Repository navigation
Serve an MCP server for AI agents - #686
Merged
vdolek merged 5 commits intoOct 30, 2026
Merged
Conversation
EvilBrainsBot
added
the
agent-in-progress
Claude
Member
Author
Code Review
Generated by Claude Code |
EvilBrainsBot
removed
the
agent-in-progress
EvilBrainsBot
added
the
agent-done
Claude
A file link row holds the SHA-256 of a 256-bit secret, the user, tenant and API token that created it, its target and its expiry ten minutes out. It stands outside the tenant like ApiTokens and has no history. Using a link deletes it with one DELETE ... RETURNING, so two concurrent uses spend it once; a hosted service removes expired rows every ten minutes. Revoking the token, or deleting its user or tenant, cascades to its links. The text reader returns a file version's text in pages of 50,000 characters: text formats as stored, the PDF text layer through PdfPig and DOCX paragraphs through OpenXml. A file over 30 MB is not read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UovdganawgyqDHGsank6jS
/mcp speaks stateless Streamable HTTP through the official SDK. A policy re-authenticates with the API token scheme alone, so the browser session and an access token get 401, and a foreign Origin gets 403 as a cross-site write does. Every MCP message is a POST, so the read-only boundary lets /mcp through; filters list only the read tools to a read-only token and refuse it the others. The tools call the business services in process with the contract DTOs, paging and filters of REST, and answer a validation, not-found or conflict outcome with its Problem Details title and detail as a tool error. File bytes travel only through one-time links on the anonymous /api/file-links: a PUT of raw bytes under the upload rules, or a GET sent with Cache-Control: no-store. The secret travels in the query string because the request log records only the path; hosting diagnostics and the SDK are pinned to Warning, below which they log the query string and tool results. The download link tool is a read tool, so a read-only token can fetch a file. Production sets AllowedHosts to its public host, since the link URL takes the scheme and host of the /mcp request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UovdganawgyqDHGsank6jS
Consuming a link is a business write that can fail, so it answers with an outcome enum and the action maps every member. The link's token id had no reader and is dropped from the consumed link. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UovdganawgyqDHGsank6jS
SDD-022 requires an English description on every tool and every parameter; the convention test covered the tools only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UovdganawgyqDHGsank6jS
EvilBrainsBot
force-pushed
the
claude/project-thread-fyo2wf-mcp
branch
from
October 30, 2026 21:03
729fc64 to
a0d268a
Compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UovdganawgyqDHGsank6jS
vdolek
approved these changes
Oct 30, 2026
github-actions
Bot
removed
the
agent-done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Martin · project thread
Summary
An MCP server on
/mcpfor AI agents, authenticated by API token only, with one-time links for file bytes. Stacked on #682, whose branch is the base.Changes
Origin403; a read-only token lists and calls only read tools.create_file_upload_link/create_file_download_linkon anonymous/api/file-links: 256-bit secret stored hashed, 10 minutes, single use, revoked with its token. The secret travels in the query string, which no log records. The download link tool is a read tool.read_file_text: text formats, PDF, DOCX; 50,000-character pages; 30 MB limit./mcprequests are logged like/api.Risks
EVILCASE_HOST, which setsAllowedHosts.CLAUDE.mdand the API rule still say every other path serves the frontend: [DECISION] Name /mcp in CLAUDE.md and the API rule #685.dotnet rcould not run here (no pwsh, no .NET 8 runtime); format, build and the changed test classes ran directly.Closes #673
Generated by Claude Code