rails-mcp 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 161612bf6580c9a6d6563aa52c53c49f38aa050f74f11055552ef25b6f441383
-  data.tar.gz: fcb09db9f6295dd174ea98ca00aab717983af3f18388717ea22eebb1409faf7e
+  metadata.gz: 6292b5dbca062dd8eeb8ddc10b4a903ec192e2cbddcc2e643e67f45c4ba29512
+  data.tar.gz: 0eb7f17f657f6327dcc5c9f6872e8b296102ec87612fe2277c24f2d7c66cd0c9
 SHA512:
-  metadata.gz: 8e873d2ac2fc72ba19b5011b7520feeb0cbf34940f40897315b960397907581bc4595392470acd924d598f3fab6a7362be02aabde3855dd3dab89a6750a5326a
-  data.tar.gz: 513252c3490cea1f90a7ff4b0e4ce52bc5c774f17fc8deaf3d8b829dda6dc3c90f1cc47f263525af0a60622d7bccc9af320dfade408d3300cd58b669f1191c18
+  metadata.gz: c185a2920099323584004f6c17cc095d97543e91faf666b343c93a106aac031565d298778138d5d6ee223f624f58a90c81d631588ebbf78bed4eabca760e3bc3
+  data.tar.gz: 34ca5897fda701bdba97ca326d879ba7c628a7e9a3dc7eb531c74aa5cd8485cca485b741d7219cc48a63d214b5c919c2a2eb2188d8136ddd9cd5918a035c130a

data/README.md

@@ -143,6 +143,45 @@ curl -X POST "http://localhost:3001/mcp/rpc" \
   }'
 ```
 
+## Optional: Client Verification
+
+If you want a second layer of defense beyond environment-scoped mounting and network gating, enable client verification when constructing the server. When enabled, every request must carry an `X-Rails-Mcp-Token` header whose value matches `ENV["RAILS_MCP_TOKEN"]` (minimum 8 characters); otherwise the server responds `401 Unauthorized`.
+
+This deliberately uses a custom header (not `Authorization: Bearer`) and returns no `WWW-Authenticate` so it stays off the standard MCP/OAuth code path — important when the host Rails app already exposes a separate, product-facing MCP server with DCR / well-known discovery.
+
+```ruby
+mount RailsMcp::MCP::Server.new(use_client_verification: true) => "/mcp"
+```
+
+Set the token in the host environment:
+
+```bash
+export RAILS_MCP_TOKEN="<at-least-8-char-secret>"
+```
+
+Claude Code:
+
+```bash
+claude mcp add rails-mcp --transport http \
+  --header "X-Rails-Mcp-Token: $RAILS_MCP_TOKEN" \
+  http://localhost:3001/mcp/rpc
+```
+
+Cursor (`.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "rails-mcp": {
+      "url": "http://localhost:3001/mcp/rpc",
+      "headers": {
+        "X-Rails-Mcp-Token": "<at-least-8-char-secret>"
+      }
+    }
+  }
+}
+```
+
 ## Testing
 
 Run the test suite:

data/lib/rails_mcp/mcp/server.rb

@@ -9,7 +9,11 @@ module RailsMcp
     # Minimal MCP-over-HTTP (JSON-RPC) server.
     # Single-session, single-process demo: fine for local/dev usage.
     class Server
-      def initialize
+      VERIFICATION_HEADER = "HTTP_X_RAILS_MCP_TOKEN"
+      MIN_TOKEN_LENGTH = 8
+
+      def initialize(use_client_verification: false)
+        @use_client_verification = use_client_verification
         @tools = [
           {
             "name" => "evaluate_ruby_code",
@@ -31,6 +35,10 @@ module RailsMcp
       def call(env)
         req = Rack::Request.new(env)
 
+        if @use_client_verification && !verified?(env)
+          return [401, {"content-type" => "application/json"}, [JSON.generate({"error" => "Unauthorized"})]]
+        end
+
         case [req.request_method, req.path_info]
         when ["POST", "/rpc"] then handle_rpc(req)
         else
@@ -40,6 +48,17 @@ module RailsMcp
 
       private
 
+      # Checks a custom header against ENV["RAILS_MCP_TOKEN"]. Deliberately not
+      # `Authorization: Bearer` — that triggers DCR/well-known discovery in
+      # MCP clients and would collide with any product-facing MCP the host app
+      # already exposes. The 401 response intentionally omits WWW-Authenticate
+      # so OAuth-aware clients don't try to negotiate a token.
+      def verified?(env)
+        expected = ENV["RAILS_MCP_TOKEN"]
+        return false if expected.nil? || expected.length < MIN_TOKEN_LENGTH
+        env[VERIFICATION_HEADER] == expected
+      end
+
       def handle_rpc(req)
         payload = JSON.parse(req.body.read)
         id      = payload["id"]

data/lib/rails_mcp/version.rb

@@ -1,5 +1,5 @@
 # typed: strict
 module RailsMcp
-  VERSION = "0.1.2"
+  VERSION = "0.1.4"
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-mcp
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.4
 platform: ruby
 authors:
 - Raja Jamwal
@@ -79,9 +79,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Lightweight gem, tested in huge Rails codebases (20k+ Ruby files). Allows
-  AI assistants to eval and verify rails/ruby code changes at lighting-speed access
-  without the need restart server.
+description: Lightweight gem, tested in large Rails codebases (20k+ Ruby files). Allows
+  AI assistants to evaluate and verify rails/ruby code changes securely at lighting-speed
+  access without the need to restart server or run bundler.
 email:
 - linux.experi@gmail.com
 executables: []
@@ -114,5 +114,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.7.2
 specification_version: 4
-summary: Model Context Protocol (MCP) server for Ruby code execution
+summary: "(MCP) server for Ruby/Rails code execution inline AI Agents"
 test_files: []