chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(opax-mcp): bruk X-MCP-Secret header — ikkje Authorization (kolliderer med Cloud Run IAM)

Browse Source
This commit is contained in:
chrischristiansen-glitch 2026-06-15 18:23:21 +02:00
parent 27290b2ab6
commit 7d4b475189
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
opax-mcp/server.py
View File

@ -1,6 +1,6 @@
"""opax-mcp — MCP tool server for OPAX/Vauco
Transport: HTTP (FastAPI + uvicorn) for Cloud Run
Alle tools kalles av Jason/Emma internt — ingen 3part.
Auth: Cloud Run IAM (Authorization header) + X-MCP-Secret header for tool-level auth
"""
import os
import httpx
@ -17,13 +17,13 @@ GITHUB_PAT = os.environ.get("GITHUB_PAT", "")
GOOGLE_CLOUD_PROJECT = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5")
def _auth_check(authorization: Optional[str]):
if MCP_SECRET and authorization != f"Bearer {MCP_SECRET}":
def _auth_check(x_mcp_secret: Optional[str]):
if MCP_SECRET and x_mcp_secret != MCP_SECRET:
raise HTTPException(status_code=401, detail="Unauthorized")
# ---------------------------------------------------------------------------
# Health
# Health — ingen auth, Cloud Run trenger denne
# ---------------------------------------------------------------------------
@app.get("/health")
@ -43,9 +43,9 @@ class ToolRequest(BaseModel):
@app.post("/tools/call")
async def call_tool(
req: ToolRequest,
authorization: Optional[str] = Header(default=None)
x_mcp_secret: Optional[str] = Header(default=None)
):
_auth_check(authorization)
_auth_check(x_mcp_secret)
handler = TOOLS.get(req.tool)
if not handler:
raise HTTPException(status_code=404, detail=f"Unknown tool: {req.tool}")
@ -54,8 +54,8 @@ async def call_tool(
@app.get("/tools")
async def list_tools(authorization: Optional[str] = Header(default=None)):
_auth_check(authorization)
async def list_tools(x_mcp_secret: Optional[str] = Header(default=None)):
_auth_check(x_mcp_secret)
return {"tools": list(TOOLS.keys())}