rails-mcp 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb0683d35c50e882a06c6eaf4b87a1dc9d159210ceb749390eeadd91d8d63167
-  data.tar.gz: cb36847aa01cfa2a466598d481300d82d8ef226cdfc735f4bfa7c9cf52e2424a
+  metadata.gz: 9abbdcbddd03422c13399b75c6f3e45a360f349b0ea409b6c5aa2466aed79ef9
+  data.tar.gz: 2171f3dba98480579cc725e7ad7cdd558cd06d53e0ec3f2fe2fea1e10fb2270b
 SHA512:
-  metadata.gz: 2f26054cabebf6b4d475dfcc134b02a50b7492111a619fb9c9c7a4b3a666f966fa77b0521a977242cb729dc5afd3ab3d5545b051281500567b8bb8365c85e5e9
-  data.tar.gz: 58312fa76044c7285b72bedee876c6118593282060b0160698b8f6a2e4f5392896b7c59dfc082dc823f3b8a3c1fdb29e4c5069dbe7050abd6ab9cfaf73f78bcb
+  metadata.gz: 812025d7923995691c0c93236934b0a67df6b4c90ed2e65b64778d32d20740b64d73e4013165859ea6141de98036a75498702c56c690d46475865518f3b90753
+  data.tar.gz: faaf14ad99d8cb2789081071a1d71f0ca050b373f73d2837711482b9a3f4106aa69dd116ed41d177dc26d0fbfc6a5879e25f42f97c6751ccb5977099bf403467

data/README.md

@@ -143,6 +143,45 @@ curl -X POST "http://localhost:3001/mcp/rpc" \
   }'
 ```
 
+## Optional: Client Verification
+
+If you want a second layer of defense beyond environment-scoped mounting and network gating, enable client verification when constructing the server. When enabled, every request must carry an `X-Rails-Mcp-Token` header whose value matches `ENV["RAILS_MCP_TOKEN"]` (minimum 8 characters); otherwise the server responds `401 Unauthorized`.
+
+This deliberately uses a custom header (not `Authorization: Bearer`) and returns no `WWW-Authenticate` so it stays off the standard MCP/OAuth code path — important when the host Rails app already exposes a separate, product-facing MCP server with DCR / well-known discovery.
+
+```ruby
+mount RailsMcp::MCP::Server.new(use_client_verification: true) => "/mcp"
+```
+
+Set the token in the host environment:
+
+```bash
+export RAILS_MCP_TOKEN="<at-least-8-char-secret>"
+```
+
+Claude Code:
+
+```bash
+claude mcp add rails-mcp --transport http \
+  --header "X-Rails-Mcp-Token: $RAILS_MCP_TOKEN" \
+  http://localhost:3001/mcp/rpc
+```
+
+Cursor (`.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "rails-mcp": {
+      "url": "http://localhost:3001/mcp/rpc",
+      "headers": {
+        "X-Rails-Mcp-Token": "<at-least-8-char-secret>"
+      }
+    }
+  }
+}
+```
+
 ## Testing
 
 Run the test suite:

data/lib/rails_mcp/mcp/server.rb

@@ -9,7 +9,11 @@ module RailsMcp
     # Minimal MCP-over-HTTP (JSON-RPC) server.
     # Single-session, single-process demo: fine for local/dev usage.
     class Server
-      def initialize
+      VERIFICATION_HEADER = "HTTP_X_RAILS_MCP_TOKEN"
+      MIN_TOKEN_LENGTH = 8
+
+      def initialize(use_client_verification: false)
+        @use_client_verification = use_client_verification
         @tools = [
           {
             "name" => "evaluate_ruby_code",
@@ -31,6 +35,10 @@ module RailsMcp
       def call(env)
         req = Rack::Request.new(env)
 
+        if @use_client_verification && !verified?(env)
+          return [401, {"content-type" => "application/json"}, [JSON.generate({"error" => "Unauthorized"})]]
+        end
+
         case [req.request_method, req.path_info]
         when ["POST", "/rpc"] then handle_rpc(req)
         else
@@ -40,6 +48,17 @@ module RailsMcp
 
       private
 
+      # Checks a custom header against ENV["RAILS_MCP_TOKEN"]. Deliberately not
+      # `Authorization: Bearer` — that triggers DCR/well-known discovery in
+      # MCP clients and would collide with any product-facing MCP the host app
+      # already exposes. The 401 response intentionally omits WWW-Authenticate
+      # so OAuth-aware clients don't try to negotiate a token.
+      def verified?(env)
+        expected = ENV["RAILS_MCP_TOKEN"]
+        return false if expected.nil? || expected.length < MIN_TOKEN_LENGTH
+        env[VERIFICATION_HEADER] == expected
+      end
+
       def handle_rpc(req)
         payload = JSON.parse(req.body.read)
         id      = payload["id"]

data/lib/rails_mcp/version.rb

@@ -1,5 +1,5 @@
 # typed: strict
 module RailsMcp
-  VERSION = "0.1.1"
+  VERSION = "0.1.3"
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-mcp
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Raja Jamwal
@@ -79,8 +79,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Allows AI assistants to eval and verify rails/ruby code changes at lighting-speed
-  access without the need restart server.
+description: Lightweight gem, tested in huge Rails codebases (20k+ Ruby files). Allows
+  AI assistants to eval and verify rails/ruby code changes at lighting-speed access
+  without the need restart server.
 email:
 - linux.experi@gmail.com
 executables: []