starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-21 00:02:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: move the MCP URL token setting to Core

Browse Source 
It sat in the Auth/OAuth/SAML list, which the settings sidebar shows under SSO,
suggesting a dependency on SSO that does not exist: MCP OAuth has Windmill act as
the authorization server, and any login method, password included, completes it.
It is an instance-wide credential policy, so it now lives with the other ones in
Core, kept out of quick setup like its neighbours.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
hugocasa
2026-09-16 16:02:48 +02:00
co-authored by Claude Opus 5
parent 0d1fdb5da8
commit 9a5010625f
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/lib/components/instanceSettings.ts
+9 -8
View File
@@ -298,6 +298,15 @@ export const settings: Record<string, Setting[]> = {
ee_only: '',
hideInQuickSetup: true
},
{
label: 'Disable token in MCP URLs',
description:
'Reject the ?token= query parameter on the MCP endpoints, so MCP clients authenticate with an Authorization header or through the OAuth flow. A token in a URL is a credential that ends up in browser history, proxy logs and referrers. Existing MCP URLs carrying a token stop working. Servers and workers pick this up within a minute; dedicated MCP servers (MODE=mcp) apply it when they next restart.',
key: 'mcp_disable_token_query_param',
fieldType: 'boolean',
storage: 'setting',
hideInQuickSetup: true
},
{
label: 'Audit log retention (days)',
key: 'audit_log_retention_days',
@@ -686,14 +695,6 @@ export const settings: Record<string, Setting[]> = {
fieldType: 'boolean',
storage: 'setting'
},
{
label: 'Disable token in MCP URLs',
description:
'Reject the ?token= query parameter on the MCP endpoints, so MCP clients authenticate with an Authorization header or through the OAuth flow. A token in a URL is a credential that ends up in browser history, proxy logs and referrers. Existing MCP URLs carrying a token stop working. Servers and workers pick this up within a minute; dedicated MCP servers (MODE=mcp) apply it when they next restart.',
key: 'mcp_disable_token_query_param',
fieldType: 'boolean',
storage: 'setting'
},
{
label: 'Auto-login SSO provider',
description: