feat: MCP UI proxy to goose-server #5749
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR migrates the MCP UI proxy functionality from a local Electron-managed HTTP server to a centralized endpoint on the goose-server. The changes remove complex client-side proxy security infrastructure (token generation, header injection, WebContents whitelisting) in favor of a simpler server-side implementation.
Key changes:
- Removes local proxy server initialization and IPC handlers from the Electron desktop app
- Updates the MCP UI renderer to fetch proxy URL from goose-server instead of Electron main process
- Adds
/mcp-ui-proxyendpoint to goose-server with auth bypass
Reviewed Changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| ui/desktop/src/preload.ts | Removes getMcpUIProxyUrl IPC API definition |
| ui/desktop/src/main.ts | Removes proxy initialization call |
| ui/desktop/src/components/MCPUIResourceRenderer.tsx | Updates to construct proxy URL from goosed host/port |
| ui/desktop/src/api/types.gen.ts | Generated TypeScript types for new endpoint |
| ui/desktop/src/api/sdk.gen.ts | Generated SDK client for new endpoint |
| ui/desktop/openapi.json | OpenAPI schema update for new endpoint |
| crates/goose-server/src/routes/mod.rs | Registers new mcp_ui_proxy route module |
| crates/goose-server/src/openapi.rs | Registers new endpoint in OpenAPI docs |
| crates/goose-server/src/auth.rs | Bypasses authentication for /mcp-ui-proxy |
| pub mod audio; | ||
| pub mod config_management; | ||
| pub mod errors; | ||
| pub mod mcp_ui_proxy; |
There was a problem hiding this comment.
The mcp_ui_proxy.rs module file doesn't exist yet. This will cause a compilation error.
| next: Next, | ||
| ) -> Result<Response, StatusCode> { | ||
| if request.uri().path() == "/status" { | ||
| if request.uri().path() == "/status" || request.uri().path() == "/mcp-ui-proxy" { |
There was a problem hiding this comment.
Bypassing authentication for /mcp-ui-proxy removes the security protections from the original implementation (token validation, origin checks, WebContents whitelisting). This allows unauthenticated access to MCP UI resources. Consider requiring the X-Secret-Key header or document why this endpoint must be public.
| if request.uri().path() == "/status" || request.uri().path() == "/mcp-ui-proxy" { | |
| if request.uri().path() == "/status" { |
alexhancock
force-pushed
the
feat/mcp-ui-improvements-rust-server-goosed
branch
from
5d2cd63 to
a7770d0
Compare
@aharvard Draft of moving it. Not complete yet.