecureHTTP  bool              `yaml:"allow_insecure_http"`
	Headers            map[string]string `yaml:"headers"`
	OAuth              *OAuthConfig      `yaml:"oauth"`
}

func (BackendConfig) RequiredToolScopes 

func (backend BackendConfig) RequiredToolScopes(toolName string) []string

type ClientAuthorizationConfig 

type ClientAuthorizationConfig struct {
	Enabled            bool     `yaml:"enabled"`
	RequireClientGrant bool     `yaml:"require_client_grant"`
	MaxGrantTTL        Duration `yaml:"max_grant_ttl"`
	ClientID           string   `yaml:"client_id"`
	ClientSecretEnv    string   `yaml:"client_secret_env"`
}

func (ClientAuthorizationConfig) GrantTTL 

func (c ClientAuthorizationConfig) GrantTTL() time.Duration

type ClientEndpointOption 

type ClientEndpointOption struct {
	Prompts        bool               `json:"prompts"`
	Resources      bool               `json:"resources"`
	Subscriptions  bool               `json:"subscriptions"`
	RequiredScopes []string           `json:"required_scopes"`
	ID             string             `json:"id"`
	Tools          []ClientToolOption `json:"tools"`
}

type ClientToolOption 

type ClientToolOption struct {
	Name           string         `json:"name"`
	Effect         string         `json:"effect"`
	RequiredScopes []string       `json:"required_scopes"`
	ResourceRules  []ResourceRule `json:"resource_rules"`
}

type Config 

type Config struct {
	Vault               *VaultConfig              `yaml:"vault"`
	ClientAuthorization ClientAuthorizationConfig `yaml:"client_authorization"`
	Server              ServerConfig              `yaml:"server"`
	Auth                AuthConfig                `yaml:"auth"`
	Admin               AdminConfig               `yaml:"admin"`
	Backends            []BackendConfig           `yaml:"backends"`
}

func Load 

func Load(path string) (*Config, error)

func LoadStatic 

func LoadStatic(path string) (*Config, error)

LoadStatic loads server, auth, and admin configuration without expanding or validating YAML backends when the database-backed admin platform is enabled. This lets an initialized database remain the sole backend source even after bootstrap-only environment variables have been removed.

func (*Config) AllScopes 

func (cfg *Config) AllScopes() []string

func (*Config) Backend 

func (cfg *Config) Backend(id string) (BackendConfig, bool)

func (*Config) ImmutableEqual 

func (cfg *Config) ImmutableEqual(other *Config) error

func (*Config) MCPPath 

func (cfg *Config) MCPPath() string

func (*Config) ResourceMetadataPath 

func (cfg *Config) ResourceMetadataPath() string

func (*Config) ResourceMetadataURL 

func (cfg *Config) ResourceMetadataURL() string

func (*Config) Validate 

func (cfg *Config) Validate() error

type CredentialConfig added in v2.1.0 

type CredentialConfig struct {
	Mode          string         `yaml:"mode" json:"mode"`
	Path          string         `yaml:"path" json:"path,omitempty"`
	Field         string         `yaml:"field" json:"field,omitempty"`
	Header        string         `yaml:"header" json:"header,omitempty"`
	Scheme        string         `yaml:"scheme" json:"scheme,omitempty"`
	DiscoveryPath string         `yaml:"discovery_path" json:"discovery_path,omitempty"`
	OAuth         *PersonalOAuth `yaml:"oauth" json:"oauth,omitempty"`
}

CredentialConfig selects an administrator-owned Vault location. Personal secret paths are allocated by the server, never supplied by an MCP caller.

func CloneCredentials added in v2.1.0 

func CloneCredentials(c *CredentialConfig) *CredentialConfig

func (*CredentialConfig) Validate added in v2.1.0 

func (c *CredentialConfig) Validate(headers map[string]string, oauth *OAuthConfig) error

type Duration 

type Duration struct {
	time.Duration
}

func (*Duration) UnmarshalYAML 

func (d *Duration) UnmarshalYAML(node *yaml.Node) error

type EnterpriseConnections added in v2.3.0 

type EnterpriseConnections struct {
	Revision int64          `json:"revision"`
	OIDC     OIDCConnection `json:"oidc"`
	LDAP     LDAPConnection `json:"ldap"`
}

EnterpriseConnections is persisted as encrypted managed configuration. The two sources have separate identity namespaces and never merge local accounts.

type IdentityAccess 

type IdentityAccess struct {
	EndpointID         string         `json:"endpoint_id"`
	Tools              []string       `json:"tools"`
	AllowWriteRequests bool           `json:"allow_write_requests"`
	Prompts            bool           `json:"prompts"`
	Resources          bool           `json:"resources"`
	Subscriptions      bool           `json:"subscriptions"`
	ResourceRules      []ResourceRule `json:"resource_rules"`
}

type IdentityPermissions 

type IdentityPermissions struct {
	ScopeMode string           `json:"scope_mode,omitempty"`
	Roles     []string         `json:"roles"`
	Scopes    []string         `json:"scopes"`
	Access    []IdentityAccess `json:"access"`
}

Each access entry is an independent grant. Resource predicates must match within one entry, never combined with the tool list of a different grant.

func (IdentityPermissions) AllowsCapability 

func (p IdentityPermissions) AllowsCapability(id, capability string) bool

func (IdentityPermissions) AllowsEndpoint 

func (p IdentityPermissions) AllowsEndpoint(id string) bool

func (IdentityPermissions) AllowsTool 

func (p IdentityPermissions) AllowsTool(id, name, effect string) bool

func (IdentityPermissions) EffectiveScopes 

func (p IdentityPermissions) EffectiveScopes(admin AdminConfig) []string

func (IdentityPermissions) ToolArguments 

func (p IdentityPermissions) ToolArguments(id, name, effect string, args json.RawMessage) (json.RawMessage, error)

func (IdentityPermissions) Validate 

func (p IdentityPermissions) Validate() error

type IdentityProvider 

type IdentityProvider struct {
	Protocol         string   `yaml:"protocol" json:"protocol"`
	Issuer           string   `yaml:"issuer" json:"issuer"`
	AuthorizationURL string   `yaml:"authorization_url" json:"authorization_url"`
	TokenURL         string   `yaml:"token_url" json:"token_url"`
	UserInfoURL      string   `yaml:"userinfo_url" json:"userinfo_url"`
	ClientID         string   `yaml:"client_id" json:"client_id"`
	ClientSecretEnv  string   `yaml:"client_secret_env" json:"client_secret_env"`
	TokenAuthMethod  string   `yaml:"token_auth_method" json:"token_auth_method"`
	Scopes           []string `yaml:"scopes" json:"scopes"`
	SubjectClaim     string   `yaml:"subject_claim" json:"subject_claim"`
	NameClaim        string   `yaml:"name_claim" json:"name_claim"`
	TenantClaim      string   `yaml:"tenant_claim" json:"tenant_claim"`
	TenantValue      string   `yaml:"tenant_value" json:"tenant_value"`
	GroupsClaim      string   `yaml:"groups_claim" json:"groups_claim"`
	DepartmentsClaim string   `yaml:"departments_claim" json:"departments_claim"`
	SuccessClaim     string   `yaml:"success_claim" json:"success_claim"`
	SuccessValue     string   `yaml:"success_value" json:"success_value"`
}

func (IdentityProvider) Namespace 

func (p IdentityProvider) Namespace() string

App-scoped subjects and tenant-local IDs must not inherit another connection's grants when the operator changes the application or subject mapping.

func (*IdentityProvider) Validate added in v2.3.0 

func (p *IdentityProvider) Validate() error

type LDAPConnection added in v2.3.0 

type LDAPConnection struct {
	Enabled            bool   `json:"enabled"`
	URL                string `json:"url"`
	BindDN             string `json:"bind_dn"`
	BindPassword       string `json:"bind_password"`
	UserBaseDN         string `json:"user_base_dn"`
	UserFilter         string `json:"user_filter"`
	UserIDAttribute    string `json:"user_id_attribute"`
	NameAttribute      string `json:"name_attribute"`
	GroupBaseDN        string `json:"group_base_dn"`
	GroupFilter        string `json:"group_filter"`
	GroupIDAttribute   string `json:"group_id_attribute"`
	GroupNameAttribute string `json:"group_name_attribute"`
	RootCAPEM          string `json:"root_ca_pem"`
}

func (LDAPConnection) Namespace added in v2.3.0 

func (p LDAPConnection) Namespace() string

func (LDAPConnection) Validate added in v2.3.0 

func (p LDAPConnection) Validate() error

type OAuthConfig 

type OAuthConfig struct {
	Type         string   `yaml:"type"`
	Issuer       string   `yaml:"issuer"`
	ClientID     string   `yaml:"client_id"`
	ClientSecret string   `yaml:"client_secret"`
	Scopes       []string `yaml:"scopes"`
}

type OIDCConnection added in v2.3.0 

type OIDCConnection struct {
	Enabled      bool             `json:"enabled"`
	Provider     IdentityProvider `json:"provider"`
	ClientSecret string           `json:"client_secret"`
}

type PersonalOAuth added in v2.1.0 

type PersonalOAuth struct {
	Issuer           string   `yaml:"issuer" json:"issuer"`
	ClientID         string   `yaml:"client_id" json:"client_id"`
	ClientSecretPath string   `yaml:"client_secret_path" json:"client_secret_path,omitempty"`
	Scopes           []string `yaml:"scopes" json:"scopes"`
}

type PolicyChangeSettings 

type PolicyChangeSettings struct {
	Enabled        bool     `yaml:"enabled"`
	RequiredScopes []string `yaml:"required_scopes"`
	Subjects       []string `yaml:"subjects"`
	RequireStepUp  bool     `yaml:"require_step_up"`
}

func (PolicyChangeSettings) Scopes 

func (s PolicyChangeSettings) Scopes() []string

type ResourceRule 

type ResourceRule struct {
	Argument      string   `yaml:"argument" json:"argument"`
	AllowedValues []string `yaml:"allowed_values" json:"allowed_values"`
}

func ToolResourceRules 

func ToolResourceRules(rules []ToolRule, name string) []ResourceRule

type SSOClient 

type SSOClient struct {
	RequireConsent bool     `yaml:"require_consent" json:"require_consent"`
	Name           string   `yaml:"name" json:"name,omitempty"`
	ID             string   `yaml:"id" json:"id"`
	RedirectURIs   []string `yaml:"redirect_uris" json:"redirect_uris"`
	Resources      []string `yaml:"resources" json:"resources"`
}

type SSOConfig 

type SSOConfig struct {
	Upstream          IdentityProvider `yaml:"upstream" json:"upstream"`
	Clients           []SSOClient      `yaml:"clients" json:"clients"`
	BootstrapSubjects []string         `yaml:"bootstrap_subjects" json:"bootstrap_subjects"`
	DirectoryTokenEnv string           `yaml:"directory_token_env" json:"directory_token_env"`
}

SSOConfig makes MCPHub the issuer; upstream credentials never reach MCP clients.

type ServerConfig 

type ServerConfig struct {
	Listen              string   `yaml:"listen"`
	PublicURL           string   `yaml:"public_url"`
	PageSize            int      `yaml:"page_size"`
	RequestTimeout      Duration `yaml:"request_timeout"`
	DrainTimeout        Duration `yaml:"drain_timeout"`
	RefreshInterval     Duration `yaml:"refresh_interval"`
	CatalogTTL          Duration `yaml:"catalog_ttl"`
	MaxRequestBodyBytes int64    `yaml:"max_request_body_bytes"`
	AllowedOrigins      []string `yaml:"allowed_origins"`
}

type ToolApprovalPolicy 

type ToolApprovalPolicy struct {
	RequiredApprovals        int                `yaml:"required_approvals" json:"required_approvals,omitempty"`
	RiskRules                []ApprovalRiskRule `yaml:"risk_rules" json:"risk_rules,omitempty"`
	OperationIDArgument      string             `yaml:"operation_id_argument" json:"operation_id_argument,omitempty"`
	StatusTool               string             `yaml:"status_tool" json:"status_tool,omitempty"`
	Approvers                []ApprovalGrant    `yaml:"approvers" json:"approvers,omitempty"`
	RequireDifferentReviewer bool               `yaml:"require_different_reviewer" json:"require_different_reviewer,omitempty"`
	RequireStepUp            bool               `yaml:"require_step_up" json:"require_step_up,omitempty"`
	Action                   string             `yaml:"action" json:"action,omitempty"`
	Environment              string             `yaml:"environment" json:"environment,omitempty"`
	ResourceArguments        []string           `yaml:"resource_arguments" json:"resource_arguments,omitempty"`
	PreviewTool              string             `yaml:"preview_tool" json:"preview_tool,omitempty"`
	VersionArgument          string             `yaml:"version_argument" json:"version_argument,omitempty"`
}

func ResolveApprovalPolicies 

func ResolveApprovalPolicies(policies []ToolApprovalPolicy, arguments json.RawMessage) ([]ToolApprovalPolicy, error)

Resolve risk from the server's policies and the normalized execution arguments. A matching condition can only strengthen the base policy.

func ToolApprovalPolicies 

func ToolApprovalPolicies(rules []ToolRule, name string) []ToolApprovalPolicy

func (ToolApprovalPolicy) Validate 

func (p ToolApprovalPolicy) Validate() error

type ToolRule 

type ToolRule struct {
	Approval       *ToolApprovalPolicy `yaml:"approval" json:"approval,omitempty"`
	Match          string              `yaml:"match" json:"match"`
	Effect         string              `yaml:"effect" json:"effect,omitempty"`
	RequiredScopes []string            `yaml:"required_scopes" json:"required_scopes"`
	ResourceRules  []ResourceRule      `yaml:"resource_rules" json:"resource_rules,omitempty"`
}

func CloneToolRules 

func CloneToolRules(rules []ToolRule) []ToolRule

func (ToolRule) Matches 

func (rule ToolRule) Matches(toolName string) bool

type VaultConfig added in v2.1.0 

type VaultConfig struct {
	Address           string `yaml:"address" json:"address"`
	Mount             string `yaml:"mount" json:"mount"`
	Prefix            string `yaml:"prefix" json:"prefix"`
	Namespace         string `yaml:"namespace" json:"namespace,omitempty"`
	TokenEnv          string `yaml:"token_env" json:"-"`
	RoleIDEnv         string `yaml:"role_id_env" json:"-"`
	SecretIDEnv       string `yaml:"secret_id_env" json:"-"`
	AuthMount         string `yaml:"auth_mount" json:"auth_mount,omitempty"`
	CAFile            string `yaml:"ca_file" json:"-"`
	AllowInsecureHTTP bool   `yaml:"allow_insecure_http" json:"-"`
}

func (*VaultConfig) Validate added in v2.1.0 

func (v *VaultConfig) Validate() error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.