Support scoped Bugzilla access for agents via a capability-token proxy
Maintainers usually reply within 1 day
@suhaibmujahid is already working on this.
Since Aug 24, 2026.
Assessment
This issue has not been assessed yet.
Description
Agents currently reach Bugzilla through a broker sidecar holding a static BMO API key. That key gives every run of an agent the same standing access.
What we need is a shared service holding the upstream credential, and replace the broker's key with a per-run capability token minted by hackbot-api. The token states what the run may read; the proxy enforces it, filters results, and logs every decision.
This is inspired by proxsy, the authorization-proxy prototype @choller built, and borrows its rule-evaluation and content-filtering approach. The main departure is that authorization comes from a signed per-run token rather than static YAML client keys, which is what lets the scope be derived server-side per run.
- Dominant language
- Python
- Stars
- 571
- Forks
- 355
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 78
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from mozilla/bugbug
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Install `xvfb` in the image for the bug fix agentPossibly taken @ayoubdiourin7 claimed this 5 days ago. Openhackbot
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
mozilla/bugbug#6947 · 1 assignee ·
Maintainers usually reply within 1 day
-
good-first-bug hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
good-first-bug hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
mozilla/bugbug#6918 · 5 comments ·
Maintainers usually reply within 1 day
Similar issues
-
upstream update
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
conan-io/conan-center-index#31098 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
john-kurkowski/tldextract#382 ·
-
comp/tools duplicate P2 sweeper:risk-compatibility tool/mcp type/bug
Difficulty 1/5 Under an hour Newbie friendliness 88/100
NousResearch/hermes-agent#132042 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
deepset-ai/haystack#13092 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 85/100
feder-cr/invisible_playwright_mcp#1408 ·
Maintainers usually reply within 1 day