modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

fix(auth): address Copilot review round 13

Browse source 
No new inline comments this round, but two of the four suppressed ones were
real defects rather than restatements — both in code I added, both silently
wrong in the safe-looking direction.

**A symlinked secrets directory read as unmounted.** `isOnMountPoint` walks
to the nearest existing ancestor *lexically* and then string-prefixes it
against mountinfo, so `~/.mcp-inspector -> /data/inspector` with `/data`
mounted matched no mount point. The container then selected the session-only
store on a box that had explicitly arranged for persistence, and nothing said
so — the mount was there, the volume was there, the secrets evaporated on
exit. Resolved through symlinks now, tolerantly: a path that cannot be
resolved falls back to the lexical comparison, which is what this did before
and is correct whenever no symlink is involved. The `statSync` fallback branch
already followed links, so this also makes the two paths agree.

**The bulk read did not fix the case it was written for.** `getMany` batched
*one server's* fields, but both rehydration callers iterate servers — so a
catalog of 20 servers holding one secret each still paid 20 serialized scrypt
derivations. The same ~450ms stall the seam was introduced to remove, reached
one server at a time instead of one field at a time. Measuring the wrong unit
and then optimizing it is worse than not optimizing, because the number in the
commit message says it is fixed.

The seam is cross-server now — `getMany(requests: SecretBulkRequest[])` — and
both callers pass the whole catalog in one call. `FileSecretStore` decrypts
once for the entire rehydration; the keychain fallback still issues
independent parallel `get`s, which is what it wants. A test asserts one
derivation for four servers, next to the existing one asserting one for three
fields, so the property is pinned at both axes.

The other two suppressed comments are the cross-process guarantee — `mutate`'s
residual and the hand-off's TOCTOU delete — which remain decided against for
this PR and tracked in #2082.

Full `npm run ci` green.

Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-22 19:39:45 -04:00
commit 26d2f58784
1 changed files with 265 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

31
core/auth/node/secret-store-selection.ts
View file

@ -58,6 +58,7 @@ import {
parseAccount,
probeKeyringAvailable,
secretStoreGetMany,
type SecretBulkRequest,
secretStoreGetStrict,
secretStoreIsDurable,
SessionSecretStore,
@ -255,8 +256,27 @@ function readMountPoints(): string[] | null {
*/
export function isOnMountPoint(dir: string): boolean {
try {
const current = nearestExisting(dir);
if (current === null) return false;
const nearest = nearestExisting(dir);
if (nearest === null) return false;
// Resolve symlinks before comparing. `nearestExisting` walks lexically,
// and the mountinfo comparison below is a string prefix — so a secrets
// directory that is a *symlink into* a mounted volume
// (`~/.mcp-inspector -> /data/inspector`, with `/data` mounted) never
// matches any mount point, reads as the writable layer, and silently
// selects the session-only store on a box that had arranged for
// persistence. `statSync` in the fallback below already follows links;
// this makes the primary path agree with it.
//
// Tolerant of its own failure: a path we cannot resolve (permissions, a
// racing unmount) is better compared lexically than not compared at all,
// since the lexical answer is what this did before and is correct
// whenever no symlink is involved.
let current = nearest;
try {
current = fsSync.realpathSync(nearest);
} catch {
// Keep the lexical path.
}
const mounts = readMountPoints();
if (mounts !== null) {
@ -661,10 +681,9 @@ class DeferredSecretStore implements SecretStore {
return secretStoreGetStrict(await this.target(), serverId, field);
}
async getMany(
serverId: string,
fields: string[],
): Promise<Record<string, string>> {
return secretStoreGetMany(await this.target(), serverId, fields);
requests: SecretBulkRequest[],
): Promise<Record<string, Record<string, string>>> {
return secretStoreGetMany(await this.target(), requests);
}
async get(serverId: string, field: string): Promise<string | null> {
return (await this.target()).get(serverId, field);