This is an automated email from the ASF dual-hosted git repository.
terrymanu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shardingsphere.git
The following commit(s) were added to refs/heads/master by this push:
new aef7d13c0a3 Refine MCP HTTP auth boundary wording (#39029)
aef7d13c0a3 is described below
commit aef7d13c0a39570e31b6b38a70239df86ec4636d
Author: Liang Zhang <[email protected]>
AuthorDate: Tue Jul 7 14:33:38 2026 +0800
Refine MCP HTTP auth boundary wording (#39029)
- remove release-bound phrasing from MCP client safety guidance
- keep baseline contract and LLM evaluation text aligned with the stable
no-built-in-auth boundary
---
.../shardingsphere/mcp/support/security/MCPClientSafetyPolicy.java | 2 +-
.../src/test/resources/baseline-contract/model-contract/guidance.yaml | 2 +-
.../mcp/src/test/resources/llm/evaluation/mcp-builder-evaluation.xml | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git
a/mcp/support/src/main/java/org/apache/shardingsphere/mcp/support/security/MCPClientSafetyPolicy.java
b/mcp/support/src/main/java/org/apache/shardingsphere/mcp/support/security/MCPClientSafetyPolicy.java
index 7af98c3a84a..bdba949688a 100644
---
a/mcp/support/src/main/java/org/apache/shardingsphere/mcp/support/security/MCPClientSafetyPolicy.java
+++
b/mcp/support/src/main/java/org/apache/shardingsphere/mcp/support/security/MCPClientSafetyPolicy.java
@@ -52,7 +52,7 @@ public final class MCPClientSafetyPolicy {
result.put("identity_scope", "mcp_session");
result.put("transport_scope",
"HTTP transport can bind trusted session attribution when
configured; "
- + "authentication and authorization remain outside the
runtime in this release. "
+ + "the MCP runtime does not provide built-in
authentication or authorization. "
+ "STDIO inherits the local process boundary.");
result.put("tool_call_limit",
MCPRuntimeProtectionPolicy.createToolCallLimitPayload());
result.put("runtime_protection",
MCPRuntimeProtectionPolicy.createRuntimeProtectionPayload());
diff --git
a/test/e2e/mcp/src/test/resources/baseline-contract/model-contract/guidance.yaml
b/test/e2e/mcp/src/test/resources/baseline-contract/model-contract/guidance.yaml
index 64f4eeec3ab..0e6127b7a99 100644
---
a/test/e2e/mcp/src/test/resources/baseline-contract/model-contract/guidance.yaml
+++
b/test/e2e/mcp/src/test/resources/baseline-contract/model-contract/guidance.yaml
@@ -207,7 +207,7 @@ security_hints:
client_safety_policy:
identity_scope: mcp_session
transport_scope: HTTP transport can bind trusted session attribution when
configured;
- authentication and authorization remain outside the runtime in this
release.
+ the MCP runtime does not provide built-in authentication or
authorization.
STDIO inherits the local process boundary.
tool_call_limit: {scope: session, max_calls: 10000, property:
shardingsphere.mcp.maxToolCallsPerSession,
recovery: Close and recreate the MCP session after the quota is
exhausted.}
diff --git
a/test/e2e/mcp/src/test/resources/llm/evaluation/mcp-builder-evaluation.xml
b/test/e2e/mcp/src/test/resources/llm/evaluation/mcp-builder-evaluation.xml
index 9cc0358c3cf..ae21d68efd1 100644
--- a/test/e2e/mcp/src/test/resources/llm/evaluation/mcp-builder-evaluation.xml
+++ b/test/e2e/mcp/src/test/resources/llm/evaluation/mcp-builder-evaluation.xml
@@ -193,13 +193,13 @@
</question>
<answer>no_builtin_auth|origin_403|gateway_auth_boundary</answer>
<expected_answer>
- The built-in ShardingSphere MCP HTTP runtime does not provide
authorization in this release; transport.type only selects the active
+ The built-in ShardingSphere MCP HTTP runtime does not provide
authentication or authorization; transport.type only selects the active
transport, and bindHost controls the listener address. Missing Origin is
accepted for non-browser clients, but any present Origin on a
non-loopback binding is rejected with 403. Authentication and
authorization must be enforced by the trusted network, reverse proxy, or
gateway, and the answer should not invent OAuth or token YAML fields.
</expected_answer>
<verification>
- <step>Confirm the answer says built-in Streamable HTTP authorization is
absent in this release.</step>
+ <step>Confirm the answer says built-in Streamable HTTP authentication
and authorization are absent.</step>
<step>Confirm the answer states present Origin headers are rejected for
non-loopback bindings.</step>
<step>Confirm the answer places authentication at a trusted gateway or
network boundary.</step>
</verification>
