• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

pomerium / pomerium / 24733043775
45%

Build:
DEFAULT BRANCH: main
Ran 21 Apr 2026 04:22PM UTC
Jobs 1
Files 696
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

21 Apr 2026 04:07PM UTC coverage: 45.606% (+0.1%) from 45.499%
24733043775

push

github

web-flow
fix(mcp): recover MCP upstream auth after late config delivery (#6281)

## Summary

MCP routes delivered to a running Pomerium through the databroker config
sync path — the path Pomerium Zero uses — silently lost upstream auth.
The upstream saw empty Authorization headers and rejected every request.
Boot-time routes were unaffected. Restart cleared the symptom until the
next late-delivered route.

This change makes the ext_proc filter learn about routes and
allowed-domain updates that arrive after startup, and installs the MCP
handler on the fly when the MCP runtime flag itself is enabled via a
late configuration update.

## Related issues

- ENG-3926 —
https://linear.app/pomerium/issue/ENG-3926/pomerium-loses-mcp-upstream-auth-for-routes-delivered-after-startup

## User Explanation

MCP routes added to a running Pomerium Zero deployment now work without
a restart. Previously any MCP route added through the console after the
deployment was already running would appear reachable but fail upstream
authentication.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (\`enhancement\`, \`bug\`, \`breaking\`,
\`dependencies\`, \`ci\`)
- [ ] ready for review

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

110 of 132 new or added lines in 5 files covered. (83.33%)

15 existing lines in 5 files now uncovered.

35461 of 77755 relevant lines covered (45.61%)

113.95 hits per line

Uncovered Changes

Lines Coverage ∆ File
19
68.88
4.41% internal/mcp/upstream_auth.go
3
87.23
-0.27% internal/mcp/host_info.go

Coverage Regressions

Lines Coverage ∆ File
9
80.34
0.0% pkg/ssh/manager.go
2
94.55
0.0% pkg/fanout/receive.go
2
91.3
-8.7% pkg/grpcutil/serve.go
1
78.36
2.37% pkg/storage/postgres/backend.go
1
75.41
0.0% pkg/storage/postgres/registry.go
Jobs
ID Job ID Ran Files Coverage
1 24733043775.1 21 Apr 2026 04:22PM UTC 696
45.61
GitHub Action Run
Source Files on build 24733043775
  • Tree
  • List 696
  • Changed 15
  • Source Changed 5
  • Coverage Changed 15
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #24733043775
  • 2afa90c3 on github
  • Prev Build on main (#24669036644)
  • Next Build on main (#24736983345)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc