FreeOnePlus opened a new pull request, #162: URL: https://github.com/apache/doris-mcp-server/pull/162
## Summary - add an explicit Python entry-point boundary for trusted custom MCP tool providers - load only installed providers named in `MCP_TOOL_PROVIDERS` - integrate custom schemas and handlers with the existing registry, validation, audit, lifecycle, and dispatch paths - add bounded process-local per-tool or per-principal rate limits for business API QPS control - keep custom tools fail-closed for external OAuth and Doris-backed OAuth until a reviewed dynamic policy exists - document FastGPT usage, multi-worker limits, and the production security checklist ## Security boundary This does not add a declarative arbitrary-URL proxy. Target hosts, paths, headers, and credentials remain in reviewed provider code. Missing, mismatched, invalid, or duplicate providers fail startup. ## Verification - `uv run pytest -q -W error` — 1122 passed, 69 skipped, 58.94% coverage - coverage domains — protocol 89.94%, authentication 81.29%, core managers 82.60% - `uv run ruff check .` - `uv run mypy doris_mcp_server` - `uv run bandit -q -c pyproject.toml -r doris_mcp_server doris_mcp_client generate_requirements.py` - `uv build` and clean-wheel runtime dependency smoke - real temporary external package install, entry-point discovery, and custom tool invocation - real Streamable HTTP `tools/list`, input-schema rejection, and `tools/call` Closes #65 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
