Hiddenden/familiar
5
0 Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

feat: serve familiar as a remote HTTP MCP server (bearer auth) #63

Merged
Latte merged 3 commits from feat/remote-http into dev 2026-07-04 16:46:14 +00:00
Conversation 0 Commits 3 Files Changed 12
+532 -11
3 Commits
Author SHA1 Message Date
Latte ceb907b2fe docs: document the remote-HTTP serve mode, env vars, nginx and Mistral setup
CI / lint (pull_request) Successful in 51s
Details
CI / test (pull_request) Successful in 58s
Details
CI / publish (pull_request) Has been skipped
Details 
- README + getting-started: a "Serve over HTTPS (remote MCP)" section with the
  `familiar serve` command, the FAMILIAR_HTTP_* env vars, the write-off-by-
  default note, an nginx location block (proxy_buffering off, long read
  timeout), the headless-login / copy-the-store options, and the steps to add
  it as a Mistral custom connector.
- architecture: describe the stdio/HTTP transport split, the bearer-auth gate,
  and the HTTP write default.
- CLAUDE.md: add the new commands and env vars to Commands + Architecture.
 2026-07-04 18:22:09 +02:00
Latte 44b2dbac0c test(serve): cover HTTP bearer auth, start refusal, config, write default, headless login 
- 401 without/with a bad token (incl. WWW-Authenticate: Bearer), 200 with a
  valid one, driven through the ASGI app in-process.
- configure_http refuses to start when the token is unset or blank.
- FAMILIAR_HTTP_* config defaults and overrides; http_token() strip/empty.
- HTTP write default disabled by default, env still wins, stdio stays enabled.
- parse_callback (URL / bare code / empty) and the manual_login exchange flow.
 2026-07-04 18:22:01 +02:00
Latte 458e31685f feat(serve): opt-in HTTP transport with bearer auth + headless login 
Add a `familiar serve` subcommand that runs the FastMCP streamable-HTTP
transport for use as a remote MCP server (e.g. a Mistral custom connector),
while stdio stays the default and is completely unchanged.

- config: FAMILIAR_HTTP_HOST/PORT/PATH (default 127.0.0.1:8080/mcp) and a
  live http_token() reader for FAMILIAR_HTTP_TOKEN.
- server: configure_http()/serve_http() attach a StaticTokenVerifier so a
  missing/wrong bearer token gets 401 + WWW-Authenticate: Bearer and a valid
  one passes the handshake. Refuses to start (SystemExit) without a token.
- writes: in HTTP mode the write default flips to disabled unless
  FAMILIAR_ENABLE_WRITES is explicitly truthy; guard() logic is untouched.
- auth: manual_login() + parse_callback() power `login --no-browser`, printing
  the SSO URL and reading the pasted callback from stdin (no local browser).
- bump fastmcp pin to >=3.0.0 for the streamable-HTTP + verifier API.
 2026-07-04 18:20:59 +02:00