server

type Server struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	Address string

	// ScriptFile is the path to the setup script to run before serving.
	// Ignored when ScriptSource is set.
	ScriptFile string

	// ScriptSource is the setup script's content, for callers that already
	// hold it and have no file to point at — a script fetched from a plugin
	// scheme source, say, or one generated by the host. It takes precedence
	// over ScriptFile, so nothing has to be written to a temporary file.
	ScriptSource []byte

	// ScriptName labels ScriptSource in error messages and __file__. Defaults
	// to "<script>" when ScriptSource is set without it.
	ScriptName string

	LibDirs         []string
	Packages        []string       // Package (.zip) paths or URLs
	Bundle          *pack.Bundle   // The single app bundle to serve; when set the server runs in app-bundle mode
	LibBundles      []*pack.Bundle // Pre-opened library bundles (module providers only, no app behavior)
	Insecure        bool           // Allow self-signed HTTPS for package URLs
	CacheDir        string         // Override default OS cache dir for remote packages
	BearerToken     string
	AllowedPaths    []string            // Filesystem path restrictions (empty = no restrictions)
	NetworkPolicy   *netsecurity.Config // Script outbound network policy (nil = no restrictions)
	DisabledLibs    []string            // Built-in libraries to disable (empty = all enabled)
	PluginDirs      []string
	PluginManager   *scriptlingplugin.Manager
	MCPToolsDir     string // Empty means MCP disabled
	MCPResourcesDir string // Folder of resource .toml/.py pairs (empty = none)
	MCPPromptsDir   string // Folder of prompt .toml/.py pairs (empty = none)
	MCPSkillsDir    string // Folder of skill directories, each with a SKILL.md (empty = none)
	MCPExecTool     bool   // Enable code execution tool
	JSONRPC         bool   // Mount JSON-RPC over HTTP at /json-rpc
	KVStoragePath   string // Empty means in-memory KV store
	WebRoot         string // Directory to serve static files from (empty = disabled)
	SecretRegistry  *secretprovider.Registry
	DockerSock      string
	PodmanSock      string
	TLSCert         string
	TLSKey          string
	TLSGenerate     bool

	// ContainerDenyPrivileged refuses scriptling.container run(privileged=True)
	// in every evaluator. Privileged containers are allowed when false.
	ContainerDenyPrivileged bool

	// ExtraLibs, if set, registers additional libraries on every evaluator
	// after the standard library set — the setup script and every json-rpc,
	// http, mcp and websocket request handler. Host applications use this to
	// expose their own libraries to served scripts.
	ExtraLibs func(*scriptling.Scriptling)

	// Argv holds extra CLI arguments (after --) to expose via sys.argv in
	// every evaluator. Set from cmd.GetArgs() in the server dispatch paths.
	Argv []string
	// MaxRequestBodyBytes caps how many bytes a request body may carry
	// (applies to every route). Zero means the default, DefaultMaxRequestBody.
	MaxRequestBodyBytes int64

	// JSONRPCMaxBatch caps the elements in one JSON-RPC batch; a larger
	// batch gets a single Invalid Request error. Zero means the default,
	// DefaultJSONRPCMaxBatch; negative means unlimited.
	JSONRPCMaxBatch int

	// JSONRPCMaxConcurrency caps the JSON-RPC handlers running at once
	// across every batch, request and stream. Zero means the default,
	// DefaultJSONRPCMaxConcurrency; negative means unlimited.
	JSONRPCMaxConcurrency int

	// WebSocketOrigins restricts which browser origins may upgrade: an
	// origin allowlist, "*" to allow every origin, or empty for the
	// same-origin default. Non-browser clients send no Origin header and
	// are always allowed.
	WebSocketOrigins []string

	// MCPCorsOrigins restricts which browser origins may call /mcp
	// cross-origin: an origin allowlist, "*" to allow every origin (the old,
	// unconditional behavior), or empty for the same-origin default. Same
	// shape and semantics as WebSocketOrigins.
	//
	// The underlying mcp.Server's own Origin check is disabled entirely for
	// this route (see createMCPServer's SetOriginValidator call in mcp.go)
	// and its Access-Control-Allow-Origin header just reflects back whatever
	// Origin the browser sent — a wildcard in effect, since nothing narrows
	// it — which, combined with OPTIONS /mcp being routed to it (see
	// buildMux) so the preflight itself succeeds, lets any web page drive
	// tools/call, including execute_script, against an unauthenticated
	// server by default. This field's default closes that: with no browser
	// Origin allowlisted, the preflight's Access-Control-Allow-Origin is
	// stripped, so a cross-origin browser page's actual request is never
	// sent at all. Non-browser clients (server-to-server calls, e.g. a
	// gateway like llmrouter federating this server — never subject to CORS
	// regardless, since only browsers enforce it) are unaffected either way.
	// Set to non-empty only for browser-based use (e.g. testing against
	// examples/mcp-app-host-harness from a different origin).
	MCPCorsOrigins []string

	// JSONRPCCorsOrigins restricts which browser origins may call /json-rpc:
	// an origin allowlist, "*" to allow every origin, or empty for the
	// same-origin default. Same shape as MCPCorsOrigins. A disallowed origin
	// is refused with 403 before any handler runs (a cross-site text/plain
	// POST needs no preflight, so CORS headers alone would not stop it); an
	// allowed one gets Access-Control-Allow-Origin and an answered preflight.
	// Requests without an Origin header are unaffected.
	JSONRPCCorsOrigins []string

	// AllowedHosts lists the Host names the server answers besides its
	// defaults (see hostPolicy): exact names, or ".example.com" (also
	// written "*.example.com") for a domain and its subdomains; a port on an
	// entry is ignored. A server bound to loopback answers only loopback
	// names plus these, which defeats DNS rebinding where it bites. A server
	// bound elsewhere answers every Host until this is set, as with every
	// restriction that is off until configured; once set it also answers IP
	// literals and the machine's own host name, and refuses the rest with
	// 421.
	AllowedHosts []string
}