OXYGENHUB

Tuner: MCP over Streamable HTTP (2026-07-28 and 2025-11-25) issue #7 closed: completed andymccall opened this · 1 comment

andymccall

Tuner: the MCP endpoint POST /mcp (spec §15.1).

  • Protocol revision 2026-07-28 first: MCP-Protocol-Version, Mcp-Method and Mcp-Name required and checked against the body (400 and -32020 on a mismatch); server/discover; subscriptions/listen; no sessions; ttlMs and cacheScope on list results; tools listed in a fixed order.
  • 2025-11-25 too, so clients that still send initialize work.
  • Served on the Unix socket and the loopback port, authenticated by issue #4's signed requests (tokens only behind [security] allow_tokens), the assurance level on every event. Origin validation against DNS rebinding.
  • The JSON-RPC layer starts from oxy-core::mcp's shape (Tool, ToolOutput, read_only, destructive) and adds the HTTP transport, with SSE responses per request.
  • Fuzz the parser with random and mutated bodies, as oxygen's CBOR tests do: it must never panic.

Done when a test client signs requests over the socket, discovers the server and lists the tools, and an unsigned or wrongly signed request is refused. After issue #4.

andymccall set labels feature, security ·

andymccall set milestone Sprint 1 ·

andymccall edited ·

andymccall referenced by change 571572f5fb2c on main ·

andymccall

Done: spectra serve holds the ledger and serves POST /mcp on data/spectra.sock (0660, peer uid read with SO_PEERCRED) and 127.0.0.1:7350; it refuses a non-loopback bind without --insecure, removes a stale socket only when nothing answers, and checkpoints on SIGTERM. Every request is verified by issue #4's Authenticator before parsing: unsigned, unknown key, stale, replayed, wrong body and wrong uid are refused (wrong uid is logged as guard.impersonation; --learn-uid binds on first use as agent.uid_bound). MCP 2026-07-28 with Mcp-Method/Mcp-Name/version headers checked against the body (-32020), unsupported versions (-32022 with the list), server/discover, tools/list with ttlMs and cacheScope, subscriptions/listen; 2025-x via initialize. A foreign Origin is 403. While serving, the CLI hands its owner-signed events to the daemon, which checks each as verify would. Tests drive the real binary over the socket. One deliberate change recorded in spec 0.3b: a refusal names its reason, since it concerns the caller's own key. Also scripts/deps-pin.sh keeps new crates on vendored versions (335 now).

andymccall closed ·