xfy
ef4c4ee8ed
- CHANGELOG：[Unreleased]/Added 记录 MCP 服务器功能（传输/认证/作用域/工具面/加固/配置/依赖/环境变量）。 - .env.example：新增 MCP_TOKEN_ENC_KEY（必填，openssl rand -hex 32）+ RATE_LIMIT_MCP_PER_SEC/_BURST。 - AGENTS.md：新增「MCP Server」章节（传输/认证/令牌存储/作用域/工具组合模式/feature 门控/配置生成）+ Key Directories 加 src/mcp/ + 迁移数 14→17。 - DEPLOYMENT.md：必设变量表加 MCP_TOKEN_ENC_KEY；新增「/mcp 端点」反代说明（catch-all 代理/Origin 白名单取自 APP_BASE_URL/bearer 不经 cookie/独立限流桶）。 实时客户端冒烟测试延后到用户环境（需运行中的 DB + MCP_TOKEN_ENC_KEY + 真实 MCP 客户端）； 机制已由 T1 探针验证，集成路径在工单 T7 记录了用户侧步骤。
MCP Server — Ticket Index
Spec: docs/mcp-spec.md · Research: docs/mcp-research.md · Tickets: issues/
Dependency DAG
T1 tracer bullet (mount+auth+crypto+1 read tool)
├─► T2 token mgmt server fns + admin UI ─┐
├─► T3 read tools + Resources ────┐ │
├─► T4 write tools ───────────────┤ │
└─► T5 admin tools ───────────────┤ │
▼ │
T6 hardening ◄──┤
│ │
▼ ▼
T7 verification + docs
Execution order
| # | Ticket | Depends on | Notes |
|---|---|---|---|
| T1 | Tracer bullet — end-to-end skeleton (read path) | — | Do first. Proves rmcp/Axum mount + both build targets. Halt if rmcp≠axum 0.8. |
| T2 | Token management server fns + admin UI | T1 | Config generation for 4 clients lives here. |
| T3 | read-scope tools + Resources (knowledge base) | T1 | Can run parallel to T4/T5. |
| T4 | write-scope tools (posts/comments/tags/media) | T1 | Reuse existing helpers; same cache invalidation. |
| T5 | admin-scope tools (settings, code runner) | T1 | runner admin-only. |
| T6 | Hardening (rate limit, sanitization, audit) | T3, T4, T5 | Token-keyed governor; injection sanitization. |
| T7 | Integration verification + docs | T2, T6 | Real-client smoke test; CHANGELOG/env/AGENTS. |
T2/T3/T4/T5 are independent after T1 — fan out. T6 waits on the tool tickets; T7 is terminal.