Documentation
¶
Index ¶
- Constants
- func DirectTransport() http.RoundTripper
- func GuardDirectTransport() http.RoundTripper
- func GuardTransport(base http.RoundTripper) http.RoundTripper
- func GuardTrustedProxyDialer(dialer TrustedProxyDialer) http.RoundTripper
- func NewDirectHTTPClient(timeout time.Duration) *http.Client
- func NewHTTPClient(timeout time.Duration, base http.RoundTripper) *http.Client
- func NewTrustedProxyHTTPClient(timeout time.Duration, dialer TrustedProxyDialer) *http.Client
- func Validate(ctx context.Context, rawURL string) error
- type Options
- type TrustedProxyDialer
- type Validator
- func (v Validator) GuardTransport(base http.RoundTripper) http.RoundTripper
- func (v Validator) GuardTrustedProxyDialer(dialer TrustedProxyDialer) http.RoundTripper
- func (v Validator) Validate(ctx context.Context, rawURL string) error
- func (v Validator) ValidateURL(ctx context.Context, u *url.URL) error
- func (v Validator) ValidateURLWithoutResolution(u *url.URL) error
Constants ¶
const AllowInsecureRemoteURLEnv = "DOCKER_MCP_ALLOW_INSECURE_REMOTE_URLS"
AllowInsecureRemoteURLEnv enables local/dev remote MCP endpoints. Production defaults allow only public HTTPS destinations.
Variables ¶
This section is empty.
Functions ¶
func DirectTransport ¶
func DirectTransport() http.RoundTripper
func GuardDirectTransport ¶
func GuardDirectTransport() http.RoundTripper
func GuardTransport ¶
func GuardTransport(base http.RoundTripper) http.RoundTripper
func GuardTrustedProxyDialer ¶
func GuardTrustedProxyDialer(dialer TrustedProxyDialer) http.RoundTripper
GuardTrustedProxyDialer validates request and redirect URLs, then sends traffic through a trusted local HTTP proxy socket dialer. Use it only with Docker Desktop's hardcoded local proxy socket.
Unlike GuardTransport's direct path, this proxy path cannot pin the dialed IP after validation because Docker Desktop's proxy resolves and dials the final target. The validator still rejects blocked request and redirect URLs before the proxy is dialed, but a narrow DNS-rebinding race remains accepted here to preserve Docker Desktop proxy semantics.
func NewHTTPClient ¶
func NewTrustedProxyHTTPClient ¶
func NewTrustedProxyHTTPClient(timeout time.Duration, dialer TrustedProxyDialer) *http.Client
NewTrustedProxyHTTPClient returns a guarded client for a trusted local proxy dialer, such as Docker Desktop's proxy socket dialer.
Types ¶
type TrustedProxyDialer ¶
TrustedProxyDialer dials a trusted local HTTP proxy socket.
type Validator ¶
type Validator struct {
// contains filtered or unexported fields
}
func DefaultValidator ¶
func DefaultValidator() Validator
func NewValidator ¶
func (Validator) GuardTransport ¶
func (v Validator) GuardTransport(base http.RoundTripper) http.RoundTripper
func (Validator) GuardTrustedProxyDialer ¶
func (v Validator) GuardTrustedProxyDialer(dialer TrustedProxyDialer) http.RoundTripper
GuardTrustedProxyDialer validates request and redirect URLs, then sends traffic through a trusted local HTTP proxy socket dialer. Use it only with Docker Desktop's hardcoded local proxy socket.
Unlike GuardTransport's direct path, this proxy path cannot pin the dialed IP after validation because Docker Desktop's proxy resolves and dials the final target. The validator still rejects blocked request and redirect URLs before the proxy is dialed, but a narrow DNS-rebinding race remains accepted here to preserve Docker Desktop proxy semantics.
func (Validator) ValidateURL ¶
func (Validator) ValidateURLWithoutResolution ¶
ValidateURLWithoutResolution applies URL safety checks that do not require DNS. It rejects unsafe schemes, userinfo, unsafe hostname forms, and disallowed IP literals. Call ValidateURL or use a guarded transport before network access.
Source Files