Add TLS support for incoming MCP server connections#8
Conversation
📝 WalkthroughWalkthroughThis PR enables HTTPS support for the MCP Uvicorn server. A new ChangesTLS Server Support
🎯 2 (Simple) | ⏱️ ~10 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/rhos_ls_mcps/main.py`:
- Around line 112-118: When config.tls.ssl_ca_certs is provided we currently add
it to ssl_kwargs but never set ssl_cert_reqs, so mutual TLS is not enforced;
update the block that builds ssl_kwargs (the code that reads
config.tls.ssl_certfile, ssl_keyfile, ssl_keyfile_password, ssl_ca_certs) to
also set ssl_kwargs["ssl_cert_reqs"] = ssl.CERT_REQUIRED whenever
config.tls.ssl_ca_certs is present (import ssl if not already), ensuring that
ssl_ca_certs + ssl_cert_reqs=ssl.CERT_REQUIRED are both set to enable mTLS
enforcement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9795455a-7cd3-4ddc-aa00-469a1658b2a6
📒 Files selected for processing (3)
config.yaml.samplesrc/rhos_ls_mcps/main.pysrc/rhos_ls_mcps/settings.py
| if config.tls.ssl_certfile: | ||
| ssl_kwargs["ssl_certfile"] = config.tls.ssl_certfile | ||
| ssl_kwargs["ssl_keyfile"] = config.tls.ssl_keyfile | ||
| if config.tls.ssl_keyfile_password: | ||
| ssl_kwargs["ssl_keyfile_password"] = config.tls.ssl_keyfile_password | ||
| if config.tls.ssl_ca_certs: | ||
| ssl_kwargs["ssl_ca_certs"] = config.tls.ssl_ca_certs |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In current Uvicorn docs, does setting ssl_ca_certsalone enforce client certificate verification, or mustssl_cert_reqsalso be set (e.g.,ssl.CERT_REQUIRED)?
💡 Result:
Setting ssl_ca_certs alone does not enforce client certificate verification in current Uvicorn docs; you must also set ssl_cert_reqs (e.g., ssl.CERT_REQUIRED). Uvicorn’s settings documentation describes --ssl-cert-reqs as “Whether client certificate is required” and states the default is ssl.CERT_NONE, i.e., no client cert requirement [1]. The same documentation lists --ssl-ca-certs as the CA certificates file, but it does not say that providing CA certs changes the “required/optional/none” behavior on its own [1]. The Uvicorn CLI options ultimately map to Python’s SSLContext verify mode; ssl_cert_reqs controls ctx.verify_mode, while ssl_ca_certs is used to load trust roots for verification when verification is enabled [2]. Therefore, for mutual TLS enforcement (clients must present valid certificates), set both ssl_ca_certs and ssl_cert_reqs=ssl.CERT_REQUIRED [1][2].
Citations:
🏁 Script executed:
# Check the file exists and read the relevant section
wc -l src/rhos_ls_mcps/main.pyRepository: openstack-lightspeed/rhos-mcps
Length of output: 103
🏁 Script executed:
# Read the TLS configuration section around lines 112-118
sed -n '100,130p' src/rhos_ls_mcps/main.py | cat -nRepository: openstack-lightspeed/rhos-mcps
Length of output: 1496
🏁 Script executed:
# Check if ssl module is imported
grep -n "^import ssl\|^from ssl" src/rhos_ls_mcps/main.pyRepository: openstack-lightspeed/rhos-mcps
Length of output: 56
🏁 Script executed:
# Check if ssl_cert_reqs is set anywhere in the file
grep -n "ssl_cert_reqs" src/rhos_ls_mcps/main.pyRepository: openstack-lightspeed/rhos-mcps
Length of output: 56
mTLS is not actually enabled when only ssl_ca_certs is provided.
At line 118, CA certs are passed to the SSL configuration, but ssl_cert_reqs is never set. Without this, client certificates are not required or verified. According to Uvicorn's SSL documentation, ssl_cert_reqs controls whether client certificates are enforced (default is ssl.CERT_NONE); providing ssl_ca_certs alone does not change this behavior. Both ssl_ca_certs and ssl_cert_reqs=ssl.CERT_REQUIRED are required for mutual TLS enforcement.
🔧 Proposed fix
+import ssl
...
if config.tls.ssl_certfile:
ssl_kwargs["ssl_certfile"] = config.tls.ssl_certfile
ssl_kwargs["ssl_keyfile"] = config.tls.ssl_keyfile
if config.tls.ssl_keyfile_password:
ssl_kwargs["ssl_keyfile_password"] = config.tls.ssl_keyfile_password
if config.tls.ssl_ca_certs:
ssl_kwargs["ssl_ca_certs"] = config.tls.ssl_ca_certs
+ ssl_kwargs["ssl_cert_reqs"] = ssl.CERT_REQUIRED📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if config.tls.ssl_certfile: | |
| ssl_kwargs["ssl_certfile"] = config.tls.ssl_certfile | |
| ssl_kwargs["ssl_keyfile"] = config.tls.ssl_keyfile | |
| if config.tls.ssl_keyfile_password: | |
| ssl_kwargs["ssl_keyfile_password"] = config.tls.ssl_keyfile_password | |
| if config.tls.ssl_ca_certs: | |
| ssl_kwargs["ssl_ca_certs"] = config.tls.ssl_ca_certs | |
| if config.tls.ssl_certfile: | |
| ssl_kwargs["ssl_certfile"] = config.tls.ssl_certfile | |
| ssl_kwargs["ssl_keyfile"] = config.tls.ssl_keyfile | |
| if config.tls.ssl_keyfile_password: | |
| ssl_kwargs["ssl_keyfile_password"] = config.tls.ssl_keyfile_password | |
| if config.tls.ssl_ca_certs: | |
| ssl_kwargs["ssl_ca_certs"] = config.tls.ssl_ca_certs | |
| ssl_kwargs["ssl_cert_reqs"] = ssl.CERT_REQUIRED |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/rhos_ls_mcps/main.py` around lines 112 - 118, When
config.tls.ssl_ca_certs is provided we currently add it to ssl_kwargs but never
set ssl_cert_reqs, so mutual TLS is not enforced; update the block that builds
ssl_kwargs (the code that reads config.tls.ssl_certfile, ssl_keyfile,
ssl_keyfile_password, ssl_ca_certs) to also set ssl_kwargs["ssl_cert_reqs"] =
ssl.CERT_REQUIRED whenever config.tls.ssl_ca_certs is present (import ssl if not
already), ensuring that ssl_ca_certs + ssl_cert_reqs=ssl.CERT_REQUIRED are both
set to enable mTLS enforcement.
There was a problem hiding this comment.
@dprince can you please resolve this comment please? You either accept the proposal by the AI or not in such a case you have to provide an explanation (and close the comment). We follow the rule that CodeRabbit comments need to be addressed first before human review.
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
2 participants
Summary by CodeRabbit