fix(compose): drop MCP_SERVER_TOKEN hard-require per CANONICAL_NAMES §5 - #1977
Conversation
The ${MCP_SERVER_TOKEN:?...} interpolation hard-require on agent-zero's env
list made every compose invocation against the shared file fail on nodes
without the var — blocking bring-up of unrelated services (model-registry on
Knuckles, 2026-07-06). §5 canon: compose omits the var entirely; env.tier-agent
provides A0_SET_mcp_server_token when the operator pins one, else Agent Zero
auto-generates at startup. Documents the slot in env.tier-agent.example.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR changes the ChangesMCP Server Token Configuration
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Docker Hardening ValidationHardening Validation ReportValidated: Mon Jul 6 12:40:14 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 57ce876bea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…l removal) Codex P2 on #1977: dropping the A0_SET_mcp_server_token mapping entirely means nodes that pinned MCP_SERVER_TOKEN lose it — Agent Zero reads A0_SET_* (not the plain env var), so it auto-generates instead of honoring the pin. Restore the mapping with a soft default ${MCP_SERVER_TOKEN:-} (not the old :? hard-require), keeping the Knuckles bring-up fix (no interpolation hard-fail) while bridging a pinned token to Agent Zero's setting. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Docker Hardening ValidationHardening Validation ReportValidated: Mon Jul 6 21:48:44 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
pmoves/docker-compose.yml (1)
2651-2658: 🗄️ Data Integrity & Integration | 🔴 Critical | 🏗️ Heavy liftSame override-vs-env_file conflict as
docker-compose.agents.yml.This is the same
A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-}pattern that CANONICAL_NAMES.md §5 explicitly names as deprecated because theenvironment:entry always overrides theenv_file:-supplied pin fromenv.tier-agent, silently emptying it whenMCP_SERVER_TOKENis unset in the shell. Since this is the canonical compose file (per the PR objective, this is the one the migration path in CANONICAL_NAMES.md was closing first), it should drop theenvironment:line entirely and rely onenv_filepassthrough, matching the fix proposed fordocker-compose.agents.yml.🛡️ Proposed fix
- # A0_SET_mcp_server_token: soft default (CANONICAL_NAMES.md §5). The previous - # ${MCP_SERVER_TOKEN:?...} hard-require made *every* compose invocation on the - # shared file fail interpolation on nodes without the var — blocking bring-up - # of unrelated services (hit on Knuckles 2026-07-06). Use ${...:-} not :? — - # a pinned MCP_SERVER_TOKEN is STILL bridged to Agent Zero's setting (Codex - # `#1977`: AZ reads A0_SET_* not the plain env var, so the pin must be mapped); - # unset → empty, no hard-fail, Agent Zero auto-generates at startup. - - A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} + # A0_SET_mcp_server_token is intentionally NOT set here (CANONICAL_NAMES.md §5). + # env_file: env.tier-agent supplies A0_SET_mcp_server_token when an operator + # has pinned a token; otherwise Agent Zero auto-generates one at startup.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pmoves/docker-compose.yml` around lines 2651 - 2658, The A0_SET_mcp_server_token entry in the main compose service is still overriding the value from env_file and can silently empty a pinned MCP_SERVER_TOKEN when the shell variable is unset. Remove the environment: mapping for A0_SET_mcp_server_token and let the existing env_file-provided token flow through unchanged, matching the intended behavior for docker-compose.agents.yml and the canonical compose path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pmoves/docker-compose.agents.yml`:
- Around line 88-95: The A0_SET_mcp_server_token entry in the compose service
environment is overriding env_file and can blank out the pinned token from
env.tier-agent when MCP_SERVER_TOKEN is unset. Remove this environment mapping
from the relevant service configuration so env.tier-agent remains the source of
truth, and keep the surrounding Agent Zero token handling in the compose setup
unchanged.
In `@pmoves/env.tier-agent.example`:
- Around line 77-84: The documented pinning contract for A0_SET_mcp_server_token
is being overridden by the compose configuration, so fix the compose files
rather than this env example. In docker-compose.agents.yml and
docker-compose.yml, remove the environment entry that sets
A0_SET_mcp_server_token from MCP_SERVER_TOKEN so the value from env.tier-agent
can persist when pinned, and only leave it unset for auto-generation behavior.
---
Duplicate comments:
In `@pmoves/docker-compose.yml`:
- Around line 2651-2658: The A0_SET_mcp_server_token entry in the main compose
service is still overriding the value from env_file and can silently empty a
pinned MCP_SERVER_TOKEN when the shell variable is unset. Remove the
environment: mapping for A0_SET_mcp_server_token and let the existing
env_file-provided token flow through unchanged, matching the intended behavior
for docker-compose.agents.yml and the canonical compose path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ee14ec3f-e6ea-4db5-8d03-f525747dc185
📒 Files selected for processing (3)
pmoves/docker-compose.agents.ymlpmoves/docker-compose.ymlpmoves/env.tier-agent.example
| # A0_SET_mcp_server_token: soft default (CANONICAL_NAMES.md §5). The previous | ||
| # ${MCP_SERVER_TOKEN:?...} hard-require made *every* compose invocation on the | ||
| # shared file fail interpolation on nodes without the var — blocking bring-up | ||
| # of unrelated services (hit on Knuckles 2026-07-06). Use ${...:-} not :? — | ||
| # a pinned MCP_SERVER_TOKEN is STILL bridged to Agent Zero's setting (Codex | ||
| # #1977: AZ reads A0_SET_* not the plain env var, so the pin must be mapped); | ||
| # unset → empty, no hard-fail, Agent Zero auto-generates at startup. | ||
| - A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Remove A0_SET_mcp_server_token from environment:
environment: overrides env_file:, so A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} will blank out any pinned value from env.tier-agent whenever MCP_SERVER_TOKEN is unset in the host shell. Let env.tier-agent supply it instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/docker-compose.agents.yml` around lines 88 - 95, The
A0_SET_mcp_server_token entry in the compose service environment is overriding
env_file and can blank out the pinned token from env.tier-agent when
MCP_SERVER_TOKEN is unset. Remove this environment mapping from the relevant
service configuration so env.tier-agent remains the source of truth, and keep
the surrounding Agent Zero token handling in the compose setup unchanged.
|
|
||
| # --------------------------------------------------------------------------- | ||
| # Agent Zero MCP server token (CANONICAL_NAMES.md §5) | ||
| # --------------------------------------------------------------------------- | ||
| # Canonical home for the MCP/a2a token. Compose intentionally does NOT set | ||
| # A0_SET_mcp_server_token in its env list — pin it here to make it durable, | ||
| # or leave unset and Agent Zero auto-generates one at startup. | ||
| # A0_SET_mcp_server_token= |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Documentation itself is correct, but conflicts with actual compose behavior.
This documentation correctly states the canonical pinning contract — pin A0_SET_mcp_server_token in env.tier-agent, leave unset for auto-generation. However, as written, this is currently broken by docker-compose.agents.yml and docker-compose.yml, both of which still set A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:-} under environment:, which overrides whatever value is pinned here when MCP_SERVER_TOKEN is unset in the shell (see comments on those files). No change needed here once the compose files are fixed to drop that environment: entry.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/env.tier-agent.example` around lines 77 - 84, The documented pinning
contract for A0_SET_mcp_server_token is being overridden by the compose
configuration, so fix the compose files rather than this env example. In
docker-compose.agents.yml and docker-compose.yml, remove the environment entry
that sets A0_SET_mcp_server_token from MCP_SERVER_TOKEN so the value from
env.tier-agent can persist when pinned, and only leave it unset for
auto-generation behavior.
…_TOKEN (review P1) Compose interpolation resolves from the project env (env.shared), not from sibling environment: entries — so the added MCP_SERVER_TOKEN container env never fed A0_SET_mcp_server_token, and A0 (which reads A0_SET_*, Codex #1977) kept deriving a per-instance token. The A0_SET line now interpolates the fleet-canonical AGENT_ZERO_MCP_TOKEN directly, with legacy MCP_SERVER_TOKEN project-env as fallback and empty (derive-on-unset) when both are absent. Split overlay regenerated. Known Road compose:issue:2056 (trail committed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…OKEN) (#2057) * feat(secrets): fleet-canonical Agent Zero MCP token (AGENT_ZERO_MCP_TOKEN) GRAPHITI_MARK: B850-CLAUDE::A0-MCP-TOKEN-FLEET::2026-07-11 Closes #2056. Agent Zero derives its inbound-MCP token per instance when MCP_SERVER_TOKEN is unset (stable sha256(runtime_id:user:pass), but per-instance and silently rotates on credential/volume changes) — cross-node callers need a declarative fleet credential. Operator minted AGENT_ZERO_MCP_TOKEN into the Prod environment (name matches the existing PMOVES-DoX mapping pattern). - sync-secrets-local.yml: forward AGENT_ZERO_MCP_TOKEN - compose: agent-zero gets MCP_SERVER_TOKEN=${AGENT_ZERO_MCP_TOKEN:-} (empty default preserves derive-on-unset; edited under Known Road compose:issue:2056, split overlay regenerated via make compose-split) - secrets_funnel_populate: catalog row renamed to AGENT_ZERO_MCP_TOKEN (both spellings validate); 21/21 tests green - checklist/receipt form: all 11 inventory keys now IN-GH-SECRETS, NEEDED=0 Remaining (operator/manifest lane, tracked in #2056): manifest_v2 projection routing AGENT_ZERO_MCP_TOKEN into env.tier-agent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(compose): interpolate A0_SET_mcp_server_token from AGENT_ZERO_MCP_TOKEN (review P1) Compose interpolation resolves from the project env (env.shared), not from sibling environment: entries — so the added MCP_SERVER_TOKEN container env never fed A0_SET_mcp_server_token, and A0 (which reads A0_SET_*, Codex #1977) kept deriving a per-instance token. The A0_SET line now interpolates the fleet-canonical AGENT_ZERO_MCP_TOKEN directly, with legacy MCP_SERVER_TOKEN project-env as fallback and empty (derive-on-unset) when both are absent. Split overlay regenerated. Known Road compose:issue:2056 (trail committed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 participant
Summary
- A0_SET_mcp_server_token=${MCP_SERVER_TOKEN:?...}hard-fails file-wide compose interpolation on any node without the var — today it blockedmake -C pmoves up-model-management(an unrelated service) on Knuckles, reproducing the "MCP_SERVER_TOKEN not pinned" GAP from the 2026-07-03 standup audit.CANONICAL_NAMES.md §5already prescribes the fix: do not set it in the compose env list at all —env_file: env.tier-agentprovidesA0_SET_mcp_server_tokenwhen the operator has pinned a token; otherwise Agent Zero auto-generates one at startup. This PR applies exactly that: the line becomes an explanatory comment, andenv.tier-agent.exampledocuments the canonical slot.Note the previous deprecated pattern was
${MCP_SERVER_TOKEN:-}(empty-default silently overriding env_file). The:?hard-require fixed the silent override but traded it for fleet-wide interpolation failure. Omission is the §5 canon.Test plan
MCP_SERVER_TOKEN:make -C pmoves up-model-managementnow interpolates cleanly (was:required variable MCP_SERVER_TOKEN is missing a value)env.tier-agentwhen pinned; auto-generated otherwise (per §5)🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
Documentation