Feature: GoModel onboarding / bootstrapping - openning the dashboard for the first time
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- go
- Domain
- authentication, backend, security
Research direction
Start by reading the onboarding and security behavior described in the issue, then inspect internal/server/http.go and internal/server/admin_access_test.go; config/config.go is also cited for default admin and MCP settings. Determine how first-time setup should behave when credentials or providers are missing, and update the related tests to verify admin access is no longer anonymous while preserving an explicit recovery path.
Written by the indexing model from the issue text.
Description
Is your feature request related to a problem? Please describe.
Right now, GoModel by default is accessible without any credentials. There should be some onboarding process / bootstrapping when the credentials OR providers are not set by default.
Below more wordy security related issue reported by AI agent:
- Anonymous admin control plane when no master key is configured
The entire /admin/* API skips authentication whenever MasterKey is empty and no extension request authenticator exists—even if
managed API keys are configured through the ordinary Authenticator. This behavior is explicitly tested as a “lockout recovery”
path.Evidence: internal/server/http.go:247, internal/server/admin_access_test.go:95. Admin endpoints and MCP are enabled by
default: config/config.go:186.Impact:
- Anonymous audit-log access, including prompts and responses.
- Creation/deactivation of managed keys.
- Modification of workflows, budgets, rate limits, provider configuration, guardrails and runtime settings.
- Registration of arbitrary HTTP MCP endpoints, enabling SSRF/internal service access and malicious routing.
- Managed keys cannot secure the admin API unless a master key is also configured.
I verified that admin-managed MCP entries cannot use stdio, so I did not find a direct RCE chain: internal/mcpgateway/
store.go:29.
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 111
- Avg merge
- 14h 43m
- Merged PRs (30d)
- 142
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ENTERPILOT/GoModel
-
enhancement
Difficulty 3/5 1-2 days Newbie friendliness 55/100
ENTERPILOT/GoModel#1182 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 15/100
ENTERPILOT/GoModel#1170 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
ENTERPILOT/GoModel#1165 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 Half a day Newbie friendliness 35/100
ENTERPILOT/GoModel#1154 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
ENTERPILOT/GoModel#1107 ·
Maintainers usually reply within 1 day
All issues in ENTERPILOT/GoModel
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
SAP/crossplane-provider-btp#1118 ·
Maintainers usually reply within 1 day
-
benchmark: `make setup` fails because audit-exporter builds with Go 1.25.0 while go.mod requires 1.26.0Possibly taken @xsvm claimed this today. Open
Difficulty 1/5 Under an hour Newbie friendliness 84/100
volcano-sh/volcano#6097 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
[Bug]: Bedrock invoke-with-response-stream reports `stop_reason: "end_turn"` for tool-use turnsOpen
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day