Harden MCP HTTP non-loopback binding and add expected-content check to conformance

- Refuse to serve MCP HTTP on non-loopback hosts without --auth-token
  or OAuth configured
- Add --expect flag to model conformance; fail provider if response
  content does not match expected value
- Replace bare try/except and isinstance-or chains with contextlib.suppress
  and isinstance(..., (list, tuple)) across code_mode, oauth21, mcp_http

Author: johnteee

docs/p2-scope.md

@@ -3,19 +3,20 @@
 ## Included
 
 - In-memory Graph RAG primitives for entity/relation traversal and document retrieval.
-- Restricted Code Mode for deterministic local data manipulation with AST allow-list validation.
+- Restricted Code Mode for deterministic local data manipulation with AST allow-list validation and child-process timeout/resource guardrails.
 - Stateless MCP request/response envelopes that carry capabilities and shared state per request.
-- Streamable HTTP transport for the MCP server with `Mcp-Session-Id` sessions, optional bearer-token auth, and Origin allowlist (POST/GET/DELETE on `/mcp`).
+- Streamable HTTP transport for the MCP server with `Mcp-Session-Id` sessions, bearer-token/OAuth guardrails for non-loopback binds, and Origin allowlist (POST/GET/DELETE on `/mcp`).
 - Managed-agent readiness checks for tool metadata, audit, budget, external state, and HITL gaps.
 - Provider portability checks for tool calling, structured output, system prompt support, prompt caching, and context limits.
+- Cross-provider live model conformance smoke checks with per-provider pass/fail/skip reporting.
 
 ## Still Deferred
 
 - Production GraphQLite deployment, migrations, and Cypher query tuning.
-- Production sandboxing for Code Mode using containers, V8 isolates, or a managed execution service.
-- OAuth 2.1 / DPoP enforcement on top of the Streamable HTTP transport.
+- Strong production sandboxing for Code Mode using containers, V8 isolates, or a managed execution service.
+- Production hardening for OAuth 2.1 / DPoP deployments, including key rotation and external client storage.
 - Actual managed runtime integration with Anthropic, OpenAI, Google ADK, or Vertex Agent Engine.
-- Cross-provider live conformance tests.
+- Deeper cross-provider conformance for streaming, structured output, tool calling, and provider-specific safety blocks.
 
 ## P2 Extension Rules
 

setup.py

@@ -3,7 +3,21 @@
 from setuptools import find_packages, setup
 
 GRAPHQLITE_DEPS = ['graphqlite>=0.4.4', 'pysqlite3>=0.6.0']
-DEV_DEPS = [*GRAPHQLITE_DEPS, 'pytest>=7', 'pytest-cov>=4', 'ruff>=0.4', 'mypy>=1']
+OAUTH_DEPS = ['cryptography>=3.4']
+TELEMETRY_DEPS = [
+    'opentelemetry-api>=1.20',
+    'opentelemetry-sdk>=1.20',
+    'opentelemetry-exporter-otlp-proto-http>=1.20',
+]
+DEV_DEPS = [
+    *GRAPHQLITE_DEPS,
+    *OAUTH_DEPS,
+    *TELEMETRY_DEPS,
+    'pytest>=7',
+    'pytest-cov>=4',
+    'ruff>=0.4',
+    'mypy>=1',
+]
 
 
 setup(
@@ -13,6 +27,11 @@
     packages=find_packages(),
     python_requires='>=3.9',
     install_requires=[],
-    extras_require={'graphqlite': GRAPHQLITE_DEPS, 'dev': DEV_DEPS},
+    extras_require={
+        'graphqlite': GRAPHQLITE_DEPS,
+        'oauth': OAUTH_DEPS,
+        'telemetry': TELEMETRY_DEPS,
+        'dev': DEV_DEPS,
+    },
     entry_points={'console_scripts': ['teaagent=teaagent.cli:main']},
 )

teaagent/cli.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import argparse
+import ipaddress
 import json
 import sys
 from typing import Any, Optional
@@ -35,6 +36,17 @@
 from teaagent.workspace_tools import build_workspace_tool_registry
 
 
+def is_loopback_host(host: str) -> bool:
+    if host == 'localhost':
+        return True
+    if host in {'', '0.0.0.0', '::'}:
+        return False
+    try:
+        return ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return False
+
+
 def main(argv: Optional[list[str]] = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)
@@ -405,6 +417,11 @@ def build_parser() -> argparse.ArgumentParser:
     conformance_model.add_argument(
         '--prompt', default='Reply with exactly: ok', help='Prompt to send.'
     )
+    conformance_model.add_argument(
+        '--expect',
+        default='ok',
+        help='Exact response content required for pass. Use an empty string to only require non-empty output.',
+    )
     conformance_model.add_argument(
         '--max-tokens', type=int, default=32, help='Maximum output tokens.'
     )
@@ -681,7 +698,9 @@ def _execute_agent_task(
 
     # --- OpenTelemetry wiring ---
     _telemetry_sink = None
-    if getattr(args, 'telemetry_otlp_endpoint', None) or getattr(args, 'telemetry_console', False):
+    if getattr(args, 'telemetry_otlp_endpoint', None) or getattr(
+        args, 'telemetry_console', False
+    ):
         try:
             from teaagent.telemetry import (
                 TelemetryConfig,
@@ -730,6 +749,7 @@ def _execute_agent_task(
     # Shut down OTel to flush any pending spans.
     if _telemetry_sink is not None:
         from contextlib import suppress
+
         with suppress(Exception):
             _telemetry_sink.force_flush()
     payload = run_result_payload(result, routing=routing.to_dict() if routing else None)
@@ -850,6 +870,7 @@ def model_conformance(args: argparse.Namespace) -> int:
     report = run_model_conformance(
         args.provider,
         prompt=args.prompt,
+        expected_content=args.expect if args.expect else None,
         max_tokens=args.max_tokens,
         model=args.model,
     )
@@ -964,6 +985,16 @@ def mcp_serve_command(args: argparse.Namespace) -> int:
                 file=sys.stderr,
             )
             return 1
+        if (
+            not is_loopback_host(args.host)
+            and not args.auth_token
+            and oauth_server is None
+        ):
+            print(
+                'Refusing to serve MCP HTTP on a non-loopback host without --auth-token or OAuth.',
+                file=sys.stderr,
+            )
+            return 1
         return serve_mcp_http(
             registry,
             host=args.host,

teaagent/code_mode.py

@@ -3,6 +3,7 @@
 import ast
 import multiprocessing
 import traceback
+from contextlib import suppress
 from dataclasses import dataclass
 from typing import Any
 
@@ -168,18 +169,16 @@ def _apply_resource_limits(sandbox: CodeModeSandbox) -> None:
         soft = sandbox.memory_bytes
         if hard != resource.RLIM_INFINITY:
             soft = min(soft, hard)
-        try:
+        # macOS reports RLIMIT_AS but rejects lowering it; wall/CPU limits still
+        # keep Code Mode isolated from the parent process.
+        with suppress(ValueError):
             resource.setrlimit(resource.RLIMIT_AS, (soft, hard))
-        except ValueError:
-            # macOS reports RLIMIT_AS but rejects lowering it; wall/CPU limits still
-            # keep Code Mode isolated from the parent process.
-            pass
 
 
 def _validate_plain_data(value: Any, label: str) -> None:
     if value is None or isinstance(value, (bool, int, float, str)):
         return
-    if isinstance(value, list) or isinstance(value, tuple):
+    if isinstance(value, (list, tuple)):
         for index, item in enumerate(value):
             _validate_plain_data(item, f'{label}[{index}]')
         return

teaagent/llm_conformance.py

@@ -79,6 +79,7 @@ def run_model_conformance(
     providers: Iterable[str] | None = None,
     *,
     prompt: str = 'Reply with exactly: ok',
+    expected_content: str | None = 'ok',
     max_tokens: int = 32,
     model: str | None = None,
     adapter_factory: AdapterFactory = create_llm_adapter,
@@ -89,6 +90,7 @@ def run_model_conformance(
         _run_provider_conformance(
             provider,
             prompt=prompt,
+            expected_content=expected_content,
             max_tokens=max_tokens,
             model=model,
             adapter_factory=adapter_factory,
@@ -103,6 +105,7 @@ def _run_provider_conformance(
     provider: str,
     *,
     prompt: str,
+    expected_content: str | None,
     max_tokens: int,
     model: str | None,
     adapter_factory: AdapterFactory,
@@ -137,6 +140,14 @@ def _run_provider_conformance(
             model=response.model,
             error='provider returned empty content',
         )
+    if expected_content is not None and content != expected_content:
+        return ModelConformanceResult(
+            provider=provider,
+            status='failed',
+            model=response.model,
+            content=content,
+            error=f'provider returned {content!r}; expected {expected_content!r}',
+        )
     return ModelConformanceResult(
         provider=provider,
         status='passed',

teaagent/mcp_http.py

@@ -66,9 +66,7 @@ def build_mcp_http_server(
 ) -> tuple[ThreadingHTTPServer, MCPSessionStore]:
     sessions = MCPSessionStore()
     origins = frozenset(allowed_origins) if allowed_origins else None
-    handler_cls = _make_handler(
-        registry, sessions, auth_token, origins, oauth_server
-    )
+    handler_cls = _make_handler(registry, sessions, auth_token, origins, oauth_server)
     server = ThreadingHTTPServer((host, port), handler_cls)
     return server, sessions
 
@@ -128,17 +126,13 @@ def _check_auth(self) -> bool:
                 header = self.headers.get(_AUTHORIZATION_HEADER, '')
                 if not header.startswith('Bearer '):
                     return False
-                return secrets.compare_digest(
-                    header[len('Bearer '):], auth_token
-                )
+                return secrets.compare_digest(header[len('Bearer ') :], auth_token)
 
             # OAuth 2.1 / DPoP token validation.
             if resource_server is not None:
                 try:
                     claims = resource_server.validate_request(
-                        authorization_header=self.headers.get(
-                            _AUTHORIZATION_HEADER
-                        ),
+                        authorization_header=self.headers.get(_AUTHORIZATION_HEADER),
                         dpop_header=self.headers.get(_DPOP_HEADER),
                         method=self.command,
                         url=self._request_url(),
@@ -189,9 +183,7 @@ def _send_json(
             self.end_headers()
             self.wfile.write(body)
 
-        def _send_status(
-            self, status: int, message: Optional[str] = None
-        ) -> None:
+        def _send_status(self, status: int, message: Optional[str] = None) -> None:
             body = (message or '').encode('utf-8')
             self.send_response(status)
             self.send_header('Content-Type', 'text/plain')
@@ -235,8 +227,10 @@ def _build_dpop_error(self) -> Optional[str]:
             auth_header = self.headers.get(_AUTHORIZATION_HEADER, '')
             dpop_header = self.headers.get(_DPOP_HEADER)
             # Issue a nonce if a DPoP token is presented or DPoP header exists.
-            if (_TOKEN_TYPE_DPOP in auth_header or dpop_header is not None) and oauth_server is not None:
-                    return oauth_server.generate_dpop_nonce()
+            if (
+                _TOKEN_TYPE_DPOP in auth_header or dpop_header is not None
+            ) and oauth_server is not None:
+                return oauth_server.generate_dpop_nonce()
             return None
 
         def _read_body(self) -> tuple[Optional[Any], Optional[str]]:
@@ -276,7 +270,9 @@ def _handle_oauth_authorize(self) -> None:
             client_id = _first_param(params, 'client_id')
             redirect_uri = _first_param(params, 'redirect_uri')
             code_challenge = _first_param(params, 'code_challenge')
-            code_challenge_method = _first_param(params, 'code_challenge_method') or 'S256'
+            code_challenge_method = (
+                _first_param(params, 'code_challenge_method') or 'S256'
+            )
             scope = _first_param(params, 'scope') or 'mcp'
             state = _first_param(params, 'state')
 
@@ -330,7 +326,10 @@ def _handle_oauth_token(self) -> None:
             except UnicodeDecodeError:
                 self._send_json(
                     400,
-                    {'error': 'invalid_request', 'error_description': 'invalid encoding'},
+                    {
+                        'error': 'invalid_request',
+                        'error_description': 'invalid encoding',
+                    },
                 )
                 return
             params = parse_qs(body)
@@ -354,7 +353,10 @@ def _handle_oauth_token(self) -> None:
             if not code:
                 self._send_json(
                     400,
-                    {'error': 'invalid_request', 'error_description': 'code is required'},
+                    {
+                        'error': 'invalid_request',
+                        'error_description': 'code is required',
+                    },
                 )
                 return
             if not code_verifier:
@@ -526,9 +528,7 @@ def _add_dpop_nonce(self, extra: dict[str, str]) -> None:
 
         def _add_dpop_nonce_to_response(self) -> None:
             if oauth_server is not None:
-                self.send_header(
-                    _DPOP_NONCE_HEADER, oauth_server.generate_dpop_nonce()
-                )
+                self.send_header(_DPOP_NONCE_HEADER, oauth_server.generate_dpop_nonce())
 
     return MCPHandler