ExMCP.Authorization.MetadataFetcher (ex_mcp v1.0.0-rc.8)

Copy Markdown View Source

Fail-closed HTTP fetch boundary for OAuth metadata documents.

Fetches use HTTPS by default, reject userinfo and fragments, resolve and validate every address on every hop, pin the connection to one approved public address, and follow only bounded same-origin redirects unless another exact HTTPS origin is explicitly allowed. Tests and local development may explicitly allow plain HTTP on loopback addresses. Requests carry fixed metadata headers and never inherit authorization, cookie, or application transport headers.

Summary

Types

fetch_error()
response()

Functions

fetch(url, opts \\ [])

Fetches one OAuth metadata document through the hardened network boundary.

validate_url(url, opts \\ [])

Validates the URL form accepted by the metadata fetch boundary.

Types

fetch_error()

@type fetch_error() :: {:metadata_fetch_error, atom()}

response()

@type response() :: %{
  status: pos_integer(),
  headers: [{String.t(), String.t()}],
  body: binary(),
  final_url: String.t()
}

Functions

fetch(url, opts \\ [])

@spec fetch(
  String.t(),
  keyword()
) :: {:ok, response()} | {:error, fetch_error()}

Fetches one OAuth metadata document through the hardened network boundary.

validate_url(url, opts \\ [])

@spec validate_url(
  String.t(),
  keyword()
) :: :ok | {:error, fetch_error()}

Validates the URL form accepted by the metadata fetch boundary.