rails-mcp 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 161612bf6580c9a6d6563aa52c53c49f38aa050f74f11055552ef25b6f441383
-  data.tar.gz: fcb09db9f6295dd174ea98ca00aab717983af3f18388717ea22eebb1409faf7e
+  metadata.gz: 9abbdcbddd03422c13399b75c6f3e45a360f349b0ea409b6c5aa2466aed79ef9
+  data.tar.gz: 2171f3dba98480579cc725e7ad7cdd558cd06d53e0ec3f2fe2fea1e10fb2270b
 SHA512:
-  metadata.gz: 8e873d2ac2fc72ba19b5011b7520feeb0cbf34940f40897315b960397907581bc4595392470acd924d598f3fab6a7362be02aabde3855dd3dab89a6750a5326a
-  data.tar.gz: 513252c3490cea1f90a7ff4b0e4ce52bc5c774f17fc8deaf3d8b829dda6dc3c90f1cc47f263525af0a60622d7bccc9af320dfade408d3300cd58b669f1191c18
+  metadata.gz: 812025d7923995691c0c93236934b0a67df6b4c90ed2e65b64778d32d20740b64d73e4013165859ea6141de98036a75498702c56c690d46475865518f3b90753
+  data.tar.gz: faaf14ad99d8cb2789081071a1d71f0ca050b373f73d2837711482b9a3f4106aa69dd116ed41d177dc26d0fbfc6a5879e25f42f97c6751ccb5977099bf403467

data/README.md

@@ -143,6 +143,45 @@ curl -X POST "http://localhost:3001/mcp/rpc" \
   }'
 ```
 
+## Optional: Client Verification
+
+If you want a second layer of defense beyond environment-scoped mounting and network gating, enable client verification when constructing the server. When enabled, every request must carry an `X-Rails-Mcp-Token` header whose value matches `ENV["RAILS_MCP_TOKEN"]` (minimum 8 characters); otherwise the server responds `401 Unauthorized`.
+
+This deliberately uses a custom header (not `Authorization: Bearer`) and returns no `WWW-Authenticate` so it stays off the standard MCP/OAuth code path — important when the host Rails app already exposes a separate, product-facing MCP server with DCR / well-known discovery.
+
+```ruby
+mount RailsMcp::MCP::Server.new(use_client_verification: true) => "/mcp"
+```
+
+Set the token in the host environment:
+
+```bash
+export RAILS_MCP_TOKEN="<at-least-8-char-secret>"
+```
+
+Claude Code:
+
+```bash
+claude mcp add rails-mcp --transport http \
+  --header "X-Rails-Mcp-Token: $RAILS_MCP_TOKEN" \
+  http://localhost:3001/mcp/rpc
+```
+
+Cursor (`.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "rails-mcp": {
+      "url": "http://localhost:3001/mcp/rpc",
+      "headers": {
+        "X-Rails-Mcp-Token": "<at-least-8-char-secret>"
+      }
+    }
+  }
+}
+```
+
 ## Testing
 
 Run the test suite:

data/lib/rails_mcp/mcp/server.rb

@@ -9,7 +9,11 @@ module RailsMcp
     # Minimal MCP-over-HTTP (JSON-RPC) server.
     # Single-session, single-process demo: fine for local/dev usage.
     class Server
-      def initialize
+      VERIFICATION_HEADER = "HTTP_X_RAILS_MCP_TOKEN"
+      MIN_TOKEN_LENGTH = 8
+
+      def initialize(use_client_verification: false)
+        @use_client_verification = use_client_verification
         @tools = [
           {
             "name" => "evaluate_ruby_code",
@@ -31,6 +35,10 @@ module RailsMcp
       def call(env)
         req = Rack::Request.new(env)
 
+        if @use_client_verification && !verified?(env)
+          return [401, {"content-type" => "application/json"}, [JSON.generate({"error" => "Unauthorized"})]]
+        end
+
         case [req.request_method, req.path_info]
         when ["POST", "/rpc"] then handle_rpc(req)
         else
@@ -40,6 +48,17 @@ module RailsMcp
 
       private
 
+      # Checks a custom header against ENV["RAILS_MCP_TOKEN"]. Deliberately not
+      # `Authorization: Bearer` — that triggers DCR/well-known discovery in
+      # MCP clients and would collide with any product-facing MCP the host app
+      # already exposes. The 401 response intentionally omits WWW-Authenticate
+      # so OAuth-aware clients don't try to negotiate a token.
+      def verified?(env)
+        expected = ENV["RAILS_MCP_TOKEN"]
+        return false if expected.nil? || expected.length < MIN_TOKEN_LENGTH
+        env[VERIFICATION_HEADER] == expected
+      end
+
       def handle_rpc(req)
         payload = JSON.parse(req.body.read)
         id      = payload["id"]

data/lib/rails_mcp/version.rb

@@ -1,5 +1,5 @@
 # typed: strict
 module RailsMcp
-  VERSION = "0.1.2"
+  VERSION = "0.1.3"
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-mcp
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Raja Jamwal