pomerium / pomerium / 28625449084
52%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 706
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 52.232% (+0.02%) from 52.216%
28625449084

push

github

web-flow 
feat(mcp): add mcp_dynamic_client_registration runtime flag (#6483)

## Summary

In the MCP specification, OAUTH2.0 Dynamic Client Registration (DCR) has
moved from the default to a SHOULD support on authorization servers. It
feels likely this will be deprecated and removed in future specs. Most
MCP servers have moved to CIMD.

Adds the `mcp_dynamic_client_registration` runtime_flag to gate whether
or not Pomerium when acting as an MCP reverse proxy can use DCR to
authorize MCP servers.

Note: MCP servers already authorized with DCR will continue to work.

## Related issues


[ENG-4184](https://linear.app/pomerium/issue/ENG-4184/gate-inbound-mcp-dynamic-client-registration-dcr-behind-a-runtime-flag)

## User Explanation

```yaml
runtime_flags:
  mcp_dynamic_client_registration: true
```

is required to enable Oauth 2.0 Dynamic Client Registration flows for
MCP server authorization.

## AI disclosure

opus 4.8 was used to refactor the e2e tests to support parametrized runs
depending on which authorization methods are used.

## Checklist

- [X] reference any related issues
- [X] updated unit tests
- [X] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [X] disclosed AI usage (or wrote "none") per AI_POLICY.md
- [X] ready for review

9 of 45 new or added lines in 5 files covered. (20.0%)

20 existing lines in 10 files now uncovered.

36973 of 70786 relevant lines covered (52.23%)

462.07 hits per line

Uncovered Changes

Lines Coverage ∆ File
20
0.0
 0.0% internal/mcp/handler_register_client.go
13
20.22
 -0.71% internal/mcp/handler_metadata.go
3
0.0
 0.0% internal/mcp/handler.go

Coverage Regressions

Lines Coverage ∆ File
4
48.3
 0.18% internal/databroker/server_clustered_follower.go
3
90.59
 0.0% config/config_source.go
2
69.52
 -0.3% internal/databroker/server_backend.go
2
20.22
 -0.71% internal/mcp/handler_metadata.go
2
85.67
 -0.62% pkg/databrokerutil/syncer.go
2
94.55
 0.0% pkg/fanout/receive.go
2
88.52
 0.0% pkg/storage/postgres/postgres.go
1
75.15
 0.89% internal/databroker/config_source.go
1
78.36
 2.37% pkg/storage/postgres/backend.go
1
75.41
 0.0% pkg/storage/postgres/registry.go
Jobs
ID Job ID Ran Files Coverage
1 28625449084.1 706
52.23
 GitHub Action Run
Source Files on build 28625449084