jif bf4d3f51ea
Restrict hosted MCP credentials to local environments ( #36306 ) ...
## Why
Executor-owned MCP servers must not receive hosted ChatGPT actor credentials or credentials from the host's OAuth store.
## What changed
- Provide the ChatGPT auth provider and consult stored OAuth credentials only for MCP servers in the local environment.
- Require non-local servers configured with `auth = "chatgpt"` to supply a non-empty, valid static `Authorization` header. Reject environment-backed authorization so host secrets are not resolved for an executor-owned server.
- Report unsupported authentication and fail startup before connecting when an executor-owned server has no acceptable explicit authorization.
## Testing
Add coverage for local credential forwarding, non-local credential isolation, static header validation, auth status, OAuth lookup avoidance, and startup rejection.
GitOrigin-RevId: e18f1878f260c93d9babd390a5a7eac86172299b
2026-07-31 10:42:02 +00:00
2026-07-29 13:53:15 +00:00
2026-06-09 12:48:04 -07:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-07-30 21:12:41 +00:00
2026-07-29 13:53:15 +00:00
2026-07-31 06:02:15 +00:00
2026-07-29 00:30:11 +00:00
2026-07-21 08:50:21 +00:00
2026-07-30 23:12:50 +00:00
2026-07-30 19:47:30 +00:00
2026-07-28 05:26:16 +00:00
2026-07-29 18:29:26 +00:00
2026-07-22 02:19:45 +00:00
2026-07-21 08:59:41 +00:00
2026-06-11 18:16:39 -07:00
2026-05-08 04:07:59 +00:00
2026-07-30 21:49:53 +00:00
2026-06-13 21:43:39 -07:00
2026-07-23 01:00:35 +00:00
2026-07-30 01:20:28 +00:00
2026-07-30 21:49:53 +00:00
2026-07-29 14:01:31 +00:00
2026-07-21 08:28:51 +00:00
2026-06-11 18:16:39 -07:00
2026-07-30 20:24:29 +00:00
2026-07-30 20:24:29 +00:00
2026-07-30 20:24:29 +00:00
2026-07-30 20:24:29 +00:00
2026-07-28 21:16:06 +00:00
2026-07-30 21:49:53 +00:00
2026-07-07 01:12:24 +00:00
2026-05-07 15:44:17 -07:00
2026-06-15 20:10:53 -07:00
2026-07-31 10:42:02 +00:00
2026-06-21 13:35:25 -07:00
2026-07-27 18:41:09 +00:00
2026-07-23 01:00:35 +00:00
2026-07-26 23:36:33 +00:00
2026-07-30 20:24:29 +00:00
2026-07-24 06:03:36 +00:00
2026-07-29 01:16:29 +00:00
2026-07-30 17:14:40 +00:00
2026-06-05 15:41:13 -07:00
2026-07-30 01:37:41 +00:00
2026-07-30 19:23:33 +00:00
2026-07-30 19:23:33 +00:00
2026-07-20 06:13:29 +00:00
2026-07-30 10:01:06 +00:00
2026-07-30 00:50:02 +00:00
2026-07-30 20:24:29 +00:00
2026-07-28 17:51:37 +00:00
2026-05-07 15:44:17 -07:00
2026-07-23 23:35:29 +00:00
2026-05-28 23:09:55 -07:00
2026-07-22 02:19:45 +00:00
2026-07-27 18:07:31 +00:00
2026-07-28 19:58:25 +00:00
2026-07-31 04:20:56 +00:00
2026-06-12 19:52:49 +00:00
2026-07-27 18:07:31 +00:00
2026-07-22 04:17:34 +00:00
2026-07-30 21:49:53 +00:00
2026-07-28 21:58:33 +00:00
2026-07-30 11:52:38 +00:00
2026-07-17 20:52:42 +00:00
2026-07-23 19:32:26 +00:00
2026-07-23 00:02:15 +00:00
2026-07-28 13:31:41 +00:00
2026-07-27 18:07:31 +00:00
2026-07-30 04:26:36 +00:00
2026-07-29 23:58:10 +00:00
2026-07-24 23:36:11 +00:00
2026-05-25 17:26:10 -03:00
2026-07-22 19:14:11 +00:00
2026-07-30 22:45:04 +00:00
2026-05-07 15:44:17 -07:00
2026-07-29 23:24:43 +00:00
2026-07-29 18:29:26 +00:00
2026-07-30 21:09:15 +00:00
2026-07-30 22:45:04 +00:00
2026-05-26 20:59:47 -07:00
2026-06-12 19:52:49 +00:00
2026-07-23 21:50:17 +00:00
2026-06-25 13:56:08 -07:00
2026-07-29 19:49:01 +00:00
2026-07-29 18:37:22 +00:00
2026-05-07 15:44:17 -07:00
2026-05-13 21:23:19 +00:00
2026-05-07 15:44:17 -07:00
2026-07-24 00:10:22 +00:00
2026-07-30 16:49:12 +00:00
2026-07-30 09:19:14 +00:00
2026-07-30 21:49:53 +00:00
2026-05-07 15:44:17 -07:00
2026-07-30 21:12:41 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-07-24 00:16:42 +00:00
2026-07-27 18:37:11 +00:00
2026-07-09 17:31:44 -07:00
2026-07-30 20:24:29 +00:00
2026-07-30 20:24:29 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-07-30 04:26:36 +00:00
2026-06-04 09:16:03 -07:00
2026-05-26 20:59:47 -07:00
jif
bf4d3f51ea