Repository navigation
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new publication-test fixture uses an incompatible allowlist format and fails TypeScript checking.
1 open finding
What changed in this PR
Adds configurable approval bypasses for trusted MCP App tools and supports sandbox framing by explicitly trusted cross-origin ancestors.
Changes:
- Publishes and validates exact server/tool allowlists while preserving default approval behavior.
- Applies allowlists to App tool calls, not App-authored messages.
- Removes inherited frameguard only when sandbox headers permit cross-origin framing.
| File | Description |
|---|---|
| packages/data-provider/src/config.ts | Defines and publishes approval policy. |
| packages/data-provider/src/config.spec.ts | Tests policy validation and publication. |
| packages/api/src/mcp/apps/controller.ts | Removes conflicting inherited frameguard. |
| packages/api/src/mcp/apps/controller.spec.ts | Tests sandbox framing headers. |
| docs/mcp-apps.md | Documents allowlist configuration and boundaries. |
| client/src/Providers/MCPAppsPolicyContext.tsx | Validates published approval policy. |
| client/src/Providers/__tests__/MCPAppsPolicyContext.spec.tsx | Tests valid and malformed policies. |
| client/src/hooks/MCP/approval.tsx | Auto-approves exact allowlisted tool calls. |
| client/src/hooks/MCP/__tests__/approval.spec.tsx | Tests matching and retained approval safeguards. |
| client/src/components/MCPUIResource/MCPAppViews.tsx | Supplies policy to approval handling. |
| api/server/routes/config.js | Exposes approval policy in startup configuration. |
| api/server/routes/__tests__/config.spec.js | Tests startup policy publication. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
codegraph-librechat
Bot
added
the
🗺️ MCP & OAuth
cidrblock
force-pushed
the
feat/mcp-app-tool-approval
branch
from
October 15, 2026 20:39
6de7fb2 to
7df468d
Compare
cidrblock
force-pushed
the
feat/mcp-app-tool-approval
branch
from
October 15, 2026 20:53
7df468d to
08b3f2d
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
{server, tool}allowlist for MCP App-originated tool calls. Omitted or empty configuration keeps the existing approval prompt; App-authored messages remain approval-gated, and Agent tool approval behavior is unchanged.X-Frame-Optionsonly when the generated CSP permits those ancestors; retain the frameguard otherwise.Verification
packages/api/src/mcp/apps/controller.spec.ts: 28 tests passed.packages/data-provider/src/config.spec.ts: passed.This PR is limited to MCP Apps host approval and sandbox framing; provider/model access policy is in a separate PR.