Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Proposal: optional endpoint-bound preflight hook before remote MCP calls

Ouverte
  • Quelque chose ne va pas ?
#449 3 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
35/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
typescript
Domaine
backend-api-design, security

Piste de recherche

Commencez par server/src/plugins/store.ts vers la ligne 2799, puis suivez PluginStore.callTool, transportFor et callVendor afin de comprendre les limites de sélection et d’identifiants. Examinez les tests natifs proposés pour store/transport dans l’issue ; le travail est terminé lorsque les tests ciblés couvrent les endpoints capturés, les refus, les redirections, l’annulation, les éléments de preuve inconnus et des lignes d’audit exactes entre deux instances de store.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

OpenBot already makes tool grants, action policy, argument inspection and audit part of PluginStore.callTool. I would like to discuss a small optional extension for operators who also want fresh evidence about a public remote MCP endpoint before calling it, following the README's request to coordinate before substantial work.

At the current source, the selected row and catalogue entry are available before credentials are resolved. callVendor is a test injection that replaces the transport and receives credentials; it is not a suitable public evidence-provider contract. Also, transportFor can select MCP, Drive REST or built-in routines, so a proposed MCP check must identify the actual selected transport.

Would an opt-in asynchronous, deny-only hook at this boundary be welcome?

  • Run after the existing grant/policy/content checks and before credential resolution. Capture the effective URL, transport and physical tool name once, and use that same selection for execution after the await. A concurrent server edit must not let evidence for endpoint A authorize endpoint B.
  • Give the provider a read-only public endpoint descriptor and an abort signal. Do not expose credentials, tool arguments, actor identities or result content. Initial scope would be explicitly configured public MCP endpoints; private or credential-bearing URLs would not be disclosed.
  • The hook can continue or refuse this already-permitted call; it cannot override an existing refusal. Unavailable or unknown evidence follows explicit operator policy. Bound the request lifetime and response size, reject redirects, and keep provider text out of model-facing refusal messages.
  • Preserve the current audit contract: a refused invocation records one refusal and makes no vendor call; a forwarded invocation retains the actual vendor outcome. Keep any new decision state local to the request. Both server replicas perform their own check; no process-local persistent receipt/cache or new listener is proposed.

I maintain Agent Guild under AgentTanuki and would use this seam for an optional adapter to its free /preflight endpoint. That endpoint actively probes the configured public URL and returns unsigned observations; it does not establish endpoint ownership, authenticated access, passport verification or safety. The proposed core hook would be provider-neutral and add no automatic Guild request or paid call. The adapter would require explicit operator setup.

If the extension fits the intended architecture, I can prepare a focused PR with native store/transport tests: denied call reaches neither vault nor vendor, allowed call reaches only its captured endpoint, same-name servers cannot exchange evidence, redirects cannot change the checked destination, existing policy refusals remain effective, cancellation/unknowns are handled, and audit rows remain accurate across two store instances. This is a coordination proposal based on source inspection; those tests have not yet been implemented or run.

Langage dominant
TypeScript
Étoiles
6.6k
Forks
914
Merge moyen
19 h 22 min
PR mergées (30 j)
140

Préparer son environnement

  • Fournit un Dockerfile ou un fichier Docker Compose
  • Propose un modèle de pull request
  • Aucun guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de CopilotKit/OpenBot

Toutes les issues de CopilotKit/OpenBot

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.