security: reconsider auth/CORS posture for state-changing /altimate/mcp/reload-datamate
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Quiet
- Tech stack
- typescript
- Domain
- api, authentication, security
Research direction
Start with the /altimate/mcp/reload-datamate endpoint added in #893, then trace the shared auth and CORS handling for existing routes, including the OPENCODE_SERVER_PASSWORD behavior. Review both proposed directions with maintainers; done requires an agreed design, implementation scope, and tests covering state-changing requests.
Written by the indexing model from the issue text.
Description
Found during the v0.8.8 release review (CTO, P2 deferred).
POST /altimate/mcp/reload-datamate (added in #893) is a state-changing endpoint that re-reads IDE mcp.json from disk and calls MCP.add() to (re)connect MCP clients with whatever command/url those files contain. With no OPENCODE_SERVER_PASSWORD set (the default, loopback bind + startup warning only), any local process — including a browser page the CORS policy reflects http://localhost:* / http://127.0.0.1:* for — can POST to it and trigger a reconnect.
This is the same auth posture as all existing routes (not a new exposure class), but reload-datamate is more side-effectful (spawns/reconnects transports) than the read routes, so it warrants a closer look.
Possible directions: require auth for state-changing /altimate/* routes even when the global password is unset, or tighten the CORS reflection for those routes. Deferred — design decision, not an in-diff edit, and default bind is loopback.
- Dominant language
- TypeScript
- Stars
- 813
- Forks
- 134
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 65
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from AltimateAI/altimate-code
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
AltimateAI/altimate-code#1359 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
AltimateAI/altimate-code#1323 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
AltimateAI/altimate-code#1288 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
AltimateAI/altimate-code#1285 ·
-
privacy: Altimate Base consent dialog no longer discloses persistent per-installation identifier Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
AltimateAI/altimate-code#1284 ·
All issues in AltimateAI/altimate-code
Similar issues
-
blocklist removal
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
MetaMask/eth-phishing-detect#296544 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
pastelsky/bundlephobia#1122 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
category/development priority/P2 scope/file-operations scope/testing type/enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Enatega Customer and Rider app: Add-ons price is not visible to customer after order is placed. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100