Repository navigation
Federation: CyberdyneAuth service auth for remote MCP servers - #108
Merged
Merged
Conversation
…ools to DMs A federated server can now be given a CyberdyneAuth client via FEDERATION_AUTH_<NAME>_ISSUER/_CLIENT_ID/_CLIENT_SECRET/_AUDIENCE/_SCOPE. A client_credentials token is minted through OIDC discovery, cached until 60 s before expiry, re-minted on a 401 (one retry), and sent as the bearer on that server's own httpx2 client only. Unknown servers, half-written credentials and non-https issuers or targets are startup config errors. Tools named my_* are refused unless the answer is a DM, and results marked [personal] or visibility=personal are withheld outside a DM whatever tool returned them. CyberWealth stays out of the public sources memory accepts, so turns resting on it are never remembered. OpenSpec change add-cyberwealth-federation; ops docs for the CyberWealth dev endpoint.
…ors to remote servers The bot's compose environment is an explicit list and did not declare the FEDERATION_AUTH_CYBERWEALTH_* variables, so in Coolify the bot never saw them, opened CyberWealth without a bearer and got 401. Declare the five variables on the bot service and hold them there in test_compose_env. A refused service credential (e.g. a leftover key for a removed server) used to return None from build_federation, taking the web, market and wallet tools down with it. It now drops only the remote MCP servers and logs composition.federation.service_auth_misconfigured. Add a test for federation_auth_environment: only FEDERATION_AUTH_* keys, process environment over .env. Correct the Coolify claim in design.md and tell operators a new server's credentials must be declared in compose.
…rvice-auth # Conflicts: # src/chatmemory/composition.py # src/chatmemory/config.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Federated MCP servers can now require a CyberdyneAuth client_credentials token. Per-server credentials come from FEDERATION_AUTH__{ISSUER,CLIENT_ID,CLIENT_SECRET,AUDIENCE,SCOPE}; the bot fetches and caches the token and sends it on every MCP session to that server. Misconfiguration (a credential for a server not in FEDERATION_SERVERS, a partial credential) refuses to start; credential errors are scoped to the remote server. Personal tools are held to DMs.
No migration. The CyberWealth credentials are passed to the bot service in compose; docs/operations.md has the CyberWealth setup (CyberWealth must add the client id to CW_SERVICE_PRINCIPALS).
Tests: unit + integration + e2e green locally; mypy, ruff, openspec strict clean.