• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 23919797653
65%

Build:
DEFAULT BRANCH: main
Ran 02 Apr 2026 08:17PM UTC
Jobs 1
Files 601
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

02 Apr 2026 08:10PM UTC coverage: 65.396% (+0.06%) from 65.336%
23919797653

push

github

web-flow
Resolve JWKS keys in-process for embedded auth server (MCP server) (#4502)

When the embedded auth server is enabled, token validation currently fails silently because the token validator fetches JWKS keys over HTTP from the proxy's own endpoint. This self-referential HTTP call requires operators to set `insecureAllowHTTP` and/or `jwksAllowPrivateIP` flags — insecure workarounds that are difficult to debug when missing.

This PR eliminates the self-referential HTTP fetch by wiring the embedded auth server's `KeyProvider` directly into the token validator. When both components run in the same process, JWKS keys are resolved in-memory with a graceful fallback to HTTP for cases where the local provider cannot satisfy the request.

Note: this only addresses the issue for the runner and proxy runner - vMCP wiring will come in a separate change.

86 of 99 new or added lines in 6 files covered. (86.87%)

13 existing lines in 5 files now uncovered.

54415 of 83208 relevant lines covered (65.4%)

63.57 hits per line

Uncovered Changes

Lines Coverage ∆ File
8
83.75
0.55% pkg/auth/token.go
3
38.94
0.11% pkg/runner/runner.go
2
80.0
-3.78% pkg/auth/middleware.go

Coverage Regressions

Lines Coverage ∆ File
6
76.15
-5.5% pkg/secrets/keyring/keyctl_linux.go
2
80.15
0.26% pkg/transport/proxy/httpsse/http_proxy.go
2
57.89
-3.51% pkg/transport/session/sse_session.go
2
51.71
-0.19% pkg/workloads/manager.go
1
83.75
0.55% pkg/auth/token.go
Jobs
ID Job ID Ran Files Coverage
1 23919797653.1 02 Apr 2026 08:17PM UTC 601
65.4
GitHub Action Run
Source Files on build 23919797653
  • Tree
  • List 601
  • Changed 17
  • Source Changed 8
  • Coverage Changed 17
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #23919797653
  • 6adbe2b2 on github
  • Prev Build on main (#23915185526)
  • Next Build on main (#23948280474)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc