• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 24513049502
66%

Build:
DEFAULT BRANCH: main
Ran 16 Apr 2026 01:36PM UTC
Jobs 1
Files 633
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

16 Apr 2026 01:30PM UTC coverage: 66.124% (+0.03%) from 66.098%
24513049502

push

github

web-flow
Store serverName on Cedar Authorizer (#4861)

The AuthorizerFactory interface already passes serverName to
CreateAuthorizer, but the Cedar implementation discarded it. Store it
on the Authorizer struct so downstream enterprise features (#4769,
behavior is identical to today.

The serverName becomes the MCP parent on resource entities (added by
policies like "resource in MCP::<server>". Per the authorization RFC,
this prevents a deny rule compiled from one server's policy from
silently affecting same-named tools on other servers when the
enterprise controller merges policies into a single set.

E2E tested in a Kind cluster with real Okta tokens. The key test
deploys two MCPServers that share a single Cedar ConfigMap -- the
same setup the enterprise controller will produce when it compiles
policies from multiple CRDs into one set.

  Shared Cedar policy set:
    permit(principal in THVGroup::"engineering",
           action, resource in MCP::"<server-a>");
    permit(principal in THVGroup::"engineering",
           action, resource in MCP::"<server-b>");
    forbid(principal, action == Action::"call_tool",
           resource == Tool::"echo")
      when { resource in MCP::"<server-b>" };

  Okta JWT: { "groups": ["Everyone", "engineering"],
              "sub": "jakub@stacklok.com" }

The same user calling the same tool ("echo") gets allowed on server-a
and 403'd on server-b. The only difference is the serverName stored
on each authorizer, which determines the MCP parent on the resource
entity. Cedar's diagnostic log confirms the forbid fires only where
scoped and does not bleed across servers.

Closes #4764

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

4 of 4 new or added lines in 1 file covered. (100.0%)

11 existing lines in 3 files now uncovered.

57432 of 86855 relevant lines covered (66.12%)

62.14 hits per line

Coverage Regressions

Lines Coverage ∆ File
6
76.15
-5.5% pkg/secrets/keyring/keyctl_linux.go
3
79.38
-0.77% pkg/transport/proxy/httpsse/http_proxy.go
2
73.63
-0.64% pkg/runner/config.go
Jobs
ID Job ID Ran Files Coverage
1 24513049502.1 16 Apr 2026 01:36PM UTC 633
66.12
GitHub Action Run
Source Files on build 24513049502
  • Tree
  • List 633
  • Changed 7
  • Source Changed 1
  • Coverage Changed 7
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #24513049502
  • 22e4fd9f on github
  • Prev Build on main (#24512472441)
  • Next Build on main (#24517723691)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc