Repository navigation
mcpx: the per-server auth: block is parsed and never applied #1926
Description
Relocated from dezren39/darwin-nix#205 on 2026-10-28 (placement audit): mcpx's single source lives in developing-today/code (pkgs/mcpx); re-home tracked at #309. Original body below; issue references inside it are historical (dezren39/nix numbering).
Parent: #177
Summary
docs/protocol.md §6 says OAuth for remote servers is "declared and not performed". The gap is wider: the whole per-server auth block (bearer, basic, header, query, env) is never applied. mcpauth.Auth.Resolve has no caller, so a remote server configured with auth: is reached without credentials, and only plain headers: works. Describe, documented as used by mcpx config and mcpx doctor, has no caller either.
Found while writing the comparison register (pkgs/mcpx/docs/compare/) and checked against the code at 05c78b2. Each row below links its register entry, which carries the value, effort, risk, the specification text and every source.
Register rows
| row | difference | mcpx @ 05c78b2 | effort |
|---|---|---|---|
| AUTH-22 | Per-server auth: block parsed and never applied |
✗ broken — Auth.Resolve has no caller |
S |
Evidence
internal/mcpauth/mcpauth.go:93(Resolve),:186-189(Describe); the only reference to the package is the type atinternal/config/config.go:141.- Headers are applied at
internal/pool/pool.go:377-380;authis not.
What to do
Apply Resolve() where headers are applied, fail with a clear message when a required credential is missing, and add the guard test #177 describes (every config field declared on a server has an observable effect).
Ease · Impact · Related
Ease S · Impact med · Related: #177, #172 (declared and unread)
Acceptance criteria
- The per-server
auth:block is applied whereheaders:are applied:mcpauth.Auth.Resolvehas a caller on the remote-server connect path, and bearer/basic/header/query/env credentials from the block reach the upstream request. - A required credential that cannot be resolved fails with a clear message naming the server and the missing credential — never a silent unauthenticated connection.
-
Describeis wired to its documented callers (mcpx config/mcpx doctor) or the documentation is corrected. - The feat(nix): Android SDK + JDK 21 in the system and dev shells, and the OpenChamber release signing key #177 guard test exists: every config field declared on a server has an observable effect, and it fails if
auth:is dropped again. - Existing
headers:-only servers behave exactly as before; tests pass in CI.
Activity
developing-today commentedon Oct 28, 2026
CODE-852
dezren39 commentedon Oct 28, 2026
History carried over from dezren39/darwin-nix#205 (verbatim, oldest first):
@dezren39 · 2026-10-28T05:40:26Z
Intake review — fleet monitor
Liveness: Verified still live at intake: the issue is open and no merged PR closes it. Evidence caveat (same as the rest of this register batch): the filer's evidence was verified against
05c78b2(2026-09-30) — re-verify against current main before fixing; if a row has since been fixed, say so on the issue and narrow the scope instead of redoing it.Related: Parent tracker named in the issue body; sibling register-batch issues in dezren39/nix (the #209–#220 batch was enriched in the previous monitor run). mcpx also lives in developing-today/code — check for a code-side twin before assuming a nix-only fix.
Notes / risks: Single register row (AUTH-22) with a precise call-site fix named in the issue (
internal/pool/pool.gowhere headers are applied). Fail-closed on a missing credential is the behaviour to preserve — do not fall back to an unauthenticated connection.Suggested approach: Re-verify the cited code paths on current main, land failing tests for the acceptance criteria first, then the smallest fix that satisfies them.
🤖 Agent note · state: filed
38 remaining items
dezren39 commentedon Oct 30, 2026
🤖 Agent note · picked up
auth:block is parsed and never applied #1926 closes on merge (this was its one remaining item).feat(mcpx): surface Auth.Describe() in mcpx config and mcpx doctor (#…
dezren39 commentedon Oct 30, 2026
🤖 Agent note · done
Auth.Describe()intomcpx configandmcpx doctor— the one remaining item of this issue — DONE, merged via PR feat(mcpx): surface Auth.Describe() in mcpx config and mcpx doctor (#1926) #2593 (cc52976). The issue's main defect was already fixed earlier (triage task 2822: Pool.resolveAuth wired into dial()/httpOptions(), covered by internal/pool/auth_test.go); this PR surfaces the redacted Describe() summary in the config server listing (text + --json) and doctor.go test ./internal/cli/full PASS,./internal/mcpauth/PASS,./internal/api/PASS. Codex review on the final head completed with no findings, 0 unresolved threads. PR CI never ran — checks queued from ~07:54Z in the repo-wide runner stall (ci: Actions check runs stuck in queued across PRs — no runner pickup since ~05:00Z 2026-10-28 #1599/CI: hosted runner queue saturates repo-wide (~425 queued runs), so PR checks wait hours behind push and workflow_run traffic #2605); merged under the standing rule after direct verification.