Repository navigation
fix(quarantine): server admission stays human under the default trust tier - #1802
Merged
Merged
Conversation
… tier Spec 119 made scan the default trust mode, so the spec 086 clean-scan admission gate began releasing every server added without a trust_mode (TestE2E_QuarantineConfigApply has failed on main since #1740). Server release is meant to stay with a person. - ServerConfig.AdmitsOnCleanScan: only an explicit trust_mode "scan" lets a clean admission scan unquarantine a server. The default tier still auto-approves clean tool changes. - maybeAutoApproveScanSettled, maybeStartAdmissionScan and scanModeAdmissionOwns use it; default-tier servers get the informational (non-gating) baseline scan instead. - The approval commit re-checks AdmitsOnCleanScan for scan-auto approvals under the commit lock, so a trust_mode changed mid-scan cannot release the server. - Web UI: the add form sends trust_mode only when one is picked, and the selector checks no radio for an unset mode so Scan can be chosen explicitly. - Docs, CLI help and CHANGELOG describe the admission rule.
Deploying mcpproxy-docs with
|
| Latest commit: |
91d1d36
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://3cba59bb.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://fix-default-tier-server-admi.mcpproxy-docs.pages.dev |
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
…er-admission-manual
…xKeepCreatingHomeConfig
Windows CI failed TempDir's RemoveAll on the former cwd ("being used by
another process") twice on #1802.
Contributor
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 41064835875 --repo smart-mcp-proxy/mcpproxy-go
|
Dumbris
enabled auto-merge (squash)
October 30, 2026 14:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since #1740 (Spec 119) made
scanthe default trust mode, the Spec 086 clean-scan admission gate has been releasing every server added without atrust_mode, including one added withquarantined: true.TestE2E_QuarantineConfigApplyhas failed on main since then (bisected to #1740).Maintainer decision: server admission stays human. Only an explicit
trust_mode: "scan"auto-admits; the default tier only auto-approves clean tool changes.ServerConfig.AdmitsOnCleanScan()is true only for an explicittrust_mode: "scan".maybeAutoApproveScanSettled,maybeStartAdmissionScanandscanModeAdmissionOwnsuse it. Default-tier servers get the informational (non-gating) baseline scan instead of the admission one.AdmitsOnCleanScan(and that the server is still quarantined) forscan-autoapprovals inside the same commit, so atrust_modechanged while the scan was running cannot release the server.trust_modeonly when one is picked. The selector checks no radio for an unset mode (Scan keeps the "current default" badge), so Scan can be chosen explicitly. Previously the form always sentscan.intro.md,configuration.md,security-quarantine.md), CLI--trust-modehelp and the CHANGELOG Spec 119 entry describe the rule.Tests
scan_admission_test.go);scanModeAdmissionOwnshands it to the informational path;TestCommitServerApproval_ScanAutoRequiresExplicitScan(manual and unset refused, explicit scan released). Each fails without the fix.trust_mode; selector emitsscanfrom the unset state.internal/server(server tag, CI skip regex),internal/runtime,internal/config,cmd/...,internal/qapilot/...,httpapi;TestE2E_QuarantineConfigApplypasses again;./scripts/test-api-e2e.shall passed; vitest 2791 passed (the 2activity-views.spec.tsfailures also fail on main locally);vue-tsc; both golangci-lint configs report 0 new issues.