stacklok / toolhive / 19732668248

51%

push

github

Implement discovered mode for vMCP authentication (#2747)

Add runtime authentication discovery for VirtualMCPServer, enabling vMCP
  to automatically discover and apply authentication configurations from
  backend MCPServer ExternalAuthConfigRefs.

  Changes:
  - Add DiscoverAndResolveAuth() function in converters package to fetch
    and convert MCPExternalAuthConfig to auth strategy metadata with
    dynamic secret resolution from Kubernetes
  - Implement discoverAuthConfig() in k8s workload discoverer to populate
    backend AuthStrategy and AuthMetadata fields from ExternalAuthConfigRef
  - Add applyAuthConfigToBackend() method in aggregator discoverer to
    decide which auth to use based on source mode (discovered/mixed/inline)
  - Add comprehensive unit tests for auth discovery scenarios (token
    exchange, header injection, no auth, error cases)
  - Add e2e test validating discovered auth with real MCP requests,
    tool aggregation, and tool calls through VirtualMCPServer

  The discovered mode allows backends with heterogeneous authentication
  (OAuth 2.0 token exchange, API key header injection, or no auth) to
  coexist in the same group, with vMCP automatically discovering and
  applying the appropriate auth to each backend request.

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: taskbot <taskbot@users.noreply.github.com>

62 of 93 new or added lines in 3 files covered. (66.67%)

25421 of 51116 relevant lines covered (49.73%)

60.31 hits per line