Skip to content

feat: support optional anonymous read-only MCP - #4

Merged
jmrGrav merged 2 commits into
mainfrom
feature/anonymous-readonly-mcp
Jul 2, 2026
Merged

feat: support optional anonymous read-only MCP#4
jmrGrav merged 2 commits into
mainfrom
feature/anonymous-readonly-mcp

Conversation

@jmrGrav

@jmrGrav jmrGrav commented Jul 2, 2026

Copy link
Copy Markdown
Owner

Summary

  • adds explicit optional anonymous MCP mode behind ANONYMOUS_ENABLED
  • requires an explicit ANONYMOUS_PUBLIC_TOOLS allowlist when anonymous mode is enabled
  • allows anonymous protocol setup and public tools/call only for allowlisted tool names
  • keeps invalid bearer tokens as 401, even when anonymous mode is enabled
  • filters anonymous tools/list responses so protected tool names are not advertised
  • documents configuration and operating constraints

Security model

  • disabled by default
  • fail-fast if anonymous mode is enabled without a public tool allowlist
  • no change to authenticated OAuth/PKCE behavior
  • no write tools added
  • no production deployment performed

Validation

  • go test ./...
  • go test -race ./...
  • go vet ./...
  • gitleaks detect --no-banner --redact --source .

Closes #3

@jmrGrav
jmrGrav merged commit 269849f into main Jul 2, 2026
6 checks passed
@jmrGrav
jmrGrav deleted the feature/anonymous-readonly-mcp branch July 2, 2026 05:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support optional anonymous read-only MCP mode

1 participant