feat: MCP-over-HTTP + --bind/--token for headless/LAN mode#23
Merged
Conversation
Lets a vibecockpit instance run on a server (e.g. via --autostart on a Linux box) and serve as a central memory hub for multiple machines. Web server: - New --bind <addr> flag (default 127.0.0.1). Pass 0.0.0.0 or a specific IP to expose to the LAN. - New --token / VIBECOCKPIT_TOKEN. Required when --bind is non-loopback; Start() refuses to listen otherwise — better to fail loud than ship an unauthenticated dashboard onto a network. - bearerAuthMiddleware: loopback requests bypass entirely (so SSH-tunnel + the auto-launched browser keep working). Non-loopback requests must carry Authorization: Bearer <token>, with a ?token= query fallback for download flows. Constant-time compare. - Auto-open-browser is now skipped on non-loopback bind (no browser on a headless server). MCP transport: - Same internal/mcp.Server now exposes a HandleHTTPRequest(body []byte) []byte method backed by the same dispatcher the stdio transport uses. - /mcp endpoint on the web server speaks the MCP "Streamable HTTP" transport: each POST is one JSON-RPC request; response is the encoded reply, or 204 No Content for notifications. - /mcp is registered behind the same auth middleware as everything else, and gated by enable_mcp in config.yaml just like the stdio path. - Audit log is shared, so both transports' tool calls land in the same /api/mcp-audit feed. Tests: - isLoopbackBind table test for IPv4/IPv6 + localhost. - bearerAuthMiddleware: loopback bypass, missing/wrong/correct bearer, query-string fallback, defensive 401 when token unset on remote. - /mcp end-to-end: tools/list returns the full toolset, notifications return 204, MCP-disabled returns 503. Docs: README has a Remote/Headless Mode section with Claude Desktop and Cursor MCP-over-HTTP config snippets. CLAUDE.md notes the new flags and that the MCP toolset is identical across both transports. Verified live: --bind 0.0.0.0 without --token refuses to start; with --token, remote requests need the bearer (401 without, 200 with); loopback requests stay token-free; tools/list and search_memory round-trip correctly over HTTP.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lets a single vibecockpit instance run headless on a server and act as a central memory hub for multiple machines.
Verified live
Test plan