docs(spec): spec 089 remote-access-tunnel (feature-flagged MVP) + roadmap epic - #924
Merged
Conversation
…dmap epic Spec for one-button remote exposure of the local /mcp endpoint via an external tunnel binary (cloudflared quick tunnel first) so Claude custom connectors (all tiers incl. Free, synced to iOS/Android) can reach local MCP servers such as Obsidian MCP. Hard requirements: entire feature behind a config feature flag (default off, zero behavior change when off), tunnel never auto-starts, mandatory OAuth 2.1 + PKCE + DCR gate with audience-bound tokens and an unspoofable tunnel ingress boundary, per-server exposure allowlist covering the full MCP capability surface, remote-origin activity logging with redaction. Also: - docs/research/remote-access-tunnel-research-2026-07-29.html: deep-research report backing the spec (25/25 claims adversarially verified) - roadmap.yaml/ROADMAP.md: epic remote-access-tunnel, P2 (normal), depends_on tpa-db + ux-audit + analytics-dashboard per owner decision 2026-07-29; 4 child tasks (oauth-gate, orchestration, allowlist, UI) Cross-model review: Codex, 3 rounds (6 P1 + 9 P2 findings fixed) -> CLEAN. ## Testing - python3 scripts/gen-roadmap.py regenerates ROADMAP.md cleanly (25 epics) - spec-only change; no code paths touched
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 30428948399 --repo smart-mcp-proxy/mcpproxy-go
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Spec-only PR: feature specification for remote access tunnel (spec 089) plus the backing research report and a roadmap epic.
/mcpendpoint via an external tunnel binary (cloudflared quick tunnel first) so Claude custom connectors (all plan tiers incl. Free, synced to iOS/Android) can reach local MCP servers such as Obsidian MCP.docs/research/remote-access-tunnel-research-2026-07-29.html— deep-research run, 25/25 claims adversarially verified (Claude connector requirements, exposed-MCP incident data, NSA/Trend Micro guidance, competitor gap).remote-access-tunnel, priority P2 (normal),depends_on: [tpa-db, ux-audit, analytics-dashboard]per owner decision 2026-07-29; out of scope for MVP: hosted relay, payments, P2P.Review
Cross-model review (Codex): 3 rounds — 6 P1 + 9 P2 findings fixed (OAuth bootstrap surface, ingress trust boundary, full-MCP-surface allowlist, redirect-URI validation, token audience-binding vs URL churn, logging redaction) → round 3 CLEAN. Details in
specs/089-remote-access-tunnel/checklists/requirements.md.Testing
python3 scripts/gen-roadmap.pyregeneratesROADMAP.mdcleanly (pre-commit hook verified).