can1357 b94bfba025 feat(mcp): enforced header precedence and origin policy on remote transports ...

- Client-generated HTTP/MCP/authorization headers win over configured
  headers case-insensitively (Agent Plugins §7.2.1) via the new
  header-policy fetch wrapper used by the HTTP and legacy SSE transports.
- headerPolicy: "origin-locked" pins configured headers to the configured
  URL's origin: never forwarded across cross-origin redirects, and
  method-changing redirects of JSON-RPC POSTs are refused.
- envPolicy: "literal" exempts stdio env values (and origin-locked
  headers) from config-value resolution: no ambient env-name lookup, no
  __omp_shell("command execution, empty values preserved.")

2026-08-07 05:59:36 +02:00

..

transports

feat(mcp): enforced header precedence and origin policy on remote transports

2026-08-07 05:59:36 +02:00

client.ts

fix(mcp): supported legacy sse transport

2026-06-28 07:48:40 +00:00

config-writer.ts

style: applied biome import order and formatting

2026-08-03 15:26:20 +02:00

config.ts

feat(mcp): enforced header precedence and origin policy on remote transports

2026-08-07 05:59:36 +02:00

index.ts

feat(mcp): resource notifications, subscriptions, and read_resource builtin tool (#254)

2026-03-03 03:26:07 +01:00

json-rpc.ts

fix(coding-agent): stopped web-search query mangling and API-key log leakage

2026-06-10 01:28:04 +02:00

loader.ts

fix(mcp): updated startup connection status

2026-06-20 21:14:41 +00:00

manager.ts

feat(mcp): enforced header precedence and origin policy on remote transports

2026-08-07 05:59:36 +02:00

oauth-credentials.ts

fix: fixed OAuth and profile-boundary regressions across CLI and env handling

2026-06-15 03:20:45 +02:00

oauth-discovery.ts

fix(mcp): bound oauth discovery and smithery poll fetches with abort timeouts

2026-07-23 19:45:41 +00:00

oauth-flow.ts

fix(mcp): expand env vars in reauth oauth credentials and reject empty tokens

2026-08-03 00:33:36 +00:00

render.ts

feat(coding-agent): render MCP Markdown results

2026-07-23 13:26:00 +07:00

request-id.ts

refactor(coding-agent/mcp): changed default MCP request ID format to sequential integers

2026-08-01 20:33:11 +02:00

smithery-auth.ts

fix(mcp): retry smithery poll timeouts until the authorization deadline

2026-07-23 22:15:21 +02:00

smithery-connect.ts

fix(network): bounded smithery and startup fetches

2026-07-02 23:51:18 +02:00

smithery-registry.ts

fix(network): bounded smithery and startup fetches

2026-07-02 23:51:18 +02:00

startup-events.ts

fix(mcp): sanitized startup server names

2026-06-20 23:43:16 +02:00

timeout.ts

feat(mcp): added validation and warning for invalid OMP_MCP_TIMEOUT_MS

2026-05-26 20:30:02 +02:00

tool-bridge.ts

fix(mcp): kept disable precedence and stable tool collision winners

2026-07-27 16:07:23 +02:00

tool-cache.ts

refactor: unslop common utilities

2026-02-22 11:01:11 +01:00

types.ts

feat(mcp): enforced header precedence and origin policy on remote transports

2026-08-07 05:59:36 +02:00