Skip to content

fix(mcp): make remote /api/v1/mcp data plane work for external agents#2309

Merged
os-zhuang merged 2 commits into
mainfrom
fix/mcp-dataplane-auth
Jun 24, 2026
Merged

fix(mcp): make remote /api/v1/mcp data plane work for external agents#2309
os-zhuang merged 2 commits into
mainfrom
fix/mcp-dataplane-auth

harden api-key scheme regexes against polynomial backtracking

59a0e3c
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL failed Jun 24, 2026 in 3s

1 new alert including 1 high severity security vulnerability

New alerts in code changed by this pull request

Security Alerts:

  • 1 high

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 42 in packages/core/src/security/api-key.ts

See this annotation in the file changed.

Code scanning / CodeQL

Use of password hash with insufficient computational effort High

Password from
a call to generateApiKey
Loading
is hashed insecurely.
Password from an access to API_KEY_PREFIX is hashed insecurely.
Password from a call to readHeader is hashed insecurely.
Password from an access to apiKeyScheme is hashed insecurely.
Password from a call to extractApiKey is hashed insecurely.
Password from an access to apiKey is hashed insecurely.
Password from an access to RAW_API_KEY is hashed insecurely.
Password from a call to generateApiKey is hashed insecurely.