mirror of
https://github.com/open-webui/open-terminal.git
synced 2026-11-05 01:27:28 +00:00
[PR #181] [MERGED] auth: verify MCP HTTP clients against the API key #154
Labels
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
open-webui/open-terminal#154
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-terminal/pull/181
Author: @Classic298
Created: 9/23/2026
Status: ✅ Merged
Merged: 9/23/2026
Merged by: @tjbck
Base:
main← Head:fix/mcp-http-auth📝 Commits (1)
b5abc9cauth: verify MCP HTTP clients against the API key📊 Changes
2 files changed (+17 additions, -2 deletions)
View changed files
📝
open_terminal/mcp_server.py(+16 -1)📝
pyproject.toml(+1 -1)📄 Description
The MCP server now gates its HTTP transports with a token verifier that requires the connecting client to present the API key, compared with
hmac.compare_digestto match the FastAPI layer. The stdio transport is local and does not pass through the HTTP auth layer, so it keeps working unchanged.Raises the
mcpextra's fastmcp floor to>=4.0.0, where theauth=verifier API used here is available (2.x exposed a different auth surface).Verified against fastmcp 4.0.5 on the
streamable-httptransport: a client with no token and a client with a wrong token are both rejected, a client presenting the API key gets the full tool set, andstdiocontinues to list tools with no client token.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.