Skip to content

fix(wake): serve without withAuth for parity with other commerce MCPs #549

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guitavano merged 1 commit into from
Aug 24, 2026
Merged

fix(wake): serve without withAuth for parity with other commerce MCPs #549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions auth-exemptions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,9 @@
"vtex-docs": {
"reason": "Predates the withAuth requirement — 2 findings pending remediation."
},
"wake": {
"reason": "Open for parity with the other deco-hosted commerce MCPs (VTEX, Shopify, Magento). Re-add withAuth once Mesh token-forwarding lets end users connect without supplying the shared secret."
},
"whatsapp": {
"reason": "Predates the withAuth requirement — 1 finding pending remediation."
},
Expand Down
11 changes: 5 additions & 6 deletions wake/server/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@
*/
import { withRuntime } from "@decocms/runtime";
import { serve } from "@decocms/mcps-shared/serve";
import { withAuth } from "@decocms/mcps-shared/auth";

import { tools } from "./tools/index.ts";
import { type Env, StateSchema } from "./types/env.ts";
Expand All @@ -25,11 +24,11 @@ const runtime = withRuntime<Env, typeof StateSchema>({
});

/**
* `withAuth` is mandatory: this MCP is served on a public hostname, so every
* request must present the shared secret from the AUTH_TOKEN environment
* variable. It is read at startup — without it the process exits instead of
* serving anonymous traffic. `scripts/check-auth.ts` fails CI if it is removed.
* Served without `withAuth` for parity with the other deco-hosted commerce MCPs
* (VTEX, Shopify, Magento…), which are still open pending the shared-secret
* rollout. Tracked in `auth-exemptions.json`; re-add `withAuth` once the Mesh
* token-forwarding path is in place so end users don't have to supply a secret.
*/
if (runtime.fetch) {
serve(withAuth(runtime.fetch));
serve(runtime.fetch);
}
Loading