Open
Conversation
Add HTTP transport mode alongside stdio for hosting the MCP server as a web service. The AI sidebar connects to this server for tool execution. - Per-request credential isolation via AsyncLocal (no shared state) - Authorization header + X-Org-Id + X-Instance-Url required on tool calls - Credential-mutating tools blocked in HTTP mode (login, logout, etc.) - Request body size limited to 1MB - CORS origins configurable via MCP_CORS_ORIGINS env var - Tool results truncated to 500 chars in logs - Generic error messages to clients, details logged server-side - SafeArgs regex whitelist on all command inputs - Token refresh with JWT expiry checking - 40 unit tests covering security, isolation, registry, and blocked tools
morgang5522
reviewed
Apr 5, 2026
|
|
||
| // ── HTTP mode: in-process execution ────────────────────────────────── | ||
|
|
||
| private async Task<string> ExecuteInProcess(string command) |
There was a problem hiding this comment.
Is there an easier way to handle all of these permutations of commands and options? I feel like we might be duplicating it here and in the CLI
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Key Changes
mcp/Program.cs— HTTP server with health check, tool listing, and authenticated tool execution endpointsmcp/McpClientFactory.cs— Per-request credential management with JWT expiry checking and token refreshmcp/Tools/CliTool.cs— Expanded tool set (entities, fields, workflows, data, fetch) with SafeArgs input validationmcp/McpToolRegistry.cs— Tool definition registry for HTTP modetests-mcp/— 40 unit testsSecurity
X-Org-Id+X-Instance-Urlrequired on all tool execution requestsMCP_CORS_ORIGINS(defaults to localhost for dev)Running
cd mcp dotnet run -- --http --port 5299Environment variables:
MCP_CORS_ORIGINS— comma-separated allowed origins (default:http://localhost:5200)Test plan
/health/tools