  hugocasaandClaude Opus 5
|
e474e8803c
|
feat: expose request headers to scripts invoked via MCP (#10903)
* feat: expose allowlisted request headers to scripts invoked via MCP
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* fix: close header-forgery routes flagged in review of MCP header passthrough
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* fix: match allowlisted headers exactly and withdraw every model-args run path
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* fix: address review nits on MCP header passthrough
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* fix: stop over-withdrawing deleteScriptByHash and align schema strip key space
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* refactor: move MCP header field detail into a label tooltip
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* fix: bound include_header parsing and narrow the duplicate-header drop
* feat: handle runnable-executing tools instead of withdrawing them
* docs: record the preprocessor kind seam on proxied run-by-path
* fix: strip every runnable argument map and open the field to gateway tokens
* fix: withhold connection credentials from runnables unless explicitly named
* fix: keep endpoint control arguments out of the transport-owned strip
* fix: exempt workspace_id from the strip only where it routes the call
* style: reindent the MCP header tooltip block
* refactor: deliver MCP request headers through the preprocessor only
* fix: widen the proxy-owned header set and clear docs left by the redesign
* fix: count proxied header delivery and finish the redesign doc sweep
* fix: forward proxied headers only to a runnable that has a preprocessor
* refactor: drop include_header and the MCP credential deny list
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* chore: restore the blank line in CreateToken
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* refactor: drop the mcp header_passthrough feature usage counter
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* test: pin that a caller credential other than the hop's own travels
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* refactor: deliver headers only through the direct script and flow tools
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* feat: withhold connection credentials and pin MCP header delivery end to end
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
* test: send every credential the withheld-list assertions cover
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
2026-09-03 11:30:20 +02:00 |
|