Repository navigation
Conversation
… and authorization
…s exist when not listed
… env vars, pin v2
Reject null, false and scalar identities from Mcp.auth.identity, expand oauth test scopes with the declared resource's implies, add McpConfig::rbacPermissions(), make mcp check read the cakedc/users authenticators and guard the oauth plugin class.
…re authentication
steinkel
left a comment
steinkel
left a comment
There was a problem hiding this comment.
Review of the 2.x rewrite: no blocking issues in the security path I read (auth fails closed, check ordering is sound). Two non-blocking comments inline.
| $maxBodyBytes, | ||
| ); | ||
| $response = $factory->create()->run($transport); | ||
| } catch (Throwable $exception) { |
There was a problem hiding this comment.
🟡 [3] Configuration errors are reported as a generic 500.
This catch (Throwable) also swallows the exceptions AuthSettings throws on invalid Mcp.auth settings (the fail-closed path). Clients only see Internal error, and the cause is visible only if the McpLogger::SCOPE log scope is configured.
Suggestion: catch InvalidArgumentException / LogicException from the auth settings separately, log them at critical, and point to bin/cake mcp check in the message, so a misconfigured production endpoint is easy to diagnose.
| * | ||
| * @implements \Mcp\Server\Handler\Request\RequestHandlerInterface<mixed> | ||
| */ | ||
| final class ToolCallGuard implements RequestHandlerInterface |
There was a problem hiding this comment.
🟡 [5] Resources and prompts have no per-item authorization.
ToolCallGuard and ToolListFilter only cover tools/call and tools/list. docs/authorization.md states this, but it is security-relevant: anyone exposing resources next to RBAC-gated tools may assume they are protected too, and any identified caller can read every resource and prompt.
Suggestion: mention it in the README, and have bin/cake mcp check warn when an authorizer other than allow-all is configured and resources or prompts are discovered. Longer term, consider an equivalent guard for resources/read and prompts/get.
2 participants
2.x of the plugin for CakePHP 5, built on the official
mcp/sdk(^0.9). This branch carries two milestones:2.0: rewrite on
mcp/sdkbin/cake mcp serverover stdio.src/Mcp(#[McpTool],#[McpResource], ...), plus theMcp.server.configurebuilder hook.cakephp/authenticationidentity, with an injectableCurrentIdentity.ToolAuthorizerInterface, withRbacToolAuthorizeroncakedc/auth.ToolError::invalid(),McpTestTraitfor in-memory tool tests, andbin/cake mcp inspector.tests/Conformance/run.sh, also in CI).2.1: OAuth 2.1 for remote clients (claude.ai and others)
Mcp.authmodes:host(default, as 2.0),oauth(tokens ofcakedc/cakephp-oauth-serverin the same app) andexternal(JWT from any OpenID Connect issuer).401challenge, a per-tool scope policy withimplies, and step-up via403 insufficient_scope.McpConfig::isEndpoint()for the CSRF skip,bin/cake mcp check, and scope support inMcpTestTrait.The changes are listed in
CHANGELOG.md(2.0.0-beta1 and 2.1.0-beta1), with the docs underdocs/.Status
mcp/sdkis now the released^0.9, no longer a pinned commit.Notes for review
2.next-cake5. If it is easier to review in parts, it can be split by commit range: up to the 2.0 rewrite, then OAuth.2.0.0-beta1/2.1.0-beta1is left for after the merge.