1
66%
main: 66%

Ran 03 Jun 2026 09:03PM UTC

Files 747

Run time 42s

Badge

Embed ▾

Committed 03 Jun 2026 08:57PM UTC coverage: 65.848% (+0.006%) from 65.842%

Job # 26912592654.1

Build Type

push

github

Committed by

web-flow

Commit Message

Thread VirtualMCPServer name into Cedar authz middleware (#5448)

Cedar authorization policies compiled by the operator reference the
actual VirtualMCPServer name as the resource entity (e.g. MCP::"my-vmcp").
The factory hard-coded the string "vmcp" when calling
authz.CreateMiddlewareFromConfig, so the resource entity never matched
and Cedar's default-deny fired on every request — 403 for all principals
regardless of policy.

Fix by adding a serverName parameter to NewIncomingAuthMiddleware and
newCedarAuthzMiddleware, and passing vmcpCfg.Name at the serve.go call
site. Adds a regression test that scopes a Cedar permit policy to a
specific resource name and asserts it is honoured.

Fixes #5428

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Coverage Stats

66398 of 100835 relevant lines covered (65.85%)

63.51 hits per line

stacklok / toolhive / 26912592654 / 1
66%
main: 66%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 26912592654.1

stacklok / toolhive / 26912592654 / 1 66% main: 66%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 26912592654.1

stacklok / toolhive / 26912592654 / 1
66%
main: 66%

README BADGES
x