Repository navigation
Implement the decided MCP URL policy #112
Description
Question
Apply whatever the "Decide the MCP URL policy" ticket settles (HTTPS rules, allowlist shape) to the MCP fingerprinting config path in crates/agenticd/src/mcp.rs and its config surface. If the decision calls for an ADR, write and land the ADR first, then implement.
Scope:
- Enforce the decided policy at config-load and/or request time, with typed errors.
- Regression tests: disallowed scheme rejected, non-allowlisted URL rejected (per the decided policy), loopback exception honored if decided.
- Ensure the demo's local MCP fingerprinting still works under the new policy.
Blocked by the URL-policy decision ticket.
Resolution records: PR link (and ADR link if one was written), test names.
Activity
tonibergholm commentedon Jul 9, 2026
Scope from the resolved decision ticket (#108): implement the three-part policy — (1) startup rejection of non-loopback http:// MCP URLs, typed error, no escape hatch; (2) reqwest::redirect::Policy::none() on the daemon client, redirect → per-server error naming the Location target, comment pinning the shared-client contract; (3) no allowlist. Draft ADR-0016 (one-pager, ADR-0001 format) first, recording all three plus the allowlist-by-construction reasoning. Tests: non-loopback http rejected at startup, loopback http accepted, redirect response rejected with Location in the error.
tonibergholm commentedon Jul 10, 2026
Resolution
Shipped as PR #122 (pending review/merge). ADR-0016 written and marked Accepted, recording all three decisions.
What landed: (1)
validate_mcp_urlenforcing HTTPS-except-loopback at startup viaparse_mcp_spec— typedMcpUrlError, no escape hatch; (2)reqwest::redirect::Policy::none()on the shared daemon client withfingerprint_onerejecting a 3xx and naming theLocation(the SSRF-closing half), plus a comment pinning the shared-client contract; (3) no allowlist, by construction, with the reasoning in the ADR.Tests: https + four loopback-http forms accepted; non-loopback http / public-IP http / non-http(s) schemes rejected with the right variant; startup abort through
parse_mcp_spec; redirect-to-metadata-address rejected with Location surfaced. Workspace tests + clippy + fmt green. Demo confirmed unaffected (no--mcpin run-demo.sh).Fact for later: ADR-0016 governs the daemon's MCP config surface; the
urlcrate is now a direct agenticd dep.Enforce the MCP URL policy: HTTPS-except-loopback + no redirects (ADR…