Unsecure transport #310
Merged
Unsecure transport #310
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
anuchandy
requested review from
JasonYeMSFT,
alzimmermsft,
conniey,
jongio,
vukelich and
wbreza
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR introduces HTTP transport support for the MCP server as an alternative to the default STDIO transport. The changes add a new command-line option --enable-insecure-transports that allows the server to run over HTTP with CORS enabled for development purposes.
Key changes:
- Adds HTTP transport capability with CORS configuration
- Introduces security validation requiring production credentials when enabling insecure transports
- Updates package dependencies to support the new HTTP transport functionality
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| Azure.Mcp.Core.csproj | Adds ModelContextProtocol.AspNetCore package reference for HTTP transport |
| ServiceStartOptions.cs | Adds EnableInsecureTransports property to configuration options |
| ServiceOptionDefinitions.cs | Defines the new command-line option for enabling insecure transports |
| ServiceStartCommand.cs | Implements HTTP host creation and security validation logic |
| ServiceCollectionExtensions.cs | Configures MCP server with appropriate transport based on options |
| Directory.Packages.props | Updates ModelContextProtocol package versions and adds AspNetCore variant |
Comments suppressed due to low confidence (1)
core/Azure.Mcp.Core/src/Areas/Server/Commands/ServiceStartCommand.cs:1
- According to the coding guidelines, System.Text.Json should be used instead of Newtonsoft.Json. Consider migrating to System.Text.Json for consistency.
// Copyright (c) Microsoft Corporation.
core/Azure.Mcp.Core/src/Areas/Server/Commands/ServiceStartCommand.cs
Outdated
Show resolved
Hide resolved
core/Azure.Mcp.Core/src/Areas/Server/Commands/ServiceStartCommand.cs
Outdated
Show resolved
Hide resolved
Member
Author
|
@LarryOsterman, here is the pr based on our offline discussion |
joshfree
approved these changes
Sep 4, 2025
core/Azure.Mcp.Core/src/Areas/Server/Commands/ServiceStartCommand.cs
Outdated
Show resolved
Hide resolved
jongio
reviewed
Sep 4, 2025
Member
|
Will this trigger the security concern again? |
anuchandy
force-pushed
the
stream-az-mcp-1
branch
from
bff1a07 to
9ba35aa
Compare
core/Azure.Mcp.Core/src/Areas/Server/Commands/ServiceStartCommand.cs
Outdated
Show resolved
Hide resolved
LarryOsterman
approved these changes
Sep 4, 2025
anuchandy
force-pushed
the
stream-az-mcp-1
branch
from
9ba35aa to
8cfa11c
Compare
anuchandy
force-pushed
the
stream-az-mcp-1
branch
from
8cfa11c to
43b2bcc
Compare
joshfree
approved these changes
Sep 4, 2025
github-project-automation
bot
moved this from Untriaged
to In Progress
in Azure MCP Server
feiskyer
pushed a commit
to feiskyer/microsoft-mcp
that referenced
this pull request
Sep 8, 2025
* Updated live tests * Added unit test for list keys * Added unit tests for get key * Added unit tests for create key * Refactored code and removed unnecessary tests
colbytimm
pushed a commit
to colbytimm/microsoft-mcp
that referenced
this pull request
Sep 27, 2025
* Enable enable-insecure-transports option * Check for ProdCred for streaming * allow standard ASPNETCORE_URLS and fix message * address cspell * improve message * adding GetSafeAspNetCoreUrl * restrict further
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
[Provide a clear, concise description of the changes]adding an insecure, undocumented switch to begin the early exploration of self-hosted remote mcp server.
[Any additional context, screenshots, or information that helps reviewers]GitHub issue number?
[Link to the GitHub issue this PR addresses]Pre-merge Checklist
CHANGELOG.mdfor product changes (features, bug fixes, UI/UX, updated dependencies).\eng\common\spelling\Invoke-Cspell.ps1README.mddocumentation/docs/azmcp-commands.md/docs/e2eTestPrompts.mdToolDescriptionEvaluatorand obtained a score of0.4or more and a top 3 ranking for all related test promptscrypto mining, spam, data exfiltration, etc.)/azp run mcp - pullrequest - liveto run Live Test Pipeline