jcwalker3andClaude Opus 4.8
c162608175
Closes #931.
The transport was a literal passed once at the bottom of the module,
bind_native_mcp_transport(transport="stdio"), and every guard that asks
"is this a trusted native session" resolves that question through the
value bound there. The string was a constant in the authorization chain
rather than configuration, so a remote transport had no way to be
expressed and no way to be told apart from an untrusted offline import.
mcp_transport_config becomes the single source of truth: it owns the
permitted set, the default, and the resolution of deployment
configuration (GITEA_MCP_TRANSPORT) into a validated identifier. Unset
configuration still yields stdio, so existing deployments are unchanged.
streamable-http is accepted so the bind is pluggable; standing up its
listener remains #938. sse is deliberately not registered.
bind_native_mcp_transport now resolves from configuration when no
transport argument is given, validates against that one permitted set
before writing the runtime record, and pins the result. bound_transport
is the shared accessor every transport-aware guard reads; it reports the
pinned value and never the environment, so a post-bind GITEA_MCP_TRANSPORT
change cannot move what a guard observes -- the rule already applied to
the session-state root under #695 AC2. Rebinding the same identifier is
idempotent; rebinding a different one is refused, so two guards can never
disagree within one process. assert_transport_bound fails closed before
mcp.run, so an absent or invalid bind stops the server instead of serving
tools over a transport no guard can name.
The bound identifier is now recorded in durable provenance:
mutation_provenance_fields gains bound_transport, which reaches the
decision lock through mcp_session_state.save_state and the audit records
that already spread those fields. The pre-existing transport field keeps
its trust-class values, so no durable record changes shape.
assess_transport_for_auth_mint reports the bound transport through the
same accessor; its verdict is unchanged.
#956's anchor fixture and threat model are re-anchored for the lines this
change shifts, and the two boundary claims that #931 makes false -- the
"literal stdio bind" in B1 and the stdio contract at mcp_server.py:4 --
are restated. Without this the #956 guard fails, which is what it is for.
Non-goals, untouched: the remote listener (#938), per-request principal
resolution (#932), client-managed provenance policy (#934), TLS and
remote client authentication, role capability sets, repository-binding
semantics.
Tests: tests/test_issue_931_transport_bind_seam.py, 42 tests, covering
default bind, explicit stdio, the accepted non-stdio identifier, an
unregistered identifier, no bind at all, one-value agreement across
guards, post-bind environment tampering, the durable decision-lock
record, the rebind contract, and the #695 protections that must not
regress.
Full suite from the branches/ worktree: 28 failed, 5843 passed, 6
skipped, 1047 subtests. The pinned base 9b80e75c reports 28 failed, 5801
passed, 6 skipped, 1047 subtests. The failing test IDs are identical sets
-- no failure added, none fixed; the +42 passed are this PR's new module.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
81 lines
5.2 KiB
JSON
81 lines
5.2 KiB
JSON
{
|
|
"_comment": [
|
|
"Machine-checkable anchor table for docs/remote-mcp/threat-model.md (#956).",
|
|
"Every file:line anchor cited in the threat model must appear here, and the",
|
|
"source line at that anchor must contain the 'expect' substring.",
|
|
"tests/test_issue_956_threat_model.py enforces both directions, so a refactor",
|
|
"that shifts a line number fails the suite instead of silently rotting the",
|
|
"document. #930's inventory had no such guard and its gitea_mcp_server.py",
|
|
"anchors drifted between 7bf4f125 and aad5c8b4."
|
|
],
|
|
"generated_against_commit": "aad5c8b42361d380a8eeb07b94b90815e594c2c5",
|
|
"anchors": [
|
|
{"anchor": "gitea_mcp_server.py:24728", "expect": "mcp_daemon_guard.bind_native_mcp_transport()"},
|
|
{"anchor": "mcp_daemon_guard.py:49", "expect": "_PRODUCTION_TRANSPORTS = mcp_transport_config.SUPPORTED_TRANSPORTS"},
|
|
{"anchor": "mcp_daemon_guard.py:178", "expect": "def bind_native_mcp_transport"},
|
|
{"anchor": "irrecoverable_provenance.py:497", "expect": "def assess_transport_for_auth_mint"},
|
|
{"anchor": "gitea_mcp_server.py:9132", "expect": "assess_transport_for_auth_mint()"},
|
|
{"anchor": "gitea_mcp_server.py:9381", "expect": "assess_transport_for_auth_mint()"},
|
|
{"anchor": "mcp_server.py:4", "expect": "The transport is selected by deployment configuration"},
|
|
|
|
{"anchor": "gitea_mcp_server.py:15415", "expect": "def _is_client_managed_process"},
|
|
{"anchor": "gitea_mcp_server.py:15445", "expect": "def _provenance_mutation_block"},
|
|
{"anchor": "gitea_mcp_server.py:15453", "expect": "unsupported_manual_launch"},
|
|
{"anchor": "gitea_mcp_server.py:19004", "expect": "server_provenance"},
|
|
{"anchor": "gitea_mcp_server.py:21445", "expect": "def _check_mcp_runtimes_diagnostics"},
|
|
{"anchor": "gitea_mcp_server.py:21465", "expect": "\"ps\", \"-o\", \"pid,lstart,command\""},
|
|
{"anchor": "gitea_mcp_server.py:21509", "expect": "\"ps\", \"eww\""},
|
|
{"anchor": "gitea_config.py:1172", "expect": "RECOGNIZED_GITEA_ENV_KEYS"},
|
|
{"anchor": "gitea_config.py:1233", "expect": "GITEA_CLIENT_MANAGED"},
|
|
|
|
{"anchor": "gitea_config.py:54", "expect": "ENV_PROFILE = \"GITEA_MCP_PROFILE\""},
|
|
{"anchor": "gitea_config.py:97", "expect": "_REVIEW_MERGE_OPS"},
|
|
{"anchor": "gitea_config.py:499", "expect": "repository authorization scope"},
|
|
|
|
{"anchor": "gitea_config.py:956", "expect": "def _keychain_token"},
|
|
{"anchor": "gitea_config.py:974", "expect": "def resolve_token"},
|
|
{"anchor": "gitea_config.py:1015", "expect": "def keychain_auth"},
|
|
{"anchor": "gitea_config.py:294", "expect": "def _validate_identity_auth"},
|
|
{"anchor": "mcp_daemon_guard.py:519", "expect": "def assert_keychain_access_allowed"},
|
|
{"anchor": "gitea_mcp_server.py:19261", "expect": "def gitea_list_profiles"},
|
|
{"anchor": "gitea_mcp_server.py:19312", "expect": "gitea_config.resolve_token(p)"},
|
|
{"anchor": "gitea_mcp_server.py:19555", "expect": "def gitea_audit_config"},
|
|
{"anchor": "gitea_mcp_server.py:19577", "expect": "service_summaries(config)"},
|
|
|
|
{"anchor": "gitea_config.py:704", "expect": "def resolve_service"},
|
|
{"anchor": "gitea_config.py:837", "expect": "def service_summaries"},
|
|
{"anchor": "gitea_config.py:851", "expect": "_keychain_token(auth.get(\"id\"))"},
|
|
{"anchor": "gitea_mcp_server.py:17710", "expect": "\"jenkins-mcp\""},
|
|
{"anchor": "gitea_mcp_server.py:17716", "expect": "external-mcp"},
|
|
{"anchor": "gitea_mcp_server.py:17737", "expect": "\"glitchtip-mcp\""},
|
|
{"anchor": "gitea_mcp_server.py:17742", "expect": "external-mcp"},
|
|
{"anchor": "mcp_discoverability.py:9", "expect": "EXPECTED_JENKINS_TOOLS"},
|
|
{"anchor": "mcp_discoverability.py:17", "expect": "EXPECTED_GLITCHTIP_TOOLS"},
|
|
|
|
{"anchor": "sentry_incident_bridge.py:36", "expect": "SENTRY_AUTH_TOKEN"},
|
|
{"anchor": "sentry_incident_bridge.py:190", "expect": "def resolve_token"},
|
|
{"anchor": "sentry_incident_bridge.py:289", "expect": "Authorization"},
|
|
{"anchor": "sentry_observability.py:55", "expect": "SENTRY_DSN"},
|
|
|
|
{"anchor": "master_parity_gate.py:168", "expect": "def capture_startup_parity"},
|
|
{"anchor": "master_parity_gate.py:255", "expect": "mutation_safe"},
|
|
{"anchor": "gitea_mcp_server.py:19105", "expect": "def gitea_assess_master_parity"},
|
|
|
|
{"anchor": "gitea_mcp_server.py:193", "expect": "ACTIVE_WORKTREE_ENV"},
|
|
{"anchor": "gitea_mcp_server.py:194", "expect": "AUTHOR_WORKTREE_ENV"},
|
|
{"anchor": "gitea_mcp_server.py:2351", "expect": "/tmp/gitea_issue_lock.json"},
|
|
{"anchor": "gitea_mcp_server.py:10897", "expect": "def gitea_bootstrap_author_issue_worktree"},
|
|
{"anchor": "mcp_server.py:13", "expect": "/tmp/mcp_server_stderr.log"},
|
|
|
|
{"anchor": "issue_lock_store.py:26", "expect": "DEFAULT_LOCK_DIR"},
|
|
{"anchor": "issue_lock_store.py:83", "expect": "def session_pointer_path"},
|
|
{"anchor": "issue_lock_store.py:98", "expect": "def is_process_alive"},
|
|
{"anchor": "mcp_session_state.py:27", "expect": "DEFAULT_STATE_DIR"},
|
|
{"anchor": "control_plane_db.py:47", "expect": "DEFAULT_DB_PATH"},
|
|
{"anchor": "control_plane_db.py:380", "expect": "mode=0o700"},
|
|
{"anchor": "control_plane_db.py:386", "expect": "sqlite3.connect"},
|
|
{"anchor": "control_plane_db.py:1145", "expect": "os.getpid()"},
|
|
{"anchor": "gitea_mcp_server.py:12804", "expect": "owner_pid_alive"}
|
|
]
|
|
}
|