Awesome/awesome-copilot
1
0
Fork 0
mirror of https://github.com/github/awesome-copilot.git synced 2026-08-25 10:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(plugins): discover MCP servers from mcp.json at plugin root (#2713)

Browse Source 
* fix(plugins): discover MCP servers from spec-mandated mcp.json at plugin root

MCP config was declared via an extensions.com.github.awesome-copilot.mcpServers
pointer to a .mcp.json file. That namespace is stripped from the served manifest,
so nothing carried the MCP declaration through materialization.

Per Agent Plugins v1.0.0 the fixed location is mcp.json at the plugin root, which
already ships as-is. Drop the pointer, rename both .mcp.json files, and validate
mcp.json (schema, closed top-level fields, server transport variants).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Validate mcp.json against the full v1.0.0 schema with Ajv

Replace the hand-rolled MCP checks with Ajv validation against the
canonical Agent Plugins v1.0.0 MCP schema, so non-spec configs (empty
command/url, non-string args, reserved PLUGIN_ROOT/PLUGIN_DATA env keys,
invalid cwd, unknown server fields) are rejected. Per-server errors are
re-derived from the matching discriminated branch to avoid unhelpful
oneOf output.

Also reject a top-level extensions.mcpServers placement, which slipped
through because the manifest schema allows arbitrary object-valued
extension keys.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Strengthen mcpServers and stdio semantic validation

Reject mcpServers under any extensions namespace in plugin.json so
inline MCP config cannot bypass root-level mcp.json enforcement.

Also run stdio semantic checks after schema validation to reject
absolute command paths and cwd values that escape the plugin root,
with regression tests for both cases.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Enforce MCP path containment across platform path styles

Resolve plugin-relative commands and placeholder-rooted cwd values
against the plugin root, normalize Windows separators, and reject
lexical or symlink escapes. Add regression coverage for traversal,
placeholders, Windows paths, and symlink targets.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Align MCP semantics with the v1.0.0 specification

Restore the canonical cwd pattern and literal ./ command prefix.
Validate remote HTTP URLs and headers, including HTTPS requirements,
header syntax, control characters, and case-insensitive duplicates.
Keep PLUGIN_DATA checks lexical-only so it is not conflated with the
plugin filesystem root.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Reject unsafe MCP symlink paths

Resolve mcp.json through the filesystem and require a regular file
inside the real plugin root, reporting dangling links explicitly.

Harden command and PLUGIN_ROOT containment checks to inspect symlink
ancestors with lstat and realpath instead of treating unresolved paths
as ordinary missing segments. Add regression coverage for outside,
dangling, and ancestor symlink cases.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Handle mixed separators in MCP data paths

Split PLUGIN_DATA traversal checks on both slash types so mixed
separators cannot bypass lexical containment on Windows clients.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Reject credentials in MCP package headers

MCP headers are visible package data, so reject credential-bearing
headers including authorization, proxy authorization, cookies, and
common API-key or token names. Preserve ordinary custom headers and
add focused regression coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
This commit is contained in:
Aaron Powell
2026-08-24 10:26:18 +10:00
committed by GitHub
parent b95e24caae
commit 37dcfd2325
12 changed files with 835 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
eng/validate-plugins.mjs
+87 -4
View File
@@ -6,7 +6,7 @@ import { fileURLToPath } from "url";
import { ROOT_FOLDER } from "./constants.mjs";
import { readExternalPlugins } from "./external-plugin-validation.mjs";
import { validateLicenseField } from "./lib/license.mjs";
import { AGENT_PLUGIN_SCHEMA_URL, validateAgentPluginManifest } from "./agent-plugin-schema.mjs";
import { AGENT_PLUGIN_SCHEMA_URL, validateAgentPluginManifest, validateAgentPluginMcpConfig } from "./agent-plugin-schema.mjs";
const PLUGINS_DIR = path.join(ROOT_FOLDER, "plugins");
const EXTENSIONS_DIR = path.join(ROOT_FOLDER, "extensions");
@@ -212,9 +212,77 @@ function validateExtensionReferences(plugin, pluginDir) {
return errors;
}
function validateCompositionNamespace(plugin) {
export function validateMcpConfig(pluginDir) {
const errors = [];
const compositionFields = ["agents", "hooks", "mcpServers", "skills"];
const legacyPath = path.join(pluginDir, ".mcp.json");
if (fs.existsSync(legacyPath)) {
errors.push("MCP configuration must live at mcp.json in the plugin root, not .mcp.json");
}
const mcpJsonPath = path.join(pluginDir, "mcp.json");
let mcpStat;
try {
mcpStat = fs.lstatSync(mcpJsonPath);
} catch (error) {
if (error.code === "ENOENT") {
try {
fs.readlinkSync(mcpJsonPath);
errors.push("mcp.json is a dangling symbolic link");
} catch (readlinkError) {
if (readlinkError.code !== "EINVAL" && readlinkError.code !== "ENOENT") {
errors.push(`mcp.json could not be inspected: ${readlinkError.message}`);
}
}
return errors;
}
errors.push(`mcp.json could not be inspected: ${error.message}`);
return errors;
}
let pluginRoot;
let resolvedMcpJsonPath;
try {
pluginRoot = fs.realpathSync.native(pluginDir);
resolvedMcpJsonPath = fs.realpathSync.native(mcpJsonPath);
} catch (error) {
if (mcpStat.isSymbolicLink() && error.code === "ENOENT") {
errors.push("mcp.json is a dangling symbolic link");
} else {
errors.push(`mcp.json could not be resolved: ${error.message}`);
}
return errors;
}
const relativeMcpPath = path.relative(pluginRoot, resolvedMcpJsonPath);
if (relativeMcpPath === ".." ||
relativeMcpPath.startsWith(`..${path.sep}`) ||
path.isAbsolute(relativeMcpPath)) {
errors.push("mcp.json must resolve to a file inside the plugin root");
return errors;
}
if (!fs.statSync(resolvedMcpJsonPath).isFile()) {
errors.push("mcp.json must be a regular file");
return errors;
}
const parsed = parseJsonFile(resolvedMcpJsonPath);
if (parsed.parseError) {
errors.push(`failed to parse mcp.json: ${parsed.parseError}`);
return errors;
}
if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
errors.push("mcp.json must contain a top-level object");
return errors;
}
errors.push(...validateAgentPluginMcpConfig(parsed, pluginDir).map((message) => `mcp.json ${message}`));
return errors;
}
export function validateCompositionNamespace(plugin) {
const errors = [];
const compositionFields = ["agents", "hooks", "skills"];
const extensions = plugin.extensions;
const composition = extensions?.[AWESOME_COPILOT_NAMESPACE];
@@ -230,6 +298,17 @@ function validateCompositionNamespace(plugin) {
return errors;
}
if (extensions && typeof extensions === "object" && !Array.isArray(extensions)) {
for (const [namespace, value] of Object.entries(extensions)) {
if (value && typeof value === "object" && !Array.isArray(value) && value.mcpServers !== undefined) {
errors.push(`extensions["${namespace}"].mcpServers is not supported; declare MCP servers in mcp.json at the plugin root`);
}
}
if (extensions.mcpServers !== undefined) {
errors.push("extensions.mcpServers is not supported; declare MCP servers in mcp.json at the plugin root");
}
}
for (const field of compositionFields) {
if (extensions?.[field] !== undefined) {
errors.push(`extensions.${field} must be moved to extensions["${AWESOME_COPILOT_NAMESPACE}"].${field}`);
@@ -290,12 +369,16 @@ function validatePlugin(folderName) {
// Rule 5b: license (shared with external plugins). Non-SPDX is a warning, not an error.
const warnings = [];
for (const field of ["agents", "hooks", "mcpServers", "skills"]) {
if (plugin.mcpServers !== undefined) {
errors.push("mcpServers must be declared in mcp.json at the plugin root, not in plugin.json");
}
for (const field of ["agents", "hooks", "skills"]) {
if (plugin[field] !== undefined) {
errors.push(`${field} must be moved to extensions["${AWESOME_COPILOT_NAMESPACE}"].${field}`);
}
}
errors.push(...validateCompositionNamespace(plugin));
errors.push(...validateMcpConfig(pluginDir));
const licenseResult = validateLicenseField(plugin.license, { required: false });
errors.push(...licenseResult.errors);
warnings.push(...licenseResult.warnings);