fix(security): close unauthenticated MCP host execution and proxy bypass

[reprewindai-dev]

Incident

Production cAPI exposes /api/mcp/servers and the direct /api/proxy/{serverId}/{...path} forwarder without an effective authentication gate. The MCP registry accepts local-process descriptors, and the stdio transport inherited the complete cAPI process environment.

Fix

• require the existing Covenant admin token for both GET and POST on /api/mcp/servers
• reject local-process MCP in production; permit it only in non-production when CAPI_ALLOW_LOCAL_PROCESS_MCP=true
• remove ...process.env inheritance from spawned stdio MCP processes; only a minimal non-secret runtime allowlist plus explicitly supplied descriptor env is passed
• enforce BYOS_INTERNAL_API_KEY on every direct proxy method
• fail closed if the internal key is not configured
• strip cAPI internal auth headers before forwarding upstream

Truth boundary

This is source remediation. It does not by itself remove capi.veklom.com from public ingress or prove the deployed runtime is fixed. Production ingress should still be closed/restricted immediately, then this commit deployed and verified with unauthenticated negative tests.

Required deployment checks

1. unauthenticated GET /api/mcp/servers => 401/503, never inventory
2. unauthenticated POST /api/mcp/servers => 401/503, never process spawn
3. authenticated production local-process registration => 403
4. direct proxy without X-API-Key => 401/503
5. valid internal proxy request succeeds without forwarding the internal key upstream
6. confirm no public route exposes an alternate MCP registration/proxy path

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
c-api	Error		Aug 23, 2026 2:21pm
veklom-id-59uw	Error		Aug 23, 2026 2:21pm

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: edd09347-e201-4dc4-af3c-529bb5281352

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[reprewindai-dev]

Security containment: keep this PR draft. The source direction is appropriate (admin-gated MCP registry, production local-process denial, no full process.env inheritance, fail-closed direct proxy auth), but exact-head cAPI CI run 32644995839 concludes failure. Before promotion, add/confirm focused negative tests for unauthenticated GET/POST registry access, production local-process denial, missing/wrong X-API-Key on every proxy method, and proof the internal/admin credentials are stripped upstream. Also audit remote MCP/OpenAPI registration URLs for SSRF/egress policy: authentication alone does not make caller-selected remote endpoints safe. Runtime remains NOT_VERIFIED until the deployed SHA, HTTP/protocol identity, listener 3003, and Traefik routing agree; public ingress exposure must be independently checked.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.