Files
windmill/backend/windmill-mcp/Cargo.toml
Ruben Fiszel 8053266f88 fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url (#9428)
* fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): clone user_db for oauth2 refresh and drop advisory ids from comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): disable redirects on MCP client to prevent SSRF bypass

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 09:00:43 +00:00

35 lines
1.1 KiB
TOML

[package]
name = "windmill-mcp"
version.workspace = true
authors.workspace = true
edition.workspace = true
[lib]
name = "windmill_mcp"
path = "src/lib.rs"
[features]
default = []
server = ["rmcp/transport-streamable-http-server", "rmcp/transport-streamable-http-server-session", "rmcp/transport-worker", "dep:sqlx", "dep:async-trait", "dep:http", "dep:tokio-util", "dep:tokio"]
auth = ["rmcp/auth", "dep:oauth2", "dep:sqlx", "dep:chrono"]
[dependencies]
oauth2 = { version = "5.0", optional = true }
windmill-common = { workspace = true, default-features = false }
anyhow.workspace = true
reqwest = { version = "=0.12", features = ["json", "stream", "gzip"] }
serde.workspace = true
serde_json.workspace = true
tracing.workspace = true
rmcp.workspace = true
sqlx = { workspace = true, optional = true }
chrono = { workspace = true, optional = true }
async-trait = { workspace = true, optional = true }
http = { workspace = true, optional = true }
tokio-util = { workspace = true, features = ["rt"], optional = true }
tokio = { workspace = true, optional = true }
futures.workspace = true
[dev-dependencies]
tokio = { workspace = true, features = ["macros", "rt"] }