Mirror of https://github.com/modelcontextprotocol/experimental-ext-interceptors — Status: Experimental. This repository provides a multi-language reference implementation of the proposed interceptor extension for the Model Context Protocol (MCP), as descr
  • C# 73.8%
  • Go 25.7%
  • TypeScript 0.2%
  • Python 0.2%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Ola Hungerford 2f66b9b4af
ci: prevent shell injection in status-check workflow (#39)
## Summary

Fixes the open **critical** code scanning alert
(`actions/code-injection/critical`) in
`.github/workflows/status-check.yml`.

The "Get PR number" step interpolated `${{
github.event.workflow_run.head_branch }}` directly into a `run:` shell
script. A PR author controls their own branch name, so a branch named
`rce$(...)` executes arbitrary commands on the runner — which holds a
`GITHUB_TOKEN` with `statuses: write` and `checks: write`. This is a
live target: PR #32's branch name is a working injection payload against
this exact line.

## Fix

Move the branch name (and the other two templated values in the step)
into `env:` and reference them as quoted shell variables. GitHub Actions
template expansion no longer touches the script body, so
attacker-controlled input can't break out of the string.

No behavior change for legitimate runs.

## Not addressed here

The other open alert — critical vitest advisory (Dependabot #4) — is
already covered by open PR #14, so it's intentionally left out of this
PR.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-21 16:06:34 +01:00
.githooks Implement Go interceptor chain (#4) 2026-04-29 15:29:25 +01:00
.github/workflows ci: prevent shell injection in status-check workflow (#39) 2026-08-21 16:06:34 +01:00
conformance Initial project structure for MCP interceptors (#3) 2026-01-26 17:54:37 +00:00
csharp/sdk C# SDK: migrate to ModelContextProtocol 2.1.0 (MCP spec 2026-07-28) (#34) 2026-08-18 17:20:51 -07:00
docs Go SDK: Align mode with SEP (#40) 2026-08-21 15:56:07 +01:00
go/sdk Go SDK: Align mode with SEP (#40) 2026-08-21 15:56:07 +01:00
python/sdk Import revised sep and update the sep number (#21) 2026-06-16 05:16:21 +01:00
typescript/sdk Import revised sep and update the sep number (#21) 2026-06-16 05:16:21 +01:00
.gitignore Implement Go interceptor chain (#4) 2026-04-29 15:29:25 +01:00
LICENSE Update license from MIT to Apache 2.0 2026-01-23 21:44:11 +00:00
README.md Docs: Link Interceptors WG meeting notes (#41) 2026-08-21 08:00:57 -07:00

MCP Interceptors (Experimental Extension)

Status: Experimental. This work is for prototyping and feedback only, and is not an accepted or official MCP extension.

This repository provides a multi-language reference implementation of the proposed interceptor extension for the Model Context Protocol (MCP), as described in SEP-2624.

Charter: modelcontextprotocol.io/community/working-groups/interceptors — the Interceptors Working Group's mission, scope, leadership, and active work items.

Meeting notes: Meeting Notes - Interceptors WG in the spec repo. The April 30, 2026 meeting predates that category and is in this repository's discussions, along with copies of the April 23 and May 14 notes.

Implementations

Language Directory Package Status
C# csharp/sdk/ ModelContextProtocol.Interceptors In Progress
Go go/sdk/ github.com/modelcontextprotocol/ext-interceptors/go/sdk Planned
Python python/sdk/ mcp-ext-interceptors Planned
TypeScript typescript/sdk/ @ext-modelcontextprotocol/interceptors Planned

CI/CD

This monorepo uses path-based CI workflows to efficiently test only what changes:

How It Works

  1. Language-specific workflows (csharp.yml, python.yml, go.yml, typescript.yml)

    • Only trigger when their language directory or workflow file changes
    • Run all tests, linting, and checks for that language
  2. Status check workflow (status-check.yml)

    • Runs on every PR to verify required checks passed
    • Determines what needs to pass based on which files changed
    • This is the only required check in branch protection

Examples

  • Change python/sdk/file.py → Only Python CI runs → PR requires Python checks to pass
  • Change both Go and TypeScript files → Both CIs run → PR requires both to pass
  • Change only README.md → No language CIs run → PR can merge immediately

Forcing All Checks

To run all language checks regardless of changed files:

  • In a PR: Comment /test all (only works for repo owners/members/collaborators)
  • Manually: Use GitHub Actions UI or CLI to trigger individual workflows

Adding New Required Checks

  1. Add your check to the appropriate language workflow (e.g., python.yml):

    python-security-scan:
      name: "Security Scan"
      runs-on: ubuntu-latest
      steps:
        - name: Run security checks
          run: # your commands here
    
  2. Update the status check in .github/workflows/status-check.yml:

    const requiredChecks = {
      python: [
        'Python CI / Linting',
        'Python CI / Unit Tests (3.10)',
        // ... existing checks ...
        'Python CI / Security Scan'  // ← Add your new check
      ],
    
  3. Submit PR - Your new check is now required for all relevant changes!

License

Apache License 2.0 - See LICENSE file for details

Resources