sources

type ADCReloadParams ¶ added in v1.16.0

type ADCReloadParams struct {
	Name                  string
	Scopes                []string
	QuotaProjectPin       string
	SkipQuotaProjectGuard bool
}

ADCReloadParams configures NewReloadingDefaultCredentials.

type Cache ¶

type Cache struct {
	// contains filtered or unexported fields
}

Cache is a thread-safe, expiring key-value store

func NewCache(onEvict OnEvictFunc) *Cache

func (c *Cache) Delete(key string)

func (c *Cache) DeleteExpired()

func (c *Cache) Get(key string) (any, bool)

func (c *Cache) Set(key string, value any)

type ConnectOnce ¶ added in v1.11.0

type ConnectOnce[T any] struct {
	// contains filtered or unexported fields
}

ConnectOnce holds a connection a source builds on first use. A source keeps one of these instead of a bare handle and resolves it through Do.

func NewConnectOnce[T any](ctx context.Context, name, sourceType string, tracer trace.Tracer, opts ...Option) *ConnectOnce[T]

func (c *ConnectOnce[T]) Close(ctx context.Context) error

func (c *ConnectOnce[T]) Do(ctx context.Context, connect func(context.Context) (T, error)) (T, error)

func (c *ConnectOnce[T]) Get() (T, bool)

func (c *ConnectOnce[T]) OnClose(fn func(context.Context, T) error) *ConnectOnce[T]

type Dialect ¶

type Dialect string

Dialect represents the dialect type of a database.

func (i *Dialect) String() string

func (i *Dialect) UnmarshalYAML(ctx context.Context, unmarshal func(interface{}) error) error

type IPType ¶

type IPType string

func (i *IPType) String() string

func (i *IPType) UnmarshalYAML(ctx context.Context, unmarshal func(interface{}) error) error

type Item ¶

type Item struct {
	Value     any
	ExpiresAt int64 // Unix nano timestamp
}

Item holds the cached value and its expiration timestamp

func (item Item) IsExpired() bool

type OAuthProxyCapabilities ¶ added in v1.17.0

type OAuthProxyCapabilities interface {
	OAuthResponseTypesSupported() []string
	OAuthGrantTypesSupported() []string
	OAuthCodeChallengeMethodsSupported() []string
}

OAuthProxyCapabilities can optionally be implemented by an OAuthProxySource to override the default OAuth capabilities advertised in its proxied discovery document (response_types_supported: ["code"], grant_types_supported: ["authorization_code", "refresh_token"], code_challenge_methods_supported: ["S256"]). Most authorization servers matching OAuthProxySource use these defaults and don't need to implement this.

type OAuthProxySource ¶ added in v1.17.0

type OAuthProxySource interface {
	Source
	// ClientOAuthEnabled reports whether this source instance expects the
	// caller to supply a per-request, browser-obtained OAuth access token,
	// as opposed to a single credential configured for the whole process.
	ClientOAuthEnabled() bool
	// OAuthAuthorizationEndpoint returns the full URL of the authorization
	// server's authorization endpoint (where the browser is redirected to
	// authenticate). This is returned as-is in the proxied discovery
	// document: the initial redirect happens via top-level browser
	// navigation, which isn't subject to CORS, so it does not need to be
	// proxied.
	OAuthAuthorizationEndpoint() string
	// OAuthTokenEndpoint returns the full URL of the authorization server's
	// own token endpoint. The toolbox's token proxy forwards requests here
	// server-side; browser clients never call this URL directly.
	OAuthTokenEndpoint() string
}

OAuthProxySource is implemented by a Source whose OAuth authorization server does not send CORS headers on its discovery document or token endpoint. Browsers enforce CORS on both fetch/XHR requests, so a browser-based MCP client cannot complete an OAuth Authorization Code + PKCE flow directly against such a server, even though the same requests work fine from a non-browser HTTP client (curl, a backend service, etc).

A Source that implements this interface, and reports ClientOAuthEnabled() == true, has its OAuth discovery document and token endpoint proxied by the toolbox itself (see internal/server/oauth_proxy.go), at:

GET  /.well-known/oauth-authorization-server/oauth-proxy/{sourceName}
POST /oauth-proxy/{sourceName}/token

The browser then only ever talks to the toolbox's own origin, which already sends the CORS headers configured via --allowed-origins, and the toolbox forwards the token exchange to the authorization server server-side, where CORS does not apply.

A source supplies its own full endpoint URLs rather than a bare base URL plus an assumed path suffix, because different authorization servers use different conventions and the toolbox should not need to guess any source's URL layout.

type OnEvictFunc ¶

type OnEvictFunc func(key string, value any)

OnEvictFunc is the signature for the callback

type Option ¶ added in v1.11.0

type Option func(*options)

Option configures a ConnectOnce.

func WithMinConnectTimeout(d time.Duration) Option

type Source ¶

type Source interface {
	SourceType() string
	ToConfig() SourceConfig
	IsReadOnly() bool
}

Source is the interface for the source itself.

type SourceConfig ¶

type SourceConfig interface {
	SourceConfigType() string
	Initialize(ctx context.Context, tracer trace.Tracer) (Source, error)
}

SourceConfig is the interface for configuring a source.

func DecodeConfig(ctx context.Context, sourceType string, name string, decoder *yaml.Decoder) (SourceConfig, error)

type SourceConfigFactory ¶

type SourceConfigFactory func(ctx context.Context, name string, decoder *yaml.Decoder) (SourceConfig, error)

SourceConfigFactory defines the function signature for creating a SourceConfig.