Add generic PrefixHandlers to transport config #3524
Merged
+503
−29
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add support for mounting custom HTTP handlers at specific path prefixes on the transparent proxy. This enables integrating additional endpoints (like OAuth authorization server routes) alongside the MCP proxy. Key changes: - Add PrefixHandlers field to transport Config struct - Update HTTPTransport and TransparentProxy to accept and mount prefix handlers - Refactor Start() handler mounting order for clarity: 1. Prefix handlers (user-specified, most specific) 2. Health check endpoint 3. Prometheus metrics endpoint 4. RFC 9728 OAuth discovery endpoint (now at specific paths) 5. Catch-all proxy handler The RFC 9728 .well-known endpoint is now mounted at specific paths (/.well-known/oauth-protected-resource) instead of a wildcard, allowing prefix handlers to register other well-known paths like /.well-known/oauth-authorization-server for auth server integration. Add comprehensive tests for prefix handler mounting and routing.
tgrunnagle
requested review from
ChrisJBurns,
JAORMX,
amirejaz,
blkt,
dmjb,
eleftherias,
jhrozek,
lujunsan,
rdimitrov and
yrobla
as code owners
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #3524 +/- ##
==========================================
+ Coverage 65.30% 65.34% +0.04%
==========================================
Files 401 401
Lines 39103 39111 +8
==========================================
+ Hits 25535 25558 +23
+ Misses 11584 11575 -9
+ Partials 1984 1978 -6 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
jhrozek
approved these changes
Jan 29, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a generic
PrefixHandlerscapability to the transport layer, enabling components to mount HTTP handlers at specific path prefixes on the proxy's HTTP server. This is a foundational change that enables the embedded authorization server (RFC-0031) to register OAuth2/OIDC endpoints alongside MCP proxy traffic without requiring transport-specific code changes.Why
The embedded authorization server integration requires mounting OAuth endpoints (e.g.,
/oauth/*,/.well-known/oauth-authorization-server) on the same HTTP server that handles MCP proxy traffic. Rather than coupling the transport layer to the auth server, this PR introduces a generic route-mounting mechanism that keeps the transport package agnostic to handler types while enabling flexible route composition.Changes
PrefixHandlersfield intypes.Config- a map of path prefixes to HTTP handlersPrefixHandlersflows throughFactory.Create()→HTTPTransport→TransparentProxyTransparentProxy.Start()- prefix handlers are mounted before the catch-all proxy handler, relying on Go's ServeMux longest-match routing for correct precedence/.well-known/oauth-protected-resource) instead of the entire/.well-known/prefix, allowing prefix handlers to register other well-known endpointsRelated