endpoint

package
v0.0.397 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 10, 2026 License: Apache-2.0 Imports: 29 Imported by: 0

Documentation

Overview

Package endpoint serves the read-only MCP endpoint as the mcp connect subresource of mcpservers (designs-and-proposals storage-mcp-endpoint.md):

POST /apis/spdx.softwarecomposition.kubescape.io/v1beta1/namespaces/{ns}/mcpservers/default/mcp

kube-apiserver authenticates the caller and checks RBAC create on mcpservers/mcp before it forwards the call. The endpoint accepts only calls forwarded by kube-apiserver and checks every read a tool does against the caller's RBAC.

Index

Constants

View Source
const Name = "default"

Name is the only mcpservers name served.

Variables

This section is empty.

Functions

This section is empty.

Types

type Config

type Config struct {
	// RequestHeader is storage's front-proxy configuration: the CA and the
	// names of the client certificate kube-apiserver forwards requests with.
	RequestHeader *authenticatorfactory.RequestHeaderConfig
	// Authorizer checks each read for the caller (see apiauth.NewAuthorizer).
	Authorizer authorizer.Authorizer
	// Scheme converts what the REST storage returns to v1beta1.
	Scheme *runtime.Scheme
	// VulnerabilityManifests is the vulnerabilitymanifests REST storage.
	VulnerabilityManifests rest.Storage
	// SBOMSyfts is the sbomsyfts REST storage.
	SBOMSyfts rest.Storage
	// WorkloadConfigurationScans is the workloadconfigurationscans REST storage.
	WorkloadConfigurationScans rest.Storage
	// ContainerProfiles is the containerprofiles REST storage.
	ContainerProfiles rest.Storage
	// CallTimeout bounds the work of one tool call.
	CallTimeout time.Duration
	// MaxResponseBytes caps the text of one tool result.
	MaxResponseBytes int
}

type Endpoint

type Endpoint struct {
	// contains filtered or unexported fields
}

func New

func New(cfg Config) (*Endpoint, error)

func (*Endpoint) ServeHTTP

func (e *Endpoint) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP refuses anonymous calls and calls that did not come through kube-apiserver. Storage's authenticator also accepts bearer tokens sent straight to it and anonymous calls, so a user in the request context is not enough on its own.

func (*Endpoint) Storage

func (e *Endpoint) Storage() (parent, connect rest.Storage)

Storage returns the REST storage for "mcpservers" and "mcpservers/mcp".

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL