manager

package
v0.1.35 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 2, 2026 License: Apache-2.0 Imports: 32 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AuthBindingStore added in v0.1.29 

type AuthBindingStore struct {
	// contains filtered or unexported fields
}

AuthBindingStore persists learned bindings in memory plus the per-machine workspace StateStore (version-one contract: learned state is node-local; production MCP definitions should declare providerRef explicitly).

func NewAuthBindingStore added in v0.1.29 

func NewAuthBindingStore(state workspace.StateStore) *AuthBindingStore

NewAuthBindingStore creates a binding store over a workspace StateStore; nil defaults to the filesystem state store rooted at workspace.StateRoot().

func (*AuthBindingStore) Invalidate added in v0.1.29 

func (s *AuthBindingStore) Invalidate(ctx context.Context, serverName string)

Invalidate drops the binding for a server (changed issuer/resource metadata, credential change).

func (*AuthBindingStore) Load added in v0.1.29 

func (s *AuthBindingStore) Load(ctx context.Context, serverName string) (*MCPAuthBinding, error)

Load returns the unexpired binding for a server; nil when absent/expired.

func (*AuthBindingStore) Save added in v0.1.29 

func (s *AuthBindingStore) Save(ctx context.Context, binding *MCPAuthBinding) error

Save persists a validated binding (memory + state file, owner-only mode).

type AuthRTProvider 

type AuthRTProvider func(ctx context.Context) *authtransport.RoundTripper

AuthRTProvider returns a per-request auth RoundTripper (e.g., per-user) chosen from context. When provided, it takes precedence over the static authRT set via WithAuthRoundTripper.

type JarProvider 

type JarProvider func(ctx context.Context) (http.CookieJar, error)

JarProvider returns a per-request CookieJar (e.g., per-user) chosen from context. When provided, it takes precedence over the static cookieJar set via WithCookieJar.

type MCPAuthBinding added in v0.1.29 

type MCPAuthBinding struct {
	ServerName      string    `json:"serverName"`
	Origin          string    `json:"origin"`
	MetadataURL     string    `json:"metadataURL"`
	ProviderRef     string    `json:"providerRef"`
	ClientRef       string    `json:"clientRef,omitempty"`
	Issuer          string    `json:"issuer"`
	Resource        string    `json:"resource"`
	ScopesSupported []string  `json:"scopesSupported,omitempty"`
	ETag            string    `json:"etag,omitempty"`
	ExpiresAt       time.Time `json:"expiresAt"`
}

MCPAuthBinding is a validated, non-secret authentication binding learned from an MCP 401 protected-resource challenge. It records where the metadata came from and which approved provider/client it resolved to — never tokens, codes, verifiers or client secrets. Explicit MCP configuration always overrides a learned binding.

func (*MCPAuthBinding) Valid added in v0.1.29 

func (b *MCPAuthBinding) Valid(now time.Time) bool

Valid reports whether the binding is usable at now.

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager caches MCP clients per (userID:conversationID, serverName) and handles idle reaping.

func New 

func New(prov Provider, opts ...Option) (*Manager, error)

New creates a Manager with the given Provider and options.

func (*Manager) CloseConversation 

func (m *Manager) CloseConversation(convID string)

CloseConversation drops all clients for a conversation (across all users). Note: underlying transports may keep connections if the library doesn't expose Close.

func (*Manager) EvictUserServer added in v0.1.29 

func (m *Manager) EvictUserServer(userID, serverName string)

EvictUserServer drops every pooled client for one user and MCP server. Called after a delegated credential change (link, disconnect, invalid_grant) so the next use resolves the new credential instead of reusing a client authenticated with the old one. It never touches other users' entries, sessions or auth context.

func (*Manager) Get 

func (m *Manager) Get(ctx context.Context, convID, serverName string) (mcpclient.Interface, error)

Get returns an MCP client for (user+convID, serverName), creating it if needed. When a UserIDExtractor is configured, the pool key includes the user ID to prevent shared conversations from leaking MCP auth/tokens across users.

func (*Manager) IsDelegatedAuth added in v0.1.29 

func (m *Manager) IsDelegatedAuth(ctx context.Context, serverName string) bool

IsDelegatedAuth reports whether the MCP server config selects delegated OAuth (auth.mode=oauth with providerRef/inlineProvider). Delegated servers resolve credentials exclusively through the installed CredentialResolver: workspace tokens must never be injected for them.

func (*Manager) Names added in v0.1.33 

func (m *Manager) Names(ctx context.Context) ([]string, error)

Names lists configured MCP servers when the provider supports local inventory. It never initializes or contacts an MCP server.

func (*Manager) Options 

func (m *Manager) Options(ctx context.Context, serverName string) (*mcpcfg.MCPClient, error)

Options exposes the underlying provider client options (authoring metadata, timeouts, etc.) for a given server name.

func (*Manager) PreflightCredential added in v0.1.33 

func (m *Manager) PreflightCredential(ctx context.Context, serverName string) error

PreflightCredential resolves delegated credentials before a tool execution claim is acquired or any remote MCP request is made. Interactive hosts may block on a typed link-required result and invoke this method again after the same authorization interaction completes.

func (*Manager) Reap 

func (m *Manager) Reap()

Reap closes idle clients beyond TTL by dropping references.

func (*Manager) Reconnect 

func (m *Manager) Reconnect(ctx context.Context, convID, serverName string) (mcpclient.Interface, error)

Reconnect drops the cached client for (convID, serverName) and creates a new one. It returns the fresh client or an error if recreation fails.

func (*Manager) StartReaper 

func (m *Manager) StartReaper(ctx context.Context, interval time.Duration) (stop func())

StartReaper launches a background goroutine that periodically invokes Reap until the provided context is cancelled or the returned stop function is called. If interval is non-positive, ttl/2 is used with a minimum of 1 minute.

func (*Manager) Touch 

func (m *Manager) Touch(convID, serverName string)

Touch updates last-used time for (convID, serverName).

func (*Manager) UseIDToken 

func (m *Manager) UseIDToken(ctx context.Context, serverName string) bool

UseIDToken reports whether the MCP server config prefers using an ID token when authenticating outbound calls to this server.

func (*Manager) WithAuthTokenContext 

func (m *Manager) WithAuthTokenContext(ctx context.Context, serverName string) context.Context

WithAuthTokenContext injects the selected auth token into context under the MCP auth transport key so HTTP transports can emit the appropriate Bearer header. This is a best-effort helper; when no token is available it returns ctx as-is. Delegated servers are excluded: the parent context is returned unchanged so the workspace bearer/ID token can never reach a delegated MCP transport.

type Option 

type Option func(*Manager) error

Option configures Manager. It can return an error which will be bubbled up by New.

func WithAuthBindingStore added in v0.1.29 

func WithAuthBindingStore(store *AuthBindingStore) Option

WithAuthBindingStore installs the learned-binding store used for delegated challenge-mode servers.

func WithAuthRoundTripper 

func WithAuthRoundTripper(rt *authtransport.RoundTripper) Option

WithAuthRoundTripper enables auth integration by attaching the provided RoundTripper as an Authorizer interceptor to created MCP clients.

func WithAuthRoundTripperProvider 

func WithAuthRoundTripperProvider(p AuthRTProvider) Option

WithAuthRoundTripperProvider injects a provider that selects an auth RoundTripper per request.

func WithClientFactory added in v0.1.10 

func WithClientFactory(factory func(context.Context, string, string) (mcpclient.Interface, error)) Option

WithClientFactory injects a client constructor override. It is primarily useful for tests and constrained runtimes that need to provide a custom MCP transport implementation without replacing the rest of the manager.

func WithCookieJar 

func WithCookieJar(jar http.CookieJar) Option

WithCookieJar injects a host-controlled CookieJar that will be applied to newly created MCP clients via ClientOptions, overriding any per-provider jar.

func WithCookieJarProvider 

func WithCookieJarProvider(p JarProvider) Option

WithCookieJarProvider injects a provider that selects a CookieJar per request (e.g., per user).

func WithCredentialResolver added in v0.1.29 

func WithCredentialResolver(resolver authcfg.CredentialResolver) Option

WithCredentialResolver installs the host credential resolver used for MCP definitions with auth.mode=oauth (delegated). For those servers viant/mcp becomes the sole transport-level OAuth coordinator and the resolver the sole credential-policy implementation; legacy servers are unaffected.

func WithHandlerFactory 

func WithHandlerFactory(newHandler func() protoclient.Handler) Option

WithHandlerFactory sets a factory for per-connection client handlers (for elicitation, etc.).

func WithProviderRegistry added in v0.1.29 

func WithProviderRegistry(registry authcfg.ProviderRegistry) Option

WithProviderRegistry installs the host OAuth provider registry so delegated requirement compilation can resolve providerRef before the first request.

func WithTTL 

func WithTTL(ttl time.Duration) Option

WithTTL sets idle TTL before reaping a client.

func WithTokenProvider added in v0.1.8 

func WithTokenProvider(tp token.Provider) Option

WithTokenProvider injects the shared token lifecycle manager so MCP requests can refresh tokens just before outbound auth is attached.

func WithUserIDExtractor 

func WithUserIDExtractor(fn UserIDExtractor) Option

WithUserIDExtractor sets the function used to derive a user-scoped pool key.

type Provider 

type Provider interface {
	Options(ctx context.Context, serverName string) (*mcpcfg.MCPClient, error)
}

Provider returns client options for a given MCP server name.

type RepoProvider 

type RepoProvider struct {
	// contains filtered or unexported fields
}

RepoProvider loads MCP client options from the Agently workspace repo ($AGENTLY_WORKSPACE/mcp).

func NewRepoProvider 

func NewRepoProvider(opts ...RepoProviderOption) *RepoProvider

func (*RepoProvider) Names added in v0.1.33 

func (p *RepoProvider) Names(ctx context.Context) ([]string, error)

Names lists configured MCP server definitions without performing discovery.

func (*RepoProvider) Options 

func (p *RepoProvider) Options(ctx context.Context, name string) (*mcpcfg.MCPClient, error)

type RepoProviderOption 

type RepoProviderOption func(*RepoProvider)

RepoProviderOption configures RepoProvider.

func WithRepoStateStore 

func WithRepoStateStore(ss workspace.StateStore) RepoProviderOption

WithRepoStateStore injects a StateStore for resolving state directories.

type UserIDExtractor 

type UserIDExtractor func(ctx context.Context) string

UserIDExtractor returns a user identifier from context for pool isolation. When set, the pool key becomes "userID:convID" instead of just "convID" to prevent shared conversations from leaking MCP auth across users.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.