镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

feat(mcp): port the blueprint content-validator to Rust - #1499

Open
GirlBossRush wants to merge 2 commits into
mainfrom
mcp/blueprint-validator
Open

GirlBossRush wants to merge 2 commits into
mainfrom
mcp/blueprint-validator

Conversation

@GirlBossRush

@GirlBossRush GirlBossRush commented Sep 11, 2026 •

Copy link
Copy Markdown
Contributor

This PR is ported from the marketplace code-mode validator with its conformance corpus.

  • Tag-preserving AST over saphyr-parser; three-model allow-list: forced/capped/ref attribute bins, !Find, !KeyOf-only tag walk, secret fields denied.
  • blueprint-apply is basically superuser so the guard does content validation instead of RBAC

@codecov

codecov Bot commented Sep 11, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.76923% with 114 lines in your changes missing coverage. Please review.
✅ Project coverage is 52.48%. Comparing base (dbc4fed) to head (c7521b8).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
ak-cli/src/mcp/blueprint/yaml.rs 77.02% 47 Missing and 4 partials ⚠️
ak-cli/src/mcp/blueprint/validate.rs 91.31% 17 Missing and 22 partials ⚠️
ak-cli/src/mcp/blueprint/tags.rs 92.30% 13 Missing and 1 partial ⚠️
ak-cli/src/mcp/blueprint/duration.rs 90.24% 1 Missing and 7 partials ⚠️
ak-cli/src/mcp/blueprint/refs.rs 98.94% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1499      +/-   ##
==========================================
+ Coverage   50.10%   52.48%   +2.38%     
==========================================
  Files         195      201       +6     
  Lines       19844    21079    +1235     
  Branches    15020    16255    +1235     
==========================================
+ Hits         9943    11064    +1121     
- Misses       9576     9656      +80     
- Partials      325      359      +34     
Flag Coverage Δ
rs-e2e-24.04 33.57% <0.00%> (-1.73%) ⬇️
rs-e2e-25.10 10.37% <0.00%> (?)
rs-e2e-26.04 10.38% <0.00%> (-0.54%) ⬇️
rs-macos-26-ak-agent 31.81% <ø> (ø)
rs-macos-26-ak-agent-desktop 0.00% <ø> (ø)
rs-macos-26-ak-api-cli 100.00% <ø> (ø)
rs-macos-26-ak-api-cli-gen 66.71% <ø> (ø)
rs-macos-26-ak-browser-support 23.93% <ø> (ø)
rs-macos-26-ak-cli 58.25% <90.76%> (+33.97%) ⬆️
rs-macos-26-ak-flow-executor 13.62% <ø> (ø)
rs-macos-26-ak-meta 0.00% <ø> (ø)
rs-macos-26-ak-meta-macros 0.00% <ø> (ø)
rs-macos-26-ak-platform 66.68% <ø> (ø)
rs-macos-26-ak-platform-authz 0.00% <ø> (ø)
rs-macos-26-ak-platform-facts 83.44% <ø> (ø)
rs-macos-26-ak-platform-keyring 66.45% <ø> (ø)
rs-macos-26-ak-sysd 33.87% <ø> (ø)
rs-ubuntu-24.04-ak-agent 31.81% <ø> (ø)
rs-ubuntu-24.04-ak-agent-desktop 0.00% <ø> (ø)
rs-ubuntu-24.04-ak-api-cli 100.00% <ø> (ø)
rs-ubuntu-24.04-ak-api-cli-gen 66.71% <ø> (ø)
rs-ubuntu-24.04-ak-browser-support 23.93% <ø> (ø)
rs-ubuntu-24.04-ak-cli 58.25% <90.76%> (+33.97%) ⬆️
rs-ubuntu-24.04-ak-flow-executor 13.62% <ø> (ø)
rs-ubuntu-24.04-ak-meta 0.00% <ø> (ø)
rs-ubuntu-24.04-ak-meta-macros 0.00% <ø> (ø)
rs-ubuntu-24.04-ak-nss 77.37% <ø> (ø)
rs-ubuntu-24.04-ak-pam 0.00% <ø> (ø)
rs-ubuntu-24.04-ak-platform 65.98% <ø> (ø)
rs-ubuntu-24.04-ak-platform-authz 0.00% <ø> (ø)
rs-ubuntu-24.04-ak-platform-facts 82.64% <ø> (ø)
rs-ubuntu-24.04-ak-platform-keyring 53.33% <ø> (ø)
rs-ubuntu-24.04-ak-sysd 34.09% <ø> (ø)
rs-ubuntu-24.04-arm-ak-agent 29.64% <ø> (-2.18%) ⬇️
rs-ubuntu-24.04-arm-ak-agent-desktop 0.00% <ø> (ø)
rs-ubuntu-24.04-arm-ak-api-cli 100.00% <ø> (ø)
rs-ubuntu-24.04-arm-ak-api-cli-gen 66.71% <ø> (ø)
rs-ubuntu-24.04-arm-ak-browser-support 23.93% <ø> (ø)
rs-ubuntu-24.04-arm-ak-cli 58.25% <90.76%> (+33.97%) ⬆️
rs-ubuntu-24.04-arm-ak-flow-executor 13.62% <ø> (ø)
rs-ubuntu-24.04-arm-ak-meta 0.00% <ø> (ø)
rs-ubuntu-24.04-arm-ak-meta-macros 0.00% <ø> (ø)
rs-ubuntu-24.04-arm-ak-nss 77.37% <ø> (ø)
rs-ubuntu-24.04-arm-ak-pam 0.00% <ø> (ø)
rs-ubuntu-24.04-arm-ak-platform 65.98% <ø> (ø)
rs-ubuntu-24.04-arm-ak-platform-authz 0.00% <ø> (ø)
rs-ubuntu-24.04-arm-ak-platform-facts 82.64% <ø> (ø)
rs-ubuntu-24.04-arm-ak-platform-keyring 53.33% <ø> (ø)
rs-ubuntu-24.04-arm-ak-sysd 34.09% <ø> (ø)
rs-windows-2025-ak-agent 31.81% <ø> (ø)
rs-windows-2025-ak-agent-desktop 0.00% <ø> (ø)
rs-windows-2025-ak-api-cli 100.00% <ø> (ø)
rs-windows-2025-ak-api-cli-gen 66.71% <ø> (ø)
rs-windows-2025-ak-browser-support 23.93% <ø> (ø)
rs-windows-2025-ak-cli 58.25% <90.76%> (+33.97%) ⬆️
rs-windows-2025-ak-flow-executor 13.62% <ø> (ø)
rs-windows-2025-ak-meta 0.00% <ø> (ø)
rs-windows-2025-ak-meta-macros 0.00% <ø> (ø)
rs-windows-2025-ak-platform 58.00% <ø> (ø)
rs-windows-2025-ak-platform-authz 0.00% <ø> (ø)
rs-windows-2025-ak-platform-facts 78.66% <ø> (ø)
rs-windows-2025-ak-platform-keyring 76.51% <ø> (ø)
rs-windows-2025-ak-sysd 32.36% <ø> (ø)
rs-windows-2025-ee/wcp 46.50% <ø> (+0.02%) ⬆️
swift 3.23% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@GirlBossRush
GirlBossRush force-pushed the mcp/blueprint-validator branch 2 times, most recently from d6d6d2f to ada34fa Compare September 11, 2026 15:40
@authentik-automation

Copy link
Copy Markdown
Contributor

🚀 Deployed on https://pr-1499--authentik-pkg.netlify.app

@authentik-automation
authentik-automation Bot temporarily deployed to pull request September 11, 2026 16:16 Inactive
@BeryJu
BeryJu force-pushed the mcp/blueprint-validator branch from ada34fa to e0b420e Compare September 15, 2026 23:38
@authentik-automation
authentik-automation Bot temporarily deployed to pull request September 16, 2026 00:19 Inactive
Base automatically changed from mcp/housekeeping to main September 16, 2026 00:25
A default-deny gate over a proposed blueprint, ported faithfully from the marketplace code-mode validator with its full conformance corpus (74 tests). Tag-preserving AST over saphyr-parser; three-model allow-list, forced/capped/ref attribute bins, !Find/!KeyOf-only tag walk, secret fields denied. Never applies and never panics.

This is the control-plane boundary for the unified agent MCP: blueprint-apply is superuser-equivalent, so the guard must be content validation, not RBAC.
@BeryJu
BeryJu force-pushed the mcp/blueprint-validator branch from e0b420e to c7521b8 Compare September 16, 2026 00:25
@authentik-automation
authentik-automation Bot temporarily deployed to pull request September 16, 2026 00:50 Inactive

This branch was previously deployed

1 inactive deployment
pull request — c7521b86 Deployed Sep 16, 2026 by authentik-automation[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant