Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Proposal: optional endpoint-bound preflight hook before remote MCP calls

Abierto
  • ¿Algo no está bien?
#449 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
backend-api-design, security

Línea de trabajo

Comienza con server/src/plugins/store.ts alrededor de la línea 2799 y sigue después PluginStore.callTool, transportFor y callVendor para entender los límites de selección y de credenciales. Revisa las pruebas nativas propuestas para store/transport en el issue; el trabajo estará terminado cuando las pruebas enfocadas cubran endpoints capturados, rechazos, redirecciones, cancelación, evidencia desconocida y filas de auditoría precisas en dos instancias de store.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

OpenBot already makes tool grants, action policy, argument inspection and audit part of PluginStore.callTool. I would like to discuss a small optional extension for operators who also want fresh evidence about a public remote MCP endpoint before calling it, following the README's request to coordinate before substantial work.

At the current source, the selected row and catalogue entry are available before credentials are resolved. callVendor is a test injection that replaces the transport and receives credentials; it is not a suitable public evidence-provider contract. Also, transportFor can select MCP, Drive REST or built-in routines, so a proposed MCP check must identify the actual selected transport.

Would an opt-in asynchronous, deny-only hook at this boundary be welcome?

  • Run after the existing grant/policy/content checks and before credential resolution. Capture the effective URL, transport and physical tool name once, and use that same selection for execution after the await. A concurrent server edit must not let evidence for endpoint A authorize endpoint B.
  • Give the provider a read-only public endpoint descriptor and an abort signal. Do not expose credentials, tool arguments, actor identities or result content. Initial scope would be explicitly configured public MCP endpoints; private or credential-bearing URLs would not be disclosed.
  • The hook can continue or refuse this already-permitted call; it cannot override an existing refusal. Unavailable or unknown evidence follows explicit operator policy. Bound the request lifetime and response size, reject redirects, and keep provider text out of model-facing refusal messages.
  • Preserve the current audit contract: a refused invocation records one refusal and makes no vendor call; a forwarded invocation retains the actual vendor outcome. Keep any new decision state local to the request. Both server replicas perform their own check; no process-local persistent receipt/cache or new listener is proposed.

I maintain Agent Guild under AgentTanuki and would use this seam for an optional adapter to its free /preflight endpoint. That endpoint actively probes the configured public URL and returns unsigned observations; it does not establish endpoint ownership, authenticated access, passport verification or safety. The proposed core hook would be provider-neutral and add no automatic Guild request or paid call. The adapter would require explicit operator setup.

If the extension fits the intended architecture, I can prepare a focused PR with native store/transport tests: denied call reaches neither vault nor vendor, allowed call reaches only its captured endpoint, same-name servers cannot exchange evidence, redirects cannot change the checked destination, existing policy refusals remain effective, cancellation/unknowns are handled, and audit rows remain accurate across two store instances. This is a coordination proposal based on source inspection; those tests have not yet been implemented or run.

Lenguaje dominante
TypeScript
Estrellas
6.6k
Forks
914
Merge medio
19 h 22 min
PR fusionados (30 d)
140

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de CopilotKit/OpenBot

Todos los issues de CopilotKit/OpenBot

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.