feat: add mcp_enabled for the remote MCP surface - #13
Merged
Conversation
Authorizer 2.4.0 can serve its MCP tool surface over HTTP at POST <url>/mcp as an OAuth 2.1 resource server (authorizerdev/authorizer#757). Off by default — it is a new internet-facing authenticated surface. It is served on the MAIN HTTP port, not one of its own, because it must be publicly reachable on the same origin as the OAuth metadata clients discover it through. So it needs no Service or Ingress change and inherits the existing CORS, security headers and rate limiting. mcp_enabled requires authorizer_url, and the chart FAILS AT RENDER TIME without it, following the SMTP guard already at the top of deployment.yaml. The server exits at boot in that configuration — every token presented at /mcp is checked against <authorizer_url>/mcp, and deriving that identifier from request headers instead would let a caller name their own token's audience. In-cluster the failure would otherwise be a CrashLoopBackOff whose cause is one line in a container log. Verified with helm template in all three states: off (renders, MCP_ENABLED false), on without a URL (fails at render with the explanatory message), on with a URL (renders, MCP_ENABLED true). helm lint clean.
✅ Deploy Preview for authorizer-helm-chart ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
authorizer.mcp_enabledso the chart can serve Authorizer's MCP tool surface over HTTP atPOST <authorizer_url>/mcp, shipped in authorizerdev/authorizer#757.Off by default — it is a new internet-facing authenticated surface.
No Service or Ingress change
MCP is served on the main HTTP port, not one of its own: it must be publicly reachable on the same origin as the OAuth metadata clients discover it through. So it needs no new port and inherits the existing Ingress, CORS, security headers and rate limiting.
Fails at render time without
authorizer_urlFollowing the SMTP guard already at the top of
deployment.yaml, and for the same reason: in-cluster this failure is aCrashLoopBackOffwhose cause is one line in a container log.The server exits at boot when MCP is enabled with no
--url. Every token presented at/mcpis checked against<authorizer_url>/mcp, and deriving that identifier from request headers instead would let a caller name their own token's audience — so the server refuses rather than serving an endpoint that looks authenticated and is not.Verified with
helm templatein all three statesMCP_ENABLED: "false"mcp_enabled=true, no URLmcp_enabled=true+authorizer_urlMCP_ENABLED: "true"helm lintclean.