mcp

package
v1.115.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: Apache-2.0 Imports: 48 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrPendingOAuthNoWaiter = errNoWaiter

ErrPendingOAuthNoWaiter is returned by DeliverPendingOAuthCallback when no flow is currently awaiting the given state. The HTTP handler surfaces this as 404.

Functions

func BuildAuthorizationURL 

func BuildAuthorizationURL(authEndpoint, clientID, redirectURI, state, codeChallenge, resourceURL string, scopes []string) string

BuildAuthorizationURL builds the OAuth authorization URL with PKCE.

func CreateToolSet added in v1.60.0 

func CreateToolSet(ctx context.Context, toolset latest.Toolset, runConfig *config.RuntimeConfig) (tools.ToolSet, error)

CreateToolSet is used by the tools registry.

func DeliverPendingOAuthCallback added in v1.69.0 

func DeliverPendingOAuthCallback(state string, cb PendingOAuthCallback) error

DeliverPendingOAuthCallback hands a deeplink-relayed callback to the in-process unmanaged-OAuth flow that's currently waiting on `state`.

Returns nil on success. ErrPendingOAuthNoWaiter signals that no flow is currently awaiting this state -- which is the expected behavior for replays, stale callbacks, and any state value the agent did not itself generate, and which the HTTP route surfaces as 404. Any other error is internal.

Exposed for the embedder's HTTP handler at POST /api/mcp-oauth/callback.

func GeneratePKCEVerifier 

func GeneratePKCEVerifier() string

GeneratePKCEVerifier generates a PKCE code verifier using oauth2 library

func GenerateState 

func GenerateState() (string, error)

GenerateState generates a random state parameter for OAuth CSRF protection

func InteractivePromptsAllowed added in v1.87.0 

func InteractivePromptsAllowed(ctx context.Context) bool

InteractivePromptsAllowed forwards to tools.InteractivePromptsAllowed.

func IsAuthorizationRequired added in v1.54.0 

func IsAuthorizationRequired(err error) bool

IsAuthorizationRequired forwards to tools.IsAuthorizationRequired.

func IsOAuthDeclined added in v1.70.2 

func IsOAuthDeclined(err error) bool

IsOAuthDeclined forwards to tools.IsOAuthDeclined.

func PerformOAuthLogin added in v1.44.0 

func PerformOAuthLogin(ctx context.Context, serverURL string) error

PerformOAuthLogin performs a standalone OAuth flow for the given MCP server URL. It discovers the authorization server metadata, performs dynamic client registration, opens the browser for user authorization, and stores the resulting token in the keyring.

func RegisterClient 

func RegisterClient(ctx context.Context, authMetadata *AuthorizationServerMetadata, redirectURI string, scopes []string) (clientID, clientSecret string, err error)

RegisterClient performs dynamic client registration

func RemoveOAuthToken added in v1.44.0 

func RemoveOAuthToken(resourceURL string) error

RemoveOAuthToken deletes the token stored for resourceURL.

func RequestAuthorizationCode 

func RequestAuthorizationCode(ctx context.Context, authURL string, callbackServer *CallbackServer, expectedState string) (string, string, error)

RequestAuthorizationCode requests the user to open the authorization URL and waits for the callback

func SetDefaultTokenStoreFactory added in v1.84.0 

func SetDefaultTokenStoreFactory(factory OAuthTokenStoreFactory)

SetDefaultTokenStoreFactory installs the process-wide persistent token-store factory used by NewKeyringTokenStore and remote MCP toolsets. Embedders that do not need persistent MCP OAuth storage can avoid importing any OS keyring implementation; docker-agent's CLI registers one from pkg/tools/mcp/keyringstore.

It must be called before the default store is first constructed (i.e. before any NewKeyringTokenStore call); doing otherwise would leave early callers holding a different store instance than later ones, so it panics to surface the misordering instead of silently diverging.

func WithoutInteractivePrompts added in v1.54.0 

func WithoutInteractivePrompts(ctx context.Context) context.Context

WithoutInteractivePrompts forwards to tools.WithoutInteractivePrompts.

Types

type AuthorizationRequiredError added in v1.54.0 

type AuthorizationRequiredError = tools.AuthorizationRequiredError

AuthorizationRequiredError is an alias for tools.AuthorizationRequiredError.

type AuthorizationServerMetadata 

type AuthorizationServerMetadata = oauthflow.AuthorizationServerMetadata

AuthorizationServerMetadata is an alias for oauthflow.AuthorizationServerMetadata.

type CallbackServer 

type CallbackServer = oauthflow.CallbackServer

CallbackServer is an alias for oauthflow.CallbackServer.

func NewCallbackServer 

func NewCallbackServer(ctx context.Context) (*CallbackServer, error)

NewCallbackServer creates a new OAuth callback server on a random available port

func NewCallbackServerOnPort added in v1.46.0 

func NewCallbackServerOnPort(ctx context.Context, port int) (*CallbackServer, error)

NewCallbackServerOnPort creates a new OAuth callback server on a specific port. Use port 0 to let the OS pick a random available port.

type GatewayToolset 

type GatewayToolset struct {
	*Toolset
	// contains filtered or unexported fields
}

func NewGatewayToolset 

func NewGatewayToolset(ctx context.Context, name, mcpServerName string, secrets []gateway.Secret, config any, envProvider environment.Provider, cwd string) (*GatewayToolset, error)

func (*GatewayToolset) Stop 

func (t *GatewayToolset) Stop(ctx context.Context) error

type InMemoryTokenStore 

type InMemoryTokenStore struct {
	// contains filtered or unexported fields
}

func (*InMemoryTokenStore) GetToken 

func (s *InMemoryTokenStore) GetToken(resourceURL string) (*OAuthToken, error)

func (*InMemoryTokenStore) RemoveToken 

func (s *InMemoryTokenStore) RemoveToken(resourceURL string) error

func (*InMemoryTokenStore) StoreToken 

func (s *InMemoryTokenStore) StoreToken(resourceURL string, token *OAuthToken) error

type OAuthDeclinedError added in v1.70.2 

type OAuthDeclinedError = tools.OAuthDeclinedError

OAuthDeclinedError is an alias for tools.OAuthDeclinedError.

type OAuthToken 

type OAuthToken = oauthflow.OAuthToken

OAuthToken is an alias for oauthflow.OAuthToken.

func ExchangeCodeForToken 

func ExchangeCodeForToken(ctx context.Context, tokenEndpoint, code, codeVerifier, clientID, clientSecret, redirectURI string) (*OAuthToken, error)

ExchangeCodeForToken exchanges an authorization code for an access token.

func ExchangeCodeForTokenWithResource added in v1.63.0 

func ExchangeCodeForTokenWithResource(ctx context.Context, tokenEndpoint, code, codeVerifier, clientID, clientSecret, redirectURI, resourceURL string) (*OAuthToken, error)

ExchangeCodeForTokenWithResource exchanges an authorization code and sends the RFC 8707 resource indicator to token endpoints that require it.

func RefreshAccessToken added in v1.44.0 

func RefreshAccessToken(ctx context.Context, tokenEndpoint, refreshToken, clientID, clientSecret string) (*OAuthToken, error)

RefreshAccessToken uses a refresh token to obtain a new access token without user interaction.

type OAuthTokenEntry added in v1.44.0 

type OAuthTokenEntry struct {
	ResourceURL string
	Token       *OAuthToken
}

OAuthTokenEntry pairs a stored OAuth token with its resource URL.

func ListOAuthTokens added in v1.44.0 

func ListOAuthTokens() ([]OAuthTokenEntry, error)

ListOAuthTokens returns every OAuth token from the registered persistent store.

type OAuthTokenStore 

type OAuthTokenStore interface {
	// GetToken retrieves a token for the given resource URL
	GetToken(resourceURL string) (*OAuthToken, error)
	// StoreToken stores a token for the given resource URL
	StoreToken(resourceURL string, token *OAuthToken) error
	// RemoveToken removes a token for the given resource URL
	RemoveToken(resourceURL string) error
}

OAuthTokenStore manages OAuth tokens

func NewInMemoryTokenStore 

func NewInMemoryTokenStore() OAuthTokenStore

NewInMemoryTokenStore creates a new in-memory token store

func NewKeyringTokenStore added in v1.44.0 

func NewKeyringTokenStore() OAuthTokenStore

NewKeyringTokenStore returns the process-wide persistent OAuth token store. The name is kept for compatibility; without an optional keyring-backed store registered by pkg/tools/mcp/keyringstore, it falls back to an in-memory store.

type OAuthTokenStoreFactory added in v1.84.0 

type OAuthTokenStoreFactory func() OAuthTokenStore

OAuthTokenStoreFactory constructs the process-wide persistent OAuth token store.

type PendingOAuthCallback added in v1.69.0 

type PendingOAuthCallback struct {
	Code    string
	Error   string
	ErrDesc string
}

PendingOAuthCallback is the payload delivered out-of-band to a pending unmanaged OAuth flow, by an embedder that received the deeplink callback (e.g. a system-wide URL-scheme handler or an OS-integrated launcher) and POSTs the payload to docker-agent's /api/mcp-oauth/callback route.

Exactly one of Code (success) or Error (failure) is set.

type PromptArgument 

type PromptArgument = tools.PromptArgument

PromptArgument is an alias for tools.PromptArgument.

type PromptInfo 

type PromptInfo = tools.PromptInfo

PromptInfo is an alias for tools.PromptInfo.

type Toolset 

type Toolset struct {
	// contains filtered or unexported fields
}

Toolset represents a set of MCP tools.

Connection lifecycle (initial connect, watcher goroutine, restart with backoff, graceful Stop) is delegated to a *lifecycle.Supervisor; the historical watchConnection / tryRestart / forceReconnectAndWait helpers have been replaced by the supervisor's Start / RestartAndWait / Stop.

func NewRemoteToolset 

func NewRemoteToolset(name, urlString, transport string, headers map[string]string, oauthConfig *latest.RemoteOAuthConfig, policy ...lifecycle.Policy) *Toolset

NewRemoteToolset creates a new MCP toolset from a remote MCP Server.

The optional policy lets callers tune restart/backoff behaviour; see NewToolsetCommand for the semantics.

func NewRemoteToolsetWithAllowPrivateIPs added in v1.63.0 

func NewRemoteToolsetWithAllowPrivateIPs(
	name, urlString, transport string,
	headers map[string]string,
	oauthConfig *latest.RemoteOAuthConfig,
	allowPrivateIPs bool,
	policy ...lifecycle.Policy,
) *Toolset

NewRemoteToolsetWithAllowPrivateIPs creates a new remote MCP toolset and optionally permits OAuth helper requests to dial non-public IP addresses.

func NewToolsetCommand 

func NewToolsetCommand(name, command string, args, env []string, cwd string, policy ...lifecycle.Policy) *Toolset

NewToolsetCommand creates a new MCP toolset from a command.

The optional policy lets callers tune restart/backoff behaviour. When the zero value is passed the supervisor uses its built-in defaults (RestartOnFailure, 5 attempts, 1s..32s backoff). Internal callbacks (OnDisconnect, OnRestart, Logger) are always set by the constructor and any values passed in for those fields are ignored.

func (*Toolset) Describe 

func (ts *Toolset) Describe() string

Describe returns a short, user-visible description of this toolset instance. It never includes secrets.

func (*Toolset) GetPrompt 

func (ts *Toolset) GetPrompt(ctx context.Context, name string, arguments map[string]string) (*mcp.GetPromptResult, error)

GetPrompt retrieves a specific prompt with provided arguments from the MCP server. This method executes the prompt and returns the result content.

func (*Toolset) Instructions 

func (ts *Toolset) Instructions() string

func (*Toolset) IsStarted added in v1.54.0 

func (ts *Toolset) IsStarted() bool

IsStarted reports whether the supervisor currently considers the toolset connected and serving requests. Used by tests and TUI status surfaces.

func (*Toolset) Kind added in v1.54.0 

func (ts *Toolset) Kind() string

Kind returns a short, user-friendly classification of this toolset: "Remote MCP" for HTTP/SSE/streamable-HTTP transports and "MCP" for stdio-spawned servers. Used by status surfaces (e.g. the /tools dialog) to label the toolset without leaking Go type names.

func (*Toolset) ListPrompts 

func (ts *Toolset) ListPrompts(ctx context.Context) ([]PromptInfo, error)

ListPrompts retrieves available prompts from the MCP server. Returns a slice of PromptInfo containing metadata about each available prompt including name, description, and argument specifications.

func (*Toolset) Name added in v1.54.0 

func (ts *Toolset) Name() string

Name returns the user-facing identifier for this MCP toolset.

When the YAML provides a `name:` field it always wins (it's also the prefix applied to every tool exposed by the server, so a stable user choice). Otherwise we fall back to the description — "mcp(stdio cmd=docker)", "mcp(remote host=api.github.com)", "mcp(ref=duckduckgo)" — because that disambiguates between several unnamed MCP toolsets far better than the bare YAML type "mcp" the registry would otherwise fall back to.

func (*Toolset) Restart added in v1.54.0 

func (ts *Toolset) Restart(ctx context.Context) error

Restart brings the toolset back up regardless of state. Failed or Stopped supervisors are recovered via Start (RestartAndWait would return immediately because `done` is closed). Otherwise the current session is dropped and we wait for the supervisor to reconnect, up to sessionMissingRetryTimeout.

func (*Toolset) SetElicitationHandler 

func (ts *Toolset) SetElicitationHandler(handler tools.ElicitationHandler)

func (*Toolset) SetManagedOAuth 

func (ts *Toolset) SetManagedOAuth(managed bool)

func (*Toolset) SetOAuthSuccessHandler 

func (ts *Toolset) SetOAuthSuccessHandler(handler func())

func (*Toolset) SetSamplingHandler added in v1.60.0 

func (ts *Toolset) SetSamplingHandler(handler tools.SamplingHandler)

func (*Toolset) SetSamplingWithToolsHandler added in v1.104.0 

func (ts *Toolset) SetSamplingWithToolsHandler(handler tools.SamplingWithToolsHandler)

func (*Toolset) SetStandaloneSSE added in v1.114.0 

func (ts *Toolset) SetStandaloneSSE(enable bool)

SetStandaloneSSE opts a remote streamable toolset in to the transport's standalone SSE GET stream. Required for servers that send server-initiated requests outside of client calls (some MCP gateways send a keepalive ping on the standalone stream and close the session when it cannot be delivered). No-op for stdio toolsets. Call before Start; takes effect on the next connect.

func (*Toolset) SetToolsChangedHandler 

func (ts *Toolset) SetToolsChangedHandler(handler func())

func (*Toolset) SetUnmanagedOAuthRedirectURI added in v1.69.0 

func (ts *Toolset) SetUnmanagedOAuthRedirectURI(uri string)

func (*Toolset) Start 

func (ts *Toolset) Start(ctx context.Context) error

Start performs the initial connect via the supervisor. If the connect fails (e.g. the server binary is missing), Start returns the underlying error and the toolset stays in StateStopped; the caller is expected to retry.

func (*Toolset) State added in v1.54.0 

func (ts *Toolset) State() lifecycle.StateInfo

State returns a snapshot of the toolset's lifecycle state, suitable for status displays.

func (*Toolset) Stop 

func (ts *Toolset) Stop(ctx context.Context) error

Stop tears the supervisor down. Idempotent.

func (*Toolset) Tools 

func (ts *Toolset) Tools(ctx context.Context) ([]tools.Tool, error)

func (*Toolset) WorkingDir added in v1.48.0 

func (ts *Toolset) WorkingDir() string

WorkingDir returns the working directory of the underlying stdio client, or an empty string if this toolset uses a remote transport. This is intended for testing only.

Source Files

View all Source files

Directories

Path Synopsis
Package oauthflow implements the client side of the OAuth 2.0 authorization-code flow used to authenticate against remote MCP servers: PKCE and state generation, the loopback callback server, dynamic client registration, and code/refresh token exchange.
 Package oauthflow implements the client side of the OAuth 2.0 authorization-code flow used to authenticate against remote MCP servers: PKCE and state generation, the loopback callback server, dynamic client registration, and code/refresh token exchange.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.