Add PE RBAC Token - #8
Open
psreed wants to merge 4 commits into
Open
Conversation
The MCP endpoint is fronted by nginx, which authenticates against PE RBAC, but proxy.py built its client with no auth at all. Every request came back 401 and the initialize handshake died with an opaque "Session terminated" that gave no hint a token was involved. Read PE_RBAC_TOKEN and send it as the X-Authentication header via StreamableHttpTransport. An empty or unset token is valid -- not every deployment gates on RBAC -- so omit the header entirely rather than send an empty one, which some proxies reject outright. Also normalize PE_MCP_URL. PE serves the endpoint at /mcp; a trailing slash is rewritten upstream to /infra-assistant/mcp/ and 404s *after* the RBAC check passes, so the caller sees the same opaque handshake failure. Both forms get typed, so accept either. A 401 now writes an actionable diagnostic to stderr through an httpx response hook, naming the missing token and how to generate one. Supplying an httpx_client_factory makes fastmcp ignore the transport's verify, so the CA cert is applied inside the factory instead -- without that, TLS silently falls back to system CAs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
setup wrote only PE_MCP_URL into config.env, so the container path had no way to supply a token even once the client could use one. It also prompted for the URL with a trailing slash, which is the form that 404s. setup now prompts for the token without echoing it and stores it in /config/rbac-token at mode 0600 -- deliberately outside config.env, since it is a credential rather than configuration. Leaving the prompt blank is supported for deployments that do not gate on RBAC, and clears any previously stored token so blank reliably means blank. load_config exports the token when it is not already set, so an explicit -e PE_RBAC_TOKEN still wins, and re-normalizes PE_MCP_URL so a URL passed straight through -e gets the same treatment as one entered in setup. The placeholder comparison is normalized to match. The token is not required by validate or serve: an unauthenticated PE MCP is a valid target, and selftest.py explains a 401 if one was in fact needed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds build/, *.egg-info/ and uv.lock, which local builds and uv runs leave in the working tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gavindidrichsen
added a commit
that referenced
this pull request
Aug 7, 2026
Adds a "Which PE MCP target am I connecting to?" section, a walkthrough for connecting to the legacy pe-infra-assistant MCP with PE_RBAC_TOKEN, updated Troubleshooting entries for PR #8's actual diagnostics, and a new CHEATSHEET.md with copy-paste validate commands for both targets. Proposed documentation pending Gavin's review -- not yet pushed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
gavindidrichsen
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.