◈ Drawn by PR Lens, free for open source
fix(devframe): authenticate HTTP MCP requests
devframes/devframe #327
Architecture
Open full size
Container view — Architecture Overview
Overview of client gateways, framework hosts, hub orchestration, and core devframe instances.
CLIENT RUNTIMES & UI
FRAMEWORK KITS & HOSTS
HUB ORCHESTRATION
DEVFRAME CORE ENGINE
{ }
Browser RPC Client
{ }
CLI Connect Gateway
CHANGED
Next.js Reference Hu…
CHANGED
Vite Framework Kit
Next.js Framework Kit
CHANGED
{ }
Hub Dock Subsystem
{ }
Hub Terminals Subsy…
{ }
Hub Messages Subsy…
{ }
Hub Commands Subs…
Hub Core & Lifecycle
CHANGED
Single-Tool Instance Shell
CHANGED
MCP Fetch Handler & Auth Gate
CHANGED
Streamable-HTTP with origin & bearer header
RPC transport
bridges hub instance
bridges devframe instance
delegates hub routes with opt-in MCP
delegates devframe handler
mounts host MCP handler
imports Next.js hub kit
mounts frames & checks MCP config
mounts aggregate /__mcp route
mounts with resolved auth policy
Data flow
Open full size
Authenticating and executing an MCP request
Adds opt-in bearer token and custom callback authorization on top of the loopback origin gate for Streamable-HTTP MCP routes across devframe instances, aggregate hubs, and Next.js host kits. The CLI connect client resolves credentials securely from DEVFRAME_MCP_AUTH_TOKEN while keeping tokens out of URLs and instance registry records, and hub initiation warns via DF8005 when a mounted devframe requests an MCP route while hub-level MCP is disabled.
{ }
CLI Connect Gateway
CHANGED
MCP Fetch Handler & Auth Gate
CHANGED
Single-Tool Instance Shell
CHANGED
POST /__mcp with Origin and Authorization: Bearer <token>
Validate Origin gate, then verify bearer token in constant time
Dispatch tool execution to registered context handler
Return tool execution result payload
200 OK with JSON-RPC response
View the pull request on GitHub
fix(devframe): authenticate HTTP MCP requests