mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
a605c0aa79
host_header made the contract test send the public vhost as Host, and web-app-wordpress was the only role in the repo carrying the flag. Under an onion deployment home_url() is http, so the mu-plugin's https short circuit does not fire and the filter falls through to comparing HTTP_HOST against WORDPRESS_INTERNAL_HOST. That comparison sees the onion vhost and the service name, never matches, application passwords stay unavailable, core never validates the credential, and the transport guard answers 401. Clearnet hid the defect because the first branch returned before the comparison was ever reached. Reproduced in three jobs across two repositories, both deploy modes and three distributions, each with the same line: REJECTED authenticated initialize answered 401 infinito_mcp_unauthorized. The split measured in the job logs is https://blog.infinito.test against http://blog.<onion>. The route without the spoof is already proven in the same failing job. hermes reports [OK] web-app-wordpress and openclaw reads 3 tools, resources, prompts, both against "url": "http://wordpress:80/wp-json/mcp/mcp-adapter-default-server". WordPress serves the REST MCP route under Host: wordpress, and the filter branchb260cc5604added is what lets them through. This completes5e810c4a5a, which dropped both spoofed headers for Moodle and moved the accommodation to the provider.b260cc5604did the provider side for WordPress and removed X-Forwarded-Proto but left the Host spoof standing, so the test stayed green on a route no client uses while every client was refused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
36 lines
810 B
YAML
36 lines
810 B
YAML
---
|
|
classification: plugin_server
|
|
direction: server
|
|
source_url: https://github.com/WordPress/mcp-adapter/tree/v0.5.0
|
|
transport: streamable_http
|
|
exposure: public
|
|
auth: basic_auth
|
|
auth_subject: service_account
|
|
implementation: plugin
|
|
credential:
|
|
owner: mcp-web-app-wordpress
|
|
source: token_store
|
|
key: web-app-wordpress
|
|
endpoint:
|
|
service_key: wordpress
|
|
path: /wp-json/mcp/mcp-adapter-default-server
|
|
port_key: http
|
|
limits:
|
|
request_bytes: 65536
|
|
response_bytes: 1048576
|
|
timeout_seconds: 15
|
|
concurrent_requests: 4
|
|
page_size: 20
|
|
result_items: 20
|
|
stream_seconds: 300
|
|
tools:
|
|
read_probe:
|
|
tool: infinito-list-categories
|
|
arguments: {}
|
|
allowlist:
|
|
- infinito-get-post
|
|
- infinito-list-categories
|
|
- infinito-search-posts
|
|
read_only_default: true
|
|
mutating_tools_enabled: false
|