server

package
v0.2.21 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 9, 2026 License: MPL-2.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	TransportLabelKey = "mcp.transport"
	AuthModeLabelKey  = "mcp.auth-mode"
)
View Source 
const (
	DefaultConnectionTimeoutMS = 30_000
	MaxConnectionTimeoutMS     = 10 * 60 * 1_000
)
View Source 
const (
	MCPHTTPAuthNone              = mcpServer.MCPHTTPAuthNone
	MCPHTTPAuthAPIKey            = mcpServer.MCPHTTPAuthAPIKey
	MCPHTTPAuthOAuth             = mcpServer.MCPHTTPAuthOAuth
	MCPHTTPAuthClientCredentials = mcpServer.MCPHTTPAuthClientCredentials
)

Variables

This section is empty.

Functions

func CleanupUnboundServerSecrets 

func CleanupUnboundServerSecrets(
	ctx context.Context,
	server artifact.ArtifactRef,
	document ServerDocument,
	data ServerData,
	cleaner SecretCleaner,
) error

CleanupUnboundServerSecrets removes every deterministic secret slot declared by the current canonical server document but not retained by the current installation data.

Unlike before/after-only cleanup, this operation remains retryable after the installation metadata write has committed. A retry can derive all current secret slots from the immutable server Definition and does not need the previous Artifact.Data or overlay value.

func DefinitionForCanonicalServer 

func DefinitionForCanonicalServer(
	input ServerDocument,
) (definition.Definition, error)

DefinitionForCanonicalServer converts an MCP server projected from an Artifact Store-canonicalized MCP Bundle into an immutable Definition.

Portable document validation belongs to the Artifact Store shareable schema registry. This function intentionally performs only MCP Definition projection and generic Definition canonicalization.

func EncodeServerData 

func EncodeServerData(
	input ServerData,
) (json.RawMessage, error)

func ServerSubresource 

func ServerSubresource(
	name basespec.LogicalName,
) basespec.SubresourceLocator

Types

type AuthenticationDeclaration 

type AuthenticationDeclaration struct {
	Mode MCPHTTPAuthMode `json:"mode"`

	ClientCredentialsInput      string `json:"clientCredentialsInput,omitempty"`
	ClientIDMetadataDocumentURL string `json:"clientIDMetadataDocumentURL,omitempty"`
}

type ConnectionProfile 

type ConnectionProfile struct {
	Platforms []string      `json:"platforms,omitempty"`
	Stdio     *StdioProfile `json:"stdio,omitempty"`
	HTTP      *HTTPProfile  `json:"http,omitempty"`
}

type CoreServer 

type CoreServer struct {
	Type ServerType `json:"type,omitempty"`

	Command string            `json:"command,omitempty"`
	Args    []string          `json:"args,omitempty"`
	Env     map[string]string `json:"env,omitempty"`

	URL     string            `json:"url,omitempty"`
	Headers map[string]string `json:"headers,omitempty"`
}

func NormalizeCoreServer 

func NormalizeCoreServer(value CoreServer) CoreServer

type EnvironmentResolver 

type EnvironmentResolver interface {
	ResolveEnvironment(
		ctx context.Context,
		name string,
	) (string, bool, error)
}

type HTTPProfile 

type HTTPProfile struct {
	URL           *string           `json:"url,omitempty"`
	Headers       map[string]string `json:"headers,omitempty"`
	RemoveHeaders []string          `json:"removeHeaders,omitempty"`
}

type InputBinding 

type InputBinding struct {
	Value     *string `json:"value,omitempty"`
	SecretRef string  `json:"secretRef,omitempty"`
}

type InputDeclaration 

type InputDeclaration struct {
	Kind                 InputKind `json:"kind"`
	Label                string    `json:"label,omitempty"`
	Description          string    `json:"description,omitempty"`
	Note                 string    `json:"note,omitempty"`
	Placeholder          string    `json:"placeholder,omitempty"`
	Required             bool      `json:"required,omitempty"`
	Default              *string   `json:"default,omitempty"`
	ClientSecretRequired bool      `json:"clientSecretRequired,omitempty"`
}

type InputKind 

type InputKind string
const (
	InputText   InputKind = "text"
	InputSecret InputKind = "secret"
	InputPath   InputKind = "path"
	//nolint:gosec // Cred enum.
	InputOAuthClientCredentials InputKind = "oauthClientCredentials"
)

type InstallationDeclaration 

type InstallationDeclaration struct {
	Note             string                      `json:"note,omitempty"`
	Inputs           map[string]InputDeclaration `json:"inputs,omitempty"`
	AllowEnvironment []string                    `json:"allowEnvironment,omitempty"`
}

type MCPHTTPAuthMode 

type MCPHTTPAuthMode = mcpServer.MCPHTTPAuthMode

type MaterializedServer 

type MaterializedServer struct {
	Core                           CoreServer
	Auth                           AuthenticationDeclaration
	ClientCredentialRef            string
	ClientCredentialSecretRequired bool
	TimeoutMS                      int
	SensitiveValues                []string
}

MaterializedServer contains only materialized Store document state. It is intentionally not a RuntimeConfig. Aggregate converts this model to the runtime-owned configuration contract.

func (MaterializedServer) Validate 

func (value MaterializedServer) Validate() error

type PolicyReference 

type PolicyReference struct {
	Ref      basespec.LogicalName `json:"ref"`
	Required bool                 `json:"required"`
}

type Resolved 

type Resolved struct {
	Server               artifact.ArtifactRef     `json:"server"`
	Collection           collection.CollectionRef `json:"collection"`
	ArtifactRevision     uint64                   `json:"artifactRevision"`
	CatalogRevision      uint64                   `json:"catalogRevision"`
	DefinitionDigest     cryptoutil.Digest        `json:"definitionDigest"`
	SourceContentDigest  cryptoutil.Digest        `json:"sourceContentDigest"`
	SourceGeneration     string                   `json:"sourceGeneration"`
	Document             ServerDocument           `json:"document"`
	Installation         ServerData               `json:"installation"`
	Policy               mcpPolicy.Effective      `json:"policy"`
	InstallationRevision uint64                   `json:"installationRevision"`
	RuntimeEnabled       bool                     `json:"runtimeEnabled"`
	BuiltIn              bool                     `json:"builtIn"`
	Version              cryptoutil.Digest        `json:"version"`
}

func (Resolved) MaterializeForInspection 

func (r Resolved) MaterializeForInspection(
	ctx context.Context,
	environment EnvironmentResolver,
) (MaterializedServer, error)

func (Resolved) MaterializeTrusted 

func (r Resolved) MaterializeTrusted(
	ctx context.Context,
	secrets SecretResolver,
	environment EnvironmentResolver,
) (MaterializedServer, error)

MaterializeTrusted is the resolver-to-runtime fast path. Resolver output has already passed full Artifact, Catalog, Definition, policy, and installation validation. This method validates only values that do not exist until profile application and local substitution occur.

func (Resolved) Validate 

func (r Resolved) Validate() error

type Resolver 

type Resolver interface {
	ResolveMCPServer(
		ctx context.Context,
		ref artifact.ArtifactRef,
	) (Resolved, error)
}

type SecretCleaner 

type SecretCleaner interface {
	DeleteSecret(ctx context.Context, ref string) error
}

SecretCleaner removes an opaque installation-local secret reference.

Implementations must be idempotent: deleting an already removed secret must return nil. This permits retry after a successful document publication but a failed local cleanup step.

type SecretInputTarget 

type SecretInputTarget struct {
	Kind SecretInputTargetKind
	Slot string
}

SecretInputTarget is the single runtime materialization target permitted for one `secret` installation input.

A local secret reference has a target-specific kind and slot. One portable secret input cannot safely bind multiple distinct environment variables or HTTP headers because one opaque local reference cannot prove both targets.

type SecretInputTargetKind 

type SecretInputTargetKind string
const (
	//nolint:gosec // Enum.
	SecretInputTargetStdioEnv   SecretInputTargetKind = "stdioEnv"
	SecretInputTargetHTTPHeader SecretInputTargetKind = "httpHeader"
)

type SecretResolver 

type SecretResolver interface {
	ResolveSecret(
		ctx context.Context,
		ref string,
	) (string, error)
}

type ServerData 

type ServerData struct {
	SchemaVersion string `json:"schemaVersion"`

	SelectedConnectionProfile string                  `json:"selectedConnectionProfile,omitempty"`
	Inputs                    map[string]InputBinding `json:"inputs,omitempty"`
	AdditionalPolicies        []artifact.ArtifactRef  `json:"additionalPolicies,omitempty"`
}

func DecodeServerData 

func DecodeServerData(
	raw json.RawMessage,
) (ServerData, error)

func DefaultServerData 

func DefaultServerData() ServerData

func (ServerData) SecretReferences 

func (data ServerData) SecretReferences() ([]string, error)

SecretReferences returns the unique opaque secret references held by local server installation data. It never resolves or returns secret values.

func (ServerData) Validate 

func (value ServerData) Validate() error

func (ServerData) ValidateFor 

func (value ServerData) ValidateFor(
	server artifact.ArtifactRef,
	document ServerDocument,
) error

type ServerDefinitionBody 

type ServerDefinitionBody struct {
	MCPServer CoreServer      `json:"mcpServer"`
	Extension ServerExtension `json:"extension"`
}

func ServerBodyFromDefinition 

func ServerBodyFromDefinition(
	input definition.Definition,
) (ServerDefinitionBody, error)

type ServerDocument 

type ServerDocument struct {
	Kind          artifact.ArtifactKind `json:"kind"`
	SchemaID      schema.SchemaID       `json:"schemaID"`
	SchemaVersion string                `json:"schemaVersion"`
	Digest        cryptoutil.Digest     `json:"digest,omitempty"`

	LogicalName    basespec.LogicalName    `json:"logicalName"`
	LogicalVersion basespec.LogicalVersion `json:"logicalVersion,omitempty"`
	DisplayName    string                  `json:"displayName,omitempty"`
	Description    string                  `json:"description,omitempty"`
	Labels         map[string]string       `json:"labels,omitempty"`

	MCPServer CoreServer      `json:"mcpServer"`
	Extension ServerExtension `json:"extension"`
}

func CanonicalizeServer 

func CanonicalizeServer(
	input ServerDocument,
) (ServerDocument, json.RawMessage, error)

func ServerDocumentFromDefinition 

func ServerDocumentFromDefinition(
	input definition.Definition,
) (ServerDocument, error)

func (ServerDocument) AcceptsSecretTarget 

func (value ServerDocument) AcceptsSecretTarget(
	kind mcpDomainSecret.MCPSecretKind,
	slot string,
) error

func (ServerDocument) OAuthClientSecretRequired 

func (d ServerDocument) OAuthClientSecretRequired() bool

OAuthClientSecretRequired reports whether the declared OAuth client input must contain a confidential-client secret. Client-credentials flow always requires a secret even if a document omitted the explicit declaration flag.

func (ServerDocument) SecretInputTargets 

func (value ServerDocument) SecretInputTargets() (
	map[string]SecretInputTarget,
	error,
)

func (ServerDocument) Validate 

func (value ServerDocument) Validate() error

type ServerExtension 

type ServerExtension struct {
	LogicalVersion basespec.LogicalVersion `json:"logicalVersion,omitempty"`
	DisplayName    string                  `json:"displayName,omitempty"`
	Description    string                  `json:"description,omitempty"`
	TimeoutMS      int                     `json:"timeoutMS,omitempty"`
	Labels         map[string]string       `json:"labels,omitempty"`

	Auth               AuthenticationDeclaration    `json:"auth"`
	Install            InstallationDeclaration      `json:"install"`
	ConnectionProfiles map[string]ConnectionProfile `json:"connectionProfiles,omitempty"`
	Policy             *PolicyReference             `json:"policy,omitempty"`
}

func NormalizeServerExtension 

func NormalizeServerExtension(
	name string,
	value ServerExtension,
) ServerExtension

type ServerType 

type ServerType string
const (
	ServerTypeStdio ServerType = "stdio"
	ServerTypeHTTP  ServerType = "http"
)

type StdioProfile 

type StdioProfile struct {
	Command   *string           `json:"command,omitempty"`
	Args      *[]string         `json:"args,omitempty"`
	Env       map[string]string `json:"env,omitempty"`
	RemoveEnv []string          `json:"removeEnv,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.