ee910ca286Add HTTP-based authentication to prove domain ownership, similar to https://github.com/modelcontextprotocol/registry/pull/238's DNS authentication but using HTTPS well-known URIs instead of DNS TXT records. Fixes #280 ## Motivation and Context Some organizations don't have easy access to DNS records, but can easily deploy web assets. They would therefore prefer to be able to complete a HTTP challenge rather than a DNS one to authenticate to the registry. This would in some way mirror ACME challenges: where you can do a DNS-01 or a HTTP-01 challenge. ## How Has This Been Tested? - Tested locally by stubbing out the HTTP getter - Added unit tests ## Breaking Changes None ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context I concern I had when building this that it might expose us to SSRF attacks. I think on reflection this is not a significant problem: - We only GET a fixed file `.well-known/mcp-registry-auth` (redirects disallowed) after sanitizing the domain, and then also don't expose the response to the user. This means the user shouldn't be able to hit anything very interesting. - The information they might get is what domains/servers exist in the network. Our infrastructure is already all open-source, so attackers aren't getting any additional real info by prodding at the environment this way.
132 lines
5.2 KiB
Go
132 lines
5.2 KiB
Go
package model
|
|
|
|
// AuthMethod represents the authentication method used
|
|
type AuthMethod string
|
|
|
|
const (
|
|
// GitHub OAuth authentication (access token)
|
|
AuthMethodGitHubAT AuthMethod = "github-at"
|
|
// GitHub Actions OIDC authentication
|
|
AuthMethodGitHubOIDC AuthMethod = "github-oidc"
|
|
// DNS-based public/private key authentication
|
|
AuthMethodDNS AuthMethod = "dns"
|
|
// HTTP-based public/private key authentication
|
|
AuthMethodHTTP AuthMethod = "http"
|
|
// No authentication - should only be used for local development and testing
|
|
AuthMethodNone AuthMethod = "none"
|
|
)
|
|
|
|
// ServerStatus represents the lifecycle status of a server
|
|
type ServerStatus string
|
|
|
|
const (
|
|
// ServerStatusActive represents an actively maintained server (as asserted by the publisher)
|
|
ServerStatusActive ServerStatus = "active"
|
|
// ServerStatusDeprecated represents a server that is no longer actively maintained
|
|
ServerStatusDeprecated ServerStatus = "deprecated"
|
|
)
|
|
|
|
// PublishRequest represents a request to publish a server to the registry
|
|
type PublishRequest struct {
|
|
ServerDetail `json:",inline"`
|
|
}
|
|
|
|
// Repository represents a source code repository as defined in the spec
|
|
type Repository struct {
|
|
URL string `json:"url" bson:"url"`
|
|
Source string `json:"source" bson:"source"`
|
|
ID string `json:"id,omitempty" bson:"id,omitempty"`
|
|
}
|
|
|
|
// ServerList represents the response for listing servers as defined in the spec
|
|
type ServerList struct {
|
|
Servers []Server `json:"servers" bson:"servers"`
|
|
Next string `json:"next,omitempty" bson:"next,omitempty"`
|
|
TotalCount int `json:"total_count" bson:"total_count"`
|
|
}
|
|
|
|
// create an enum for Format
|
|
type Format string
|
|
|
|
const (
|
|
FormatString Format = "string"
|
|
FormatNumber Format = "number"
|
|
FormatBoolean Format = "boolean"
|
|
FormatFilePath Format = "file_path"
|
|
)
|
|
|
|
type Input struct {
|
|
Description string `json:"description,omitempty" bson:"description,omitempty"`
|
|
IsRequired bool `json:"is_required,omitempty" bson:"is_required,omitempty"`
|
|
Format Format `json:"format,omitempty" bson:"format,omitempty"`
|
|
Value string `json:"value,omitempty" bson:"value,omitempty"`
|
|
IsSecret bool `json:"is_secret,omitempty" bson:"is_secret,omitempty"`
|
|
Default string `json:"default,omitempty" bson:"default,omitempty"`
|
|
Choices []string `json:"choices,omitempty" bson:"choices,omitempty"`
|
|
}
|
|
|
|
type InputWithVariables struct {
|
|
Input `json:",inline" bson:",inline"`
|
|
Variables map[string]Input `json:"variables,omitempty" bson:"variables,omitempty"`
|
|
}
|
|
|
|
type KeyValueInput struct {
|
|
InputWithVariables `json:",inline" bson:",inline"`
|
|
Name string `json:"name" bson:"name"`
|
|
}
|
|
type ArgumentType string
|
|
|
|
const (
|
|
ArgumentTypePositional ArgumentType = "positional"
|
|
ArgumentTypeNamed ArgumentType = "named"
|
|
)
|
|
|
|
// RuntimeArgument defines a type that can be either a PositionalArgument or a NamedArgument
|
|
type Argument struct {
|
|
InputWithVariables `json:",inline" bson:",inline"`
|
|
Type ArgumentType `json:"type" bson:"type"`
|
|
Name string `json:"name,omitempty" bson:"name,omitempty"`
|
|
IsRepeated bool `json:"is_repeated,omitempty" bson:"is_repeated,omitempty"`
|
|
ValueHint string `json:"value_hint,omitempty" bson:"value_hint,omitempty"`
|
|
}
|
|
|
|
type Package struct {
|
|
RegistryName string `json:"registry_name" bson:"registry_name"`
|
|
Name string `json:"name" bson:"name"`
|
|
Version string `json:"version" bson:"version"`
|
|
RunTimeHint string `json:"runtime_hint,omitempty" bson:"runtime_hint,omitempty"`
|
|
RuntimeArguments []Argument `json:"runtime_arguments,omitempty" bson:"runtime_arguments,omitempty"`
|
|
PackageArguments []Argument `json:"package_arguments,omitempty" bson:"package_arguments,omitempty"`
|
|
EnvironmentVariables []KeyValueInput `json:"environment_variables,omitempty" bson:"environment_variables,omitempty"`
|
|
}
|
|
|
|
// Remote represents a remote connection endpoint
|
|
type Remote struct {
|
|
TransportType string `json:"transport_type" bson:"transport_type"`
|
|
URL string `json:"url" bson:"url"`
|
|
Headers []KeyValueInput `json:"headers,omitempty" bson:"headers,omitempty"`
|
|
}
|
|
|
|
// VersionDetail represents the version details of a server
|
|
type VersionDetail struct {
|
|
Version string `json:"version" bson:"version"`
|
|
ReleaseDate string `json:"release_date,omitempty" bson:"release_date"`
|
|
IsLatest bool `json:"is_latest,omitempty" bson:"is_latest"`
|
|
}
|
|
|
|
// Server represents a basic server information as defined in the spec
|
|
type Server struct {
|
|
ID string `json:"id,omitempty" bson:"id"`
|
|
Name string `json:"name" bson:"name"`
|
|
Description string `json:"description" bson:"description"`
|
|
Status ServerStatus `json:"status,omitempty" bson:"status,omitempty"`
|
|
Repository Repository `json:"repository,omitempty" bson:"repository"`
|
|
VersionDetail VersionDetail `json:"version_detail" bson:"version_detail"`
|
|
}
|
|
|
|
// ServerDetail represents detailed server information as defined in the spec
|
|
type ServerDetail struct {
|
|
Server `json:",inline" bson:",inline"`
|
|
Packages []Package `json:"packages,omitempty" bson:"packages,omitempty"`
|
|
Remotes []Remote `json:"remotes,omitempty" bson:"remotes,omitempty"`
|
|
}
|