pomerium / pomerium / 21924576857

44%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: add ext_proc integration for response interception (#6091)

## Summary

Add Envoy ext_proc (External Processor) support for MCP routes to enable
future response interception (401/403 handling for upstream OAuth
flows).

Key changes:
- New `extproc` package with gRPC server implementation
- Route context metadata passing from ext_authz to ext_proc via Envoy
dynamic metadata
- Per-route ext_proc enablement (disabled by default, enabled for MCP
server routes)
- Fail-closed behavior for MCP routes requiring ext_proc

Currently a no-op that passes through all requests/responses while
logging MCP route details. Future implementation will intercept 401/403
responses to trigger upstream OAuth authorization flows.

## Related issues

- https://linear.app/pomerium/issue/ENG-3528

## User Explanation

No user-facing changes. This is infrastructure for future MCP proxy
authorization features.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Run Details

271 of 323 new or added lines in 10 files covered. (83.9%)

17 existing lines in 3 files now uncovered.

32289 of 72966 relevant lines covered (44.25%)

117.45 hits per line