kubeflow / mcp-server / 29680940851

Build # 29680940851

Build Type

push

github

Committed by web-flow

Commit Message

feat(ci): add MCP protocol conformance tests (#81)

* feat(ci): add MCP protocol conformance tests

Validate MCP protocol behavior (initialize, tools/list, tools/call, etc.)
against the running server over streamable HTTP on every PR, with no
Kubernetes cluster and no LLM.

- Add .github/workflows/conformance.yaml: starts kubeflow-mcp over HTTP
  with no kubeconfig, waits for initialize, and runs
  modelcontextprotocol/conformance@v0.1.16 (active suite, Node 22).
- Add tests/conformance/expected-failures.yaml baseline seeded from real
  runner output: fixture-driven scenarios, unadvertised capabilities, and
  the FastMCP DNS-rebinding hardening gap. CI fails on regressions and on
  baselined scenarios that unexpectedly start passing.
- Add `make conformance` to run the suite locally.
- Document conformance testing in CONTRIBUTING.md.

Signed-off-by: Kartikeya Trivedi <kartikeyatrivedi4oct2004@gmail.com>

* fix(security): enforce Host/Origin validation on HTTP transport

FastMCP's streamable-HTTP transport ships DNS rebinding protection off by
default, so a locally-bound, unauthenticated server accepted requests with an
arbitrary Host/Origin (HTTP 200) and was reachable from a malicious web page via
DNS rebinding. The MCP conformance `dns-rebinding-protection` scenario failed
and had been baselined as a known gap.

Add a pure-ASGI middleware that validates Host/Origin before requests reach the
MCP handler, delegating the header checks to the MCP SDK's reference
TransportSecurityMiddleware so behaviour matches the spec (421 for a bad Host,
403 for a bad Origin, 400 for a non-JSON POST). It is wired into the http/sse
transports only; stdio is unaffected. Protection is on by default and allows
loopback hosts; the allowlists and the on/off switch are configurable via
KUBEFLOW_MCP_ALLOWED_HOSTS / KUBEFLOW_MCP_ALLOWED_ORIGINS /
KUBEFLOW_MCP_DNS_REBINDING_PROTECTION.

Verified end-to-end: the live server now returns 421/403 for bad Host/Origin and
the conform... (continued)

Coverage Stats

1167 of 2522 relevant lines covered (46.27%)

1.39 hits per line

Source File

Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available