(chore) Decide whether the MCP gateway host allowlist should also drop the HTTPS requirement

Abierto
  • ¿Algo no está bien?
#7,036 1 comentario 1 reacción 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
backend, security

Línea de trabajo

Start by reading validate_egress_url_format and exempt_hosts() in api/oss/src/core/gateways/egress.py, then compare the documented behavior corrected by PR #7024 and the related concerns in #6966. This issue needs a deliberate decision about whether the allowlist also bypasses the HTTPS requirement; it does not specify which behavior to implement. Done means that decision is made and the code and documentation agree.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

backend chore security self-hosting issue

Adding a hostname to AGENTA_MCP_GATEWAY_HOST_ALLOWLIST so the gateway can reach one internal MCP server also turns off the transport check for that host. A plain HTTP URL on an allowlisted host is accepted, both when the server is saved and when it is dialled. That behaviour is real, it is now what the self-host documentation says, and the question is whether it is what we want the allowlist to mean.

Steps to reproduce

  1. Set AGENTA_MCP_GATEWAY_HOST_ALLOWLIST=mcp.internal and leave AGENTA_GATEWAYS_INSECURE_EGRESS_ALLOWED at its default.
  2. Save an MCP server at http://mcp.internal:8080.
  3. It is accepted. So is https://mcp.internal:8443. A URL on a host that is not on the list, such as https://10.0.0.5:8443, is still refused.

Where it comes from

Read on release/v0.119.1. validate_egress_url_format in api/oss/src/core/gateways/egress.py:372-375 looks the hostname up in exempt_hosts() first and returns before any scheme or literal-address check runs:

hostname = (urlparse(url).hostname or "").lower()
if hostname and hostname in exempt_hosts():
    return

exempt_hosts() (egress.py:108) is the operator allowlist plus the development mock upstreams. So the allowlist is a full exemption from the guard, not a narrowing of it.

The documentation shipped with 0.119.1 said the opposite. PR #7024 corrects the page to describe what the code does: a host on the list is accepted whatever its scheme, at save time and at call time.

The decision

Two readings of what the allowlist means, and they lead to different code:

  1. The allowlist means "I take responsibility for this host, treat it as trusted." The current code is then correct, #7024 finishes the job, and nothing else is needed.
  2. The allowlist only relaxes the private-address rule, and plain HTTP still needs AGENTA_GATEWAYS_INSECURE_HTTP_ALLOWED. The exemption should then run after the scheme check rather than before it.

Reading 2 keeps the two switches independent, which is easier to explain to an operator: one switch says where you may go, the other says over what transport. It also means an operator who allowlists one internal name does not silently accept a credential-bearing request over an unencrypted connection to it.

Reading 1 is the smaller change, and it is already written down.

This needs a deliberate answer rather than being left as it is, because the allowlist is the setting a self-hoster reaches for first when a server is unreachable, and it currently does more than its name suggests.

Related: #6966 covers other self-host gaps around the same flags, including a credential path with no transport check.

Lenguaje dominante
TypeScript
Estrellas
4.8k
Forks
690
Merge medio
20 h 11 min
PR fusionados (30 d)
448

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Agenta-AI/agenta

Todos los issues de Agenta-AI/agenta

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.