pomerium / pomerium / 28625470858
52%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 706
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 52.215% (-0.001%) from 52.216%
28625470858

push

github

web-flow 
feat(mcp): add mcp_dynamic_client_registration runtime flag (#6483)

## Summary

In the MCP specification, OAUTH2.0 Dynamic Client Registration (DCR) has
moved from the default to a SHOULD support on authorization servers. It
feels likely this will be deprecated and removed in future specs. Most
MCP servers have moved to CIMD.

Adds the `mcp_dynamic_client_registration` runtime_flag to gate whether
or not Pomerium when acting as an MCP reverse proxy can use DCR to
authorize MCP servers.

Note: MCP servers already authorized with DCR will continue to work.

## Related issues


[ENG-4184](https://linear.app/pomerium/issue/ENG-4184/gate-inbound-mcp-dynamic-client-registration-dcr-behind-a-runtime-flag)

## User Explanation

```yaml
runtime_flags:
  mcp_dynamic_client_registration: true
```

is required to enable Oauth 2.0 Dynamic Client Registration flows for
MCP server authorization.

## AI disclosure

opus 4.8 was used to refactor the e2e tests to support parametrized runs
depending on which authorization methods are used.

## Checklist

- [X] reference any related issues
- [X] updated unit tests
- [X] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [X] disclosed AI usage (or wrote "none") per AI_POLICY.md
- [X] ready for review

9 of 45 new or added lines in 5 files covered. (20.0%)

31 existing lines in 10 files now uncovered.

36961 of 70786 relevant lines covered (52.22%)

462.1 hits per line

Uncovered Changes

Lines Coverage ∆ File
20
0.0
 0.0% internal/mcp/handler_register_client.go
13
20.22
 -0.71% internal/mcp/handler_metadata.go
3
0.0
 0.0% internal/mcp/handler.go

Coverage Regressions

Lines Coverage ∆ File
10
80.13
 -0.21% pkg/ssh/manager.go
6
87.62
 -2.97% config/config_source.go
2
69.52
 -0.3% internal/databroker/server_backend.go
2
47.76
 -0.36% internal/databroker/server_clustered_follower.go
2
20.22
 -0.71% internal/mcp/handler_metadata.go
2
85.67
 -0.62% pkg/databrokerutil/syncer.go
2
89.19
 -5.41% pkg/fanout/fanout.go
2
90.91
 -3.64% pkg/fanout/receive.go
2
89.21
 0.0% pkg/health/systemd.go
1
75.15
 0.89% internal/databroker/config_source.go
Jobs
ID Job ID Ran Files Coverage
1 28625470858.1 706
52.22
 GitHub Action Run
Source Files on build 28625470858