• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 27221404552
67%

Build:
DEFAULT BRANCH: main
Ran 09 Jun 2026 04:49PM UTC
Jobs 1
Files 750
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

09 Jun 2026 04:43PM UTC coverage: 66.259% (+0.04%) from 66.224%
27221404552

push

github

web-flow
Wire Cedar admission seam into vMCP core (#5459)

* Wire Cedar admission seam into vMCP core

Authorization runs only as HTTP middleware today (AuthzMiddleware +
AnnotationEnrichmentMiddleware), so a tool can pass tools/list yet be
refused on tools/call — the "list says yes / call says no" gap — because
the two checks live on different paths. Re-platform that single Cedar
decision into the core so List* (filter) and Call/Read/Get (deny)
enforce it from one source.

Implements issue #5438:
- Add the Admission seam (interface + Cedar-backed adapter) in
  pkg/vmcp/core/admission.go. The core moved to its own package in
  #5437; the adapter wraps pkg/authz, which would cycle with the root
  vmcp package, so the seam lives here rather than pkg/vmcp/admission.go.
- Build the authorizer from cfg.Authz via the same factory path the HTTP
  middleware uses (authorizers.GetFactory + CreateAuthorizer); no new
  policy language. A nil cfg.Authz yields an allow-all seam, matching the
  AuthzMiddleware != nil guard.
- Re-inject the explicit identity and core-sourced Tool.Annotations into
  the ctx the authorizer reads, replacing AnnotationEnrichmentMiddleware
  on the domain path.
- Keep optimizer meta-tools (find_tool/call_tool) exempt via
  cfg.PassThroughTools, mirroring the HTTP response filter.
- Add cfg.ServerName/cfg.PassThroughTools to feed the seam.

server.New is untouched: the live path still enforces via middleware in
Phase 1, so double-enforcement only ever occurs in tests that exercise
the core directly. #5441 removes the HTTP middleware.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Address code review feedback

Fixed issues from code review:
- HIGH: newAdmission now rejects an empty ServerName when Authz is set,
  mirroring the live factory's fail-loud check (incoming.go:120) so a
  misconfigured composition root fails at New instead of silently
  changing Cedar resource-scoped policy semantics.
- HIGH: corrected the AllowT... (continued)

172 of 189 new or added lines in 4 files covered. (91.01%)

9 existing lines in 4 files now uncovered.

67162 of 101363 relevant lines covered (66.26%)

63.87 hits per line

Uncovered Changes

Lines Coverage ∆ File
12
91.04
pkg/vmcp/core/admission.go
2
88.17
0.33% pkg/vmcp/core/core_calls.go
2
96.49
-3.51% pkg/vmcp/server/annotation_enrichment.go
1
86.38
-0.26% pkg/vmcp/core/core_vmcp.go

Coverage Regressions

Lines Coverage ∆ File
3
71.85
-1.11% pkg/ignore/processor.go
3
78.17
-0.76% pkg/transport/proxy/httpsse/http_proxy.go
2
73.63
-0.64% pkg/runner/config.go
1
86.38
-0.26% pkg/vmcp/core/core_vmcp.go
Jobs
ID Job ID Ran Files Coverage
1 27221404552.1 09 Jun 2026 04:49PM UTC 750
66.26
GitHub Action Run
Source Files on build 27221404552
  • Tree
  • List 750
  • Changed 8
  • Source Changed 3
  • Coverage Changed 8
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #27221404552
  • 4e3f647e on github
  • Prev Build on main (#27209592861)
  • Next Build on main (#27228850861)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc