mirror of
https://github.com/open-webui/open-terminal.git
synced 2026-11-04 08:10:53 +00:00
Classic298
83bafddf87
The MCP server now gates its HTTP transports with a token verifier that requires the connecting client to present the API key, compared with hmac.compare_digest to match the FastAPI layer. The stdio transport is local and does not pass through the HTTP auth layer, so it keeps working unchanged. Raises the fastmcp floor to >=4.0.0, where the auth API used here is available.
31 lines
870 B
Python
31 lines
870 B
Python
"""MCP server — exposes every FastAPI endpoint as an MCP tool."""
|
|
|
|
import hmac
|
|
|
|
from fastmcp import FastMCP
|
|
from fastmcp.server.auth import AccessToken, TokenVerifier
|
|
from open_terminal.main import app
|
|
from open_terminal.env import API_KEY
|
|
|
|
|
|
class ApiKeyVerifier(TokenVerifier):
|
|
"""Accept a client bearer token only when it matches the API key."""
|
|
|
|
async def verify_token(self, token: str) -> AccessToken | None:
|
|
if not hmac.compare_digest(token, API_KEY):
|
|
return None
|
|
return AccessToken(token=token, client_id="open-terminal", scopes=[])
|
|
|
|
|
|
# HTTP transports gate on the API key; stdio is local and never hits this layer.
|
|
mcp = FastMCP.from_fastapi(
|
|
app=app,
|
|
name="Open Terminal",
|
|
httpx_client_kwargs={
|
|
"headers": {
|
|
"Authorization": f"Bearer {API_KEY}",
|
|
}
|
|
},
|
|
auth=ApiKeyVerifier(),
|
|
)
|