otto 2.9.0 → 2.10.0

data/lib/otto/security/middleware/ip_privacy_middleware.rb

@@ -36,6 +36,14 @@ class Otto
       #   # env['otto.original_ip'] also contains real IP
       #
       class IPPrivacyMiddleware
+        # Forwarding metadata Rack::Request reads without consulting Otto's
+        # proxy trust verdict: host (#host/#authority), scheme (#scheme/#ssl?),
+        # and port (#port), from both the X-Forwarded-* family and RFC 7239
+        # Forwarded (host=, proto=, and the port inside for=). Defined in
+        # Otto::Utils so Otto::Utils::RELAY_MARKER_HEADERS is built from the
+        # same list and cannot fall out of step with what is scrubbed here.
+        UNTRUSTED_FORWARDING_METADATA_HEADERS = Otto::Utils::FORWARDED_AUTHORITY_HEADERS
+
         # Initialize IP Privacy middleware
         #
         # @param app [#call] Rack application
@@ -55,8 +63,13 @@ class Otto
           # canonical client IP for this request, do not re-resolve or re-mask.
           # This makes stacking two instances (e.g. an app-level mount plus
           # Otto's built-in router mount) order-safe instead of double-masking.
+          #
+          # Client-IP resolution is idempotent, but proxy TRUST is not: the
+          # prior pass may have run under a different (or no) configuration,
+          # so this instance still enforces its own trust posture below.
           if env.key?('otto.client_ip')
             ensure_ip_match_present(env)
+            enforce_proxy_trust_after_prior_pass(env)
             return @app.call(env)
           end
 
@@ -65,7 +78,9 @@ class Otto
           # REMOTE_ADDR is rewritten to the masked client IP. Leak-free boolean.
           #
           # TRI-STATE: the key is written ONLY when the operator configured
-          # proxy trust (CIDR matchers or a depth). Present, its value is
+          # proxy trust (CIDR matchers, a depth, or the explicit trust-nobody
+          # assertion `trusted_proxies: :none`, which makes the value false for
+          # every peer, #259). Present, its value is
           # authoritative in both directions — true means the peer matched a
           # CIDR (filter mode) or depth mode is active (configuring a depth
           # asserts the connecting peer IS the operator's proxy tier, #226);
@@ -77,9 +92,24 @@ class Otto
           # forced consumers into grant-only reads (#228).
           # respond_to?: like geo_headers_trusted?, a partial/duck-typed
           # config (or nil) that cannot report trust state is "unconfigured".
-          if @security_config.respond_to?(:proxy_trust_configured?) && @security_config.proxy_trust_configured?
-            env['otto.via_trusted_proxy'] = trusted_proxy?(env['REMOTE_ADDR'])
-          end
+          proxy_trust_configured = @security_config.respond_to?(:proxy_trust_configured?) &&
+                                   @security_config.proxy_trust_configured?
+          via_trusted_proxy = proxy_trust_configured && trusted_proxy?(env['REMOTE_ADDR'])
+          env['otto.via_trusted_proxy'] = via_trusted_proxy if proxy_trust_configured
+
+          # Record whether the request was relayed BEFORE the scrub below can
+          # delete the relay markers. Downstream middleware that must
+          # authenticate a direct local call (Otto::CaddyTLS::LocalhostGuard)
+          # runs after this one and would otherwise read a request whose
+          # HTTP_FORWARDED was deleted here as "direct". Leak-free boolean.
+          env['otto.peer_relayed'] = Otto::Utils.relayed_request?(env)
+
+          # A peer that failed configured proxy trust cannot supply forwarded
+          # host, scheme, or port either. Unconfigured trust (absent tri-state
+          # key) is left alone: the operator has asserted nothing, and the
+          # contract reserves that state for downstream heuristics (#228), so
+          # Rack keeps its own defaults there.
+          scrub_untrusted_forwarding_metadata(env) if proxy_trust_configured && !via_trusted_proxy
 
           # Same rationale, for loopback: this middleware runs outermost, so a
           # downstream middleware that must authenticate a DIRECT LOCAL CALL
@@ -121,6 +151,58 @@ class Otto
           @config.enabled?
         end
 
+        # Enforce THIS instance's proxy trust posture when a prior
+        # IPPrivacyMiddleware pass already resolved the client IP.
+        #
+        # The early return in #call keeps client-IP resolution idempotent, but
+        # trust enforcement must not ride on it: an outer instance mounted
+        # without the application's security config (the "unconfigured
+        # defaults" case in docs/guides/privacy.md) writes otto.client_ip and
+        # nothing else, and returning here would let an inner
+        # `trusted_proxies: :none` instance pass X-Forwarded-Host through
+        # untouched — the exact bypass the assertion exists to close.
+        #
+        # What can still be decided after the prior pass:
+        # - trust-nobody: the verdict is false for every peer, so it needs no
+        #   peer address. Always enforced, overriding a laxer prior verdict.
+        # - depth mode: the verdict is true by assertion. Recorded only when
+        #   no configured pass has spoken (key absent).
+        # - CIDR mode: needs the connecting peer, which the prior pass has
+        #   rewritten (REMOTE_ADDR is now the resolved, possibly masked, client
+        #   IP — matching a masked address against a narrow CIDR produces false
+        #   ALLOWs, see #ensure_ip_match_present). A verdict recorded by a prior
+        #   CONFIGURED pass is kept (the same-config stacking case). With none,
+        #   fail closed: deny, scrub, and warn so the misconfiguration is
+        #   diagnosable rather than a silent grant.
+        #
+        # Every deny also scrubs the authority carriers, which is idempotent:
+        # deleting an already-deleted key is a no-op.
+        #
+        # @param env [Hash] Rack environment
+        def enforce_proxy_trust_after_prior_pass(env)
+          return unless @security_config.respond_to?(:proxy_trust_configured?) &&
+                        @security_config.proxy_trust_configured?
+
+          if @security_config.trust_no_proxies?
+            env['otto.via_trusted_proxy'] = false
+            scrub_untrusted_forwarding_metadata(env)
+          elsif env.key?('otto.via_trusted_proxy')
+            nil # a configured pass already decided; honor it
+          elsif @security_config.trusted_proxy_depth_mode?
+            env['otto.via_trusted_proxy'] = true
+          else
+            Otto.logger.warn(
+              '[IPPrivacyMiddleware] otto.client_ip was resolved by a prior ' \
+              'pass with no proxy trust configured, so the connecting peer ' \
+              'can no longer be matched against trusted_proxies; treating ' \
+              'the peer as untrusted and stripping forwarded authority. ' \
+              'Pass the application security config to the outer instance.'
+            )
+            env['otto.via_trusted_proxy'] = false
+            scrub_untrusted_forwarding_metadata(env)
+          end
+        end
+
         # Guarantee env['otto.ip_match'] exists on the idempotent-return path.
         #
         # Every path in this middleware that sets otto.client_ip installs the
@@ -389,6 +471,25 @@ class Otto
           env['otto.ip_match'] = ->(cidrs) { Otto::Utils.ip_in_cidrs?(client_ip, cidrs) }
         end
 
+        # Remove forwarding metadata supplied by a peer that failed proxy trust.
+        #
+        # Rack honors these according only to the process-global forwarding
+        # family, so without this an untrusted client would control
+        # request.host, request.ssl?, and request.port for every mounted Rack
+        # app (Rack::Session's Secure-cookie gate reads ssl?). Delete the
+        # carriers rather than editing them: this path runs only in CIDR filter
+        # mode or under the trust-nobody assertion (`trusted_proxies: :none`,
+        # #259), neither of which reads the Forwarded header itself, and a
+        # hand-rolled RFC 7239 parser that disagrees with Rack's on quoting
+        # (e.g. `for=a"b;host=evil`) would let a host= survive the edit.
+        # X-Forwarded-For stays, masked or not, because Otto's own resolution
+        # already ignores it from an untrusted peer.
+        #
+        # @param env [Hash] Rack environment
+        def scrub_untrusted_forwarding_metadata(env)
+          UNTRUSTED_FORWARDING_METADATA_HEADERS.each { |key| env.delete(key) }
+        end
+
         # Delete forwarded IP headers outright.
         #
         # Used on the no-resolvable-client-IP path, where there is no masked IP

data/lib/otto/security/middleware/rate_limit_middleware.rb

@@ -27,13 +27,8 @@ class Otto
         def initialize(app, security_config = nil)
           @app = app
           @security_config = security_config
-          @rate_limiter_available = defined?(Rack::Attack)
 
-          if @rate_limiter_available
-            configure_rate_limiting
-          else
-            Otto.logger.warn '[Otto] rack-attack not available - rate limiting disabled'
-          end
+          configure_rate_limiting
         end
 
         # Pass-through call - actual rate limiting handled by Rack::Attack

data/lib/otto/security/rate_limiter.rb

@@ -4,18 +4,25 @@
 
 require 'json'
 
-begin
-  require 'rack/attack'
-rescue LoadError
-  # rack-attack is optional - graceful fallback
-end
+require_relative '../optional_dependency'
 
 class Otto
   module Security
     # Rate limiting implementation using Rack::Attack
     class RateLimiting
+      RACK_ATTACK_REQUIREMENT = '~> 6.7'
+
+      def self.ensure_available!
+        Otto::OptionalDependency.require!(
+          'rack-attack',
+          RACK_ATTACK_REQUIREMENT,
+          require_path: 'rack/attack',
+          feature: 'Rate limiting'
+        )
+      end
+
       def self.configure_rack_attack!(config = {})
-        return unless defined?(Rack::Attack)
+        ensure_available!
 
         # Use provided cache store or default
         Rack::Attack.cache.store = config[:cache_store] if config[:cache_store]
@@ -23,9 +30,13 @@ class Otto
         # Default rules
         default_requests_per_minute = config.fetch(:requests_per_minute, 100)
 
-        # General request throttling
+        # General request throttling. Internal paths (/_mcp, /_status, ...)
+        # are skipped by default. PATH_INFO, not Rack::Request#path: #path
+        # prepends SCRIPT_NAME, so with Otto mounted under `map '/api'` the
+        # internal /_mcp request read as /api/_mcp and was counted here while
+        # the MCP throttle, comparing the same way, never saw it at all.
         Rack::Attack.throttle('requests', limit: default_requests_per_minute, period: 60) do |request|
-          request.ip unless request.path.start_with?('/_') # Skip internal paths by default
+          request.ip unless request.path_info.start_with?('/_')
         end
 
         # Apply custom rules if provided
@@ -45,52 +56,76 @@ class Otto
           end
         end
 
-        # Custom response for rate limited requests
-        Rack::Attack.throttled_responder = lambda do |request|
-          match_data = request.env['rack.attack.match_data']
-          now = match_data[:epoch_time]
-
-          headers = {
-            'content-type' => 'application/json',
-            'retry-after' => (match_data[:period] - (now % match_data[:period])).to_s,
-          }
+        configure_responses
+        configure_logging
+      end
 
-          # Content negotiation for rate limit response
-          # Route's response_type takes precedence over Accept header
-          route_def = request.env['otto.route_definition']
-          wants_json = (route_def&.response_type == 'json') ||
-                       request.env['HTTP_ACCEPT'].to_s.include?('application/json')
-
-          if wants_json
-            error_response = {
-              error: 'Rate limit exceeded',
-              message: 'Too many requests',
-              retry_after: headers['retry-after'].to_i,
-              limit: match_data[:limit],
-              period: match_data[:period],
-            }
-            [429, headers, [JSON.generate(error_response)]]
-          else
-            body = "Rate limit exceeded. Retry after #{headers['retry-after']} seconds."
-            headers['content-type'] = 'text/plain'
-            [429, headers, [body]]
-          end
-        end
+      # Rack::Attack holds a single throttled_responder and each subscriber to
+      # 'rack.attack' fires on every throttle event. Subclasses override
+      # throttled_response and log_throttled_request instead of registering
+      # their own responder or subscriber after super, so the hosting app never
+      # gets a redundant responder assignment or doubled log lines.
+      def self.configure_responses
+        Rack::Attack.throttled_responder = ->(request) { throttled_response(request) }
+      end
 
+      def self.configure_logging
         # Log blocked requests if ActiveSupport is available
         return unless defined?(ActiveSupport::Notifications)
 
-        # Rack::Attack is mounted by the hosting app AHEAD of Otto, so this
-        # subscriber sees the raw peer regardless of where IPPrivacyMiddleware
-        # sits in Otto's own stack. Log a masked address, never req.ip: a
-        # deployment on the default :masked profile must not write raw client
-        # IPs to its logs every time a limit trips (issue #219).
         ActiveSupport::Notifications.subscribe('rack.attack') do |_name, _start, _finish, _request_id, payload|
-          req = payload[:request]
-          ip  = Otto::LoggingHelpers.privacy_safe_ip(req.env, req.ip)
-          Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{ip}: #{payload[:matched]}"
+          log_throttled_request(payload)
+        end
+      end
+
+      def self.throttled_response(request)
+        match_data = request.env['rack.attack.match_data']
+        general_throttled_response(request, throttle_headers(match_data), match_data)
+      end
+
+      def self.throttle_headers(match_data)
+        now = match_data[:epoch_time]
+
+        {
+          'content-type' => 'application/json',
+          'retry-after' => (match_data[:period] - (now % match_data[:period])).to_s,
+        }
+      end
+
+      # Custom response for rate limited requests
+      def self.general_throttled_response(request, headers, match_data)
+        # Content negotiation for rate limit response
+        # Route's response_type takes precedence over Accept header
+        route_def = request.env['otto.route_definition']
+        wants_json = (route_def&.response_type == 'json') ||
+                     request.env['HTTP_ACCEPT'].to_s.include?('application/json')
+
+        if wants_json
+          error_response = {
+            error: 'Rate limit exceeded',
+            message: 'Too many requests',
+            retry_after: headers['retry-after'].to_i,
+            limit: match_data[:limit],
+            period: match_data[:period],
+          }
+          [429, headers, [JSON.generate(error_response)]]
+        else
+          body = "Rate limit exceeded. Retry after #{headers['retry-after']} seconds."
+          headers['content-type'] = 'text/plain'
+          [429, headers, [body]]
         end
       end
+
+      # Rack::Attack is mounted by the hosting app AHEAD of Otto, so this
+      # subscriber sees the raw peer regardless of where IPPrivacyMiddleware
+      # sits in Otto's own stack. Log a masked address, never req.ip: a
+      # deployment on the default :masked profile must not write raw client
+      # IPs to its logs every time a limit trips (issue #219).
+      def self.log_throttled_request(payload)
+        req = payload[:request]
+        ip  = Otto::LoggingHelpers.privacy_safe_ip(req.env, req.ip)
+        Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{ip}: #{payload[:matched]}"
+      end
     end
   end
 end

data/lib/otto/utils.rb

@@ -19,9 +19,47 @@ class Otto
       HTTP_X_CLIENT_IP
     ].freeze
 
+    # Forwarding metadata Rack::Request reads without consulting Otto's proxy
+    # trust verdict: host (#host/#authority), scheme (#scheme/#ssl?), and port
+    # (#port), from both the X-Forwarded-* family and RFC 7239 Forwarded
+    # (host=, proto=, and the port inside for=). IPPrivacyMiddleware deletes
+    # every one of these for a peer that failed configured proxy trust.
+    FORWARDED_AUTHORITY_HEADERS = %w[
+      HTTP_FORWARDED
+      HTTP_X_FORWARDED_HOST
+      HTTP_X_FORWARDED_PROTO
+      HTTP_X_FORWARDED_SCHEME
+      HTTP_X_FORWARDED_SSL
+      HTTP_X_FORWARDED_PORT
+    ].freeze
+
+    # Headers whose presence means the request was RELAYED by a proxy rather
+    # than issued directly by the peer: every forwarding carrier Otto knows —
+    # the forwarded-for family, RFC 7239 Forwarded, and the authority (host /
+    # scheme / port) carriers. The set must cover everything IPPrivacyMiddleware
+    # may DELETE on the untrusted-peer path: a carrier that is scrubbed but not
+    # counted here would let a relayed request look direct afterwards. Shared
+    # by IPPrivacyMiddleware (which records the verdict as
+    # env['otto.peer_relayed'] BEFORE the scrub) and
+    # Otto::CaddyTLS::LocalhostGuard, so the record and the guard's own
+    # fallback scan cannot drift.
+    RELAY_MARKER_HEADERS = (FORWARDED_FOR_HEADERS + FORWARDED_AUTHORITY_HEADERS).uniq.freeze
+
     # Special-use IPv4/IPv6 ranges that IPAddr's #private?/#loopback?/#link_local?
     # predicates do not cover but that should still be treated as non-public
     # (e.g. when picking the real client out of a forwarded chain).
+    #
+    # The documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24,
+    # 2001:db8::/32 and the newer 3fff::/20) are deliberately NOT listed here.
+    # The predicate answers "could this be the real client", and non-public
+    # entries are skipped as proxy hops. Those ranges are not globally routable,
+    # but they are the universal convention for an example public client in tests
+    # and docs, including this repo's own specs and guides, so treating them as
+    # non-public would make the resolver skip the example client and silently
+    # invalidate those examples. There is no security gain either: an attacker who
+    # can inject into a chain injects a routable address, and a documentation
+    # address in a real chain means a misconfigured hop, which is better surfaced
+    # than skipped.
     SPECIAL_USE_RANGES = [
       IPAddr.new('0.0.0.0/8'),   # "this" network / unspecified (IPv4)
       IPAddr.new('224.0.0.0/4'), # IPv4 multicast
@@ -389,6 +427,18 @@ class Otto
       end
     end
 
+    # Whether any relay marker header is present on the request.
+    #
+    # Call this only from code that runs BEFORE forwarding carriers may be
+    # deleted (IPPrivacyMiddleware's untrusted-peer scrub); downstream code
+    # should prefer the recorded env['otto.peer_relayed'] boolean.
+    #
+    # @param env [Hash] Rack environment
+    # @return [Boolean]
+    def relayed_request?(env)
+      RELAY_MARKER_HEADERS.any? { |header| !env[header].to_s.strip.empty? }
+    end
+
     # Whether an address is on the loopback interface.
     #
     # This is the RAW SOCKET PEER test used to authenticate a direct local call

data/lib/otto/version.rb

@@ -3,5 +3,5 @@
 # frozen_string_literal: true
 
 class Otto
-  VERSION = '2.9.0'
+  VERSION = '2.10.0'
 end

data/lib/otto.rb

@@ -76,7 +76,7 @@ class Otto
            end
   @logger = Logger.new($stdout, Logger::INFO)
 
-  attr_reader :routes, :routes_literal, :routes_static, :route_definitions,
+  attr_reader :routes, :routes_literal, :route_definitions,
               :routes_by_definition, :option,
               :static_route, :security_config, :locale_config, :auth_config,
               :route_handler_factory, :mcp_server, :caddy_tls_server, :security, :middleware,
@@ -84,6 +84,7 @@ class Otto
   attr_accessor :not_found, :server_error
 
   def initialize(path = nil, opts = {})
+    constructed = false
     initialize_core_state
     initialize_options(path, opts)
     initialize_configurations(opts)
@@ -106,6 +107,13 @@ class Otto
     # but before processing requests.
     @freeze_mutex = Mutex.new
     @configuration_frozen = false
+    constructed = true
+  ensure
+    # A config that committed to a forwarding family during configure_security
+    # is held process-wide; withdraw it if construction failed afterwards
+    # (e.g. a bad routes path), or the dead app would keep vetoing other
+    # families for the life of the process.
+    Otto::Security::Config.release_rack_forwarding_family!(@security_config) if @security_config && !constructed
   end
   alias options option
 
@@ -172,16 +180,6 @@ class Otto
   private
 
   def initialize_core_state
-    # The GET cache is a Concurrent::Map, not a plain Hash: lazy static-file
-    # discovery (Core::Router#handle_request, Core::FileSafety#add_static_path)
-    # writes into it at request time, after freeze_configuration! has already
-    # deep-frozen the rest of the routing state. Deep-freezing this cache too
-    # would turn every as-yet-uncached static file request into a 500
-    # (FrozenError) in production (issue #185), so it is intentionally excluded
-    # from deep_freeze_value in Configuration#freeze_configuration! and kept as
-    # a structure that is both mutable post-freeze and safe under concurrent
-    # request threads.
-    @routes_static     = { GET: Concurrent::Map.new }
     @routes            = { GET: [] }
     @routes_literal    = { GET: {} }
     @route_definitions = {}

data/otto.gemspec

@@ -34,8 +34,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'logger', '~> 1', '< 2.0'
 
   spec.add_dependency 'rack', '~> 3.1', '< 4.0'
-  spec.add_dependency 'rack-parser', '~> 0.7'
-  spec.add_dependency 'rexml', '~> 3.4'
 
   # Security dependencies
   spec.add_dependency 'loofah', '~> 2.20'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: otto
 version: !ruby/object:Gem::Version
-  version: 2.9.0
+  version: 2.10.0
 platform: ruby
 authors:
 - Delano Mandelbaum
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-19 00:00:00.000000000 Z
+date: 2026-09-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -70,34 +70,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
-- !ruby/object:Gem::Dependency
-  name: rack-parser
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-- !ruby/object:Gem::Dependency
-  name: rexml
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.4'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.4'
 - !ruby/object:Gem::Dependency
   name: loofah
   requirement: !ruby/object:Gem::Requirement
@@ -144,18 +116,32 @@ files:
 - bin/rspec
 - changelog.d/README.md
 - changelog.d/scriv.ini
-- docs/.gitignore
-- docs/1108-STREAMING_ARCHITECTURE_ANALYSIS.md
-- docs/1108-STREAMING_SUPPORT_SUMMARY.md
-- docs/enrichment.md
-- docs/geo-country.md
-- docs/ipaddr-encoding-quirk.md
-- docs/migrating/v2.0.0-pre1.md
-- docs/migrating/v2.0.0-pre2.md
+- docs/README.md
+- docs/adr/README.md
+- docs/adr/adr-001-route-authentication-at-handler-boundary.md
+- docs/adr/adr-002-multi-strategy-authentication-and-authorization.md
+- docs/adr/adr-003-caddy-tls-route-based-integration.md
+- docs/adr/adr-004-separate-compatibility-from-security-maintenance.md
+- docs/guides/authentication.md
+- docs/guides/caddy-tls.md
+- docs/guides/configuration_freezing.md
+- docs/guides/enrichment.md
+- docs/guides/forwarded-authority.md
+- docs/guides/geo-country.md
+- docs/guides/ip_privacy.md
+- docs/guides/ipaddr-encoding-quirk.md
+- docs/guides/mcp.md
+- docs/guides/privacy.md
+- docs/guides/routing.md
+- docs/guides/structured_logging.md
+- docs/guides/testing-guide.md
+- docs/maintainers/github-actions.md
+- docs/maintainers/investigations/.gitignore
+- docs/migrating/v2.0.0.md
 - docs/migrating/v2.3.0.md
-- docs/modern-authentication-authorization-landscape.md
-- docs/multi-strategy-authentication-design.md
-- docs/reverse-proxy-network-services.md
+- docs/reference/authentication.md
+- docs/reference/route-syntax.md
+- docs/reference/runtime-and-dependency-security.md
 - examples/.gitignore
 - examples/advanced_routes/README.md
 - examples/advanced_routes/app.rb
@@ -251,12 +237,16 @@ files:
 - lib/otto/mcp.rb
 - lib/otto/mcp/auth/token.rb
 - lib/otto/mcp/core.rb
+- lib/otto/mcp/endpoint.rb
+- lib/otto/mcp/errors.rb
+- lib/otto/mcp/options.rb
 - lib/otto/mcp/protocol.rb
 - lib/otto/mcp/rate_limiting.rb
 - lib/otto/mcp/registry.rb
 - lib/otto/mcp/route_parser.rb
 - lib/otto/mcp/schema_validation.rb
 - lib/otto/mcp/server.rb
+- lib/otto/optional_dependency.rb
 - lib/otto/privacy.rb
 - lib/otto/privacy/anonymizer_resolver.rb
 - lib/otto/privacy/asn_resolver.rb

data/docs/.gitignore

@@ -1,10 +0,0 @@
-*
-!.gitignore
-!migrating/
-!migrating/*.md
-!ipaddr-encoding-quirk.md
-!enrichment.md
-!geo-country.md
-!modern-authentication-authorization-landscape.md
-!multi-strategy-authentication-design.md
-!reverse-proxy-network-services.md