ji ruo 0a0158a4ab feat(mcp): add a source allowlist for the MCP server endpoint ...

Restrict which source addresses may call /mcp with a list of IPs/CIDRs
(IPv4 and IPv6). The check runs before token authentication, so a source
that is not listed is refused with 403 even when it holds a valid token.
An empty list keeps the previous behaviour (any source).

Behind a reverse proxy the TCP peer is always the proxy, so proxies can be
registered as trusted: for requests from them the client is the rightmost
X-Forwarded-For hop that is not itself a trusted proxy. Without a trusted
proxy the header is ignored, so a caller cannot claim an allowed address.

- A stored configuration that cannot be read or parsed refuses requests
  instead of falling back to no restriction.
- The audit log records the resolved client address.
- The settings API reports the address the server sees for the caller.
- The allowlist applies to /mcp only; the web UI and admin API are
  unaffected.

Refs RuoJi6/ARTEX#144

2026-11-14 14:32:39 +08:00

..

assembly_test.go

feat: 任务/模板备注展示与 Worker 运行数量配置（Codex gpt-6-astra 重写）

2026-10-24 21:46:03 +08:00

assembly.go

feat: event-driven credential processing conversations

2026-10-30 09:18:31 +08:00

asset_intercept.go

feat: 新增资产拦截规则（全局黑名单）增删改查

2026-09-19 07:58:23 -04:00

assets_scope_test.go

feat(assets): 去掉企业资产范围 256 条规则上限

2026-08-31 11:22:34 -04:00

assets.go

feat(assets): 任务测试资产支持 DSL 搜索

2026-09-11 11:59:46 -04:00

auth_test.go

fix bug

2026-10-07 07:45:28 -04:00

auth.go

feat: add English interface localization and fix preview crashes

2026-11-10 20:03:14 +08:00

auto_title_test.go

fix: 自动标题取消语义、清洗循环与拒绝占位回写

2026-10-27 13:07:09 +08:00

basic_auth_test.go

fix: recover expired Basic Auth sessions in the current tab

2026-11-10 16:28:23 +08:00

basic_auth.go

Merge pull request #131 from RuoJi6/codex/english-i18n

2026-11-10 20:12:16 +08:00

broadcast.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

calendar_schedule_manual_test.go

fix: preserve manual task starts outside schedule windows

2026-10-19 15:09:17 +08:00

calendar_schedule_startup_test.go

fix: avoid skipping calendar windows that open after startup (#16)

2026-10-19 08:57:50 +08:00

calendar_schedule_test.go

支持计划任务日期范围

2026-10-09 23:50:05 +08:00

calendar_schedule.go

fix: 收紧代理故障判定并修复自动恢复门控/日历/终态问题

2026-10-31 16:23:28 +08:00

chat_llm_resolve_test.go

fix(chat): 会话已选 LLM 时不再被「全局未激活」误拦，提示按状态细分

2026-08-24 11:55:50 -04:00

chat_mentions_test.go

feat: add English interface localization and fix preview crashes

2026-11-10 20:03:14 +08:00

chat_mentions.go

feat: add English interface localization and fix preview crashes

2026-11-10 20:03:14 +08:00

chatupload.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

commands.go

chore: sync upstream v0.3.6 changes

2026-08-28 14:03:07 +08:00

constraints_api.go

同步

2026-08-24 14:14:15 +08:00

conversation_status_test.go

feat: 支持会话级漏洞复测与运行状态展示

2026-09-10 16:06:08 +08:00

conversations.go

feat: 接入 Jev 拦截判定模型

2026-10-31 15:56:02 +08:00

core_test.go

feat(api): integrate task workflows and mock contracts

2026-08-24 19:31:16 +08:00

credentials_test.go

feat: add optional credential processing with dependent switches and traffic evidence

2026-10-20 13:01:03 +08:00

credentials.go

feat: event-driven credential processing conversations

2026-10-30 09:18:31 +08:00

customtool_test.go

fix(tools): MCP/自定义工具输出统一走 Capture 截断，修复 mcp 截断不生效 (#176)

2026-09-29 10:09:23 -04:00

customtool.go

Merge pull request #107 from RuoJi6/feat/proxy-pool

2026-11-02 15:45:28 +08:00

dto.go

feat(tasks): stop tasks that miss a configurable findings checkpoint

2026-11-11 14:07:39 +08:00

egress_probe_settings_test.go

fix: persist custom egress IP probe service (#118)

2026-11-05 16:00:07 +08:00

egress_probe_test.go

security: harden egress probe from PR56

2026-10-27 01:32:45 -07:00

egress_probe.go

feat: add English interface localization and fix preview crashes

2026-11-10 20:03:14 +08:00

engine_cancelcause_test.go

feat(tasks): stop tasks that miss a configurable findings checkpoint

2026-11-11 14:07:39 +08:00

engine_emptyturn_test.go

fix(agent): 空转回合注入续跑指令，复用空响应重试次数

2026-09-10 10:49:11 -04:00

engine_llm_calls_test.go

feat(llm): add profile failover and pool health

2026-08-24 19:28:18 +08:00

engine_no_result_test.go

feat(tasks): stop tasks that miss a configurable findings checkpoint

2026-11-11 14:07:39 +08:00

engine_timeout.go

fix(tasks): serialize no-result decisions with finding writes

2026-11-11 15:20:58 +08:00

engine_worker_test.go

Merge main and preserve task worker overrides with model pools

2026-10-26 09:36:03 +08:00

engine.go

fix: 代理暂停归入任务暂停语义并为所有成功路径加轮次门控

2026-10-31 19:30:38 +08:00

file_content.go

feat(tasks): add read-only task file browser (GITHUB-3)

2026-11-11 14:14:37 +08:00

finding_case_reviews_test.go

fix(findings): address Grok review r2 server batch (Codex gpt-6.1-sol)

2026-10-24 23:17:26 +08:00

finding_case_reviews.go

fix(findings): address Grok review r2 server batch (Codex gpt-6.1-sol)

2026-10-24 23:17:26 +08:00

finding_cases_export.go

feat(findings): consolidate duplicate reports into expandable cases

2026-10-09 10:43:53 +08:00

finding_cases_test.go

fix(findings): address Grok review r3 — preserve tool bindings on v3 refresh (Codex gpt-6.1-sol)

2026-10-24 23:37:58 +08:00

finding_cases.go

fix(findings): address Grok review r3 — preserve tool bindings on v3 refresh (Codex gpt-6.1-sol)

2026-10-24 23:37:58 +08:00

finding_report.go

feat: 复用漏洞报告撰写对话

2026-10-30 12:19:43 +08:00

finding_retests_test.go

feat: 支持会话级漏洞复测与运行状态展示

2026-09-10 16:06:08 +08:00

finding_retests.go

feat: 支持会话级漏洞复测与运行状态展示

2026-09-10 16:06:08 +08:00

finding_traffic_export.go

feat: improve finding reports and evidence exports

2026-10-29 01:25:32 +08:00

finding_traffic_test.go

Merge origin/main into codex/btw-side-question

2026-09-11 00:54:51 +08:00

finding_traffic.go

fix: 修复合并后审查发现的 6 个中/高问题

2026-09-10 10:15:24 -04:00

finding_workflow_test.go

fix(traffic): match recorded hosts with port-aware search (#114)

2026-09-15 00:43:20 +08:00

finding_workflow.go

fix(findings): protect historical reports and verify consolidation results

2026-10-09 12:23:11 +08:00

findings_filtered_stats_test.go

feat: expose traffic IDs and filter finding statistics

2026-11-09 16:11:15 +08:00

findings_groups_test.go

fix(tasks): serialize no-result decisions with finding writes

2026-11-11 15:20:58 +08:00

findings_groups.go

fix(tasks): serialize no-result decisions with finding writes

2026-11-11 15:20:58 +08:00

findings_time_sort_test.go

fix(web): restore chronological sorting in task findings

2026-10-27 14:25:36 +08:00

forward_proxy.go

Merge pull request #107 from RuoJi6/feat/proxy-pool

2026-11-02 15:45:28 +08:00

goals_api.go

同步

2026-08-24 14:14:15 +08:00

goals_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

goals.go

feat(tasks): stop tasks that miss a configurable findings checkpoint

2026-11-11 14:07:39 +08:00

health_test.go

fix: require Basic Auth for health checks

2026-11-03 14:56:39 +08:00

inheritance_api_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

inheritance_dto_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

intelligence_test.go

feat: Agent 任务名与对话标题双能力自动生成

2026-10-27 12:33:53 +08:00

intelligence.go

feat: add optional task intelligence recording and views

2026-10-20 11:16:04 +08:00

intent_intervention.go

feat(chat): 支持多类型记录 @ 引用及滚动分页 (#135)

2026-09-16 22:36:07 +08:00

intercept_config_test.go

fix: address Jev judge review feedback

2026-10-31 18:16:49 +08:00

intercept_detail_test.go

精简动作审查输入并支持审批来源定位 (#125)

2026-09-15 23:51:37 +08:00

intercept_filter_test.go

fix: avoid false script snapshot reviews

2026-10-12 17:31:33 +08:00

intercept_live_test.go

精简动作审查输入并支持审批来源定位 (#125)

2026-09-15 23:51:37 +08:00

intercept_review_test.go

feat: expose scripts to review and add approval side chat

2026-10-12 11:06:38 +08:00

intercept.go

fix: address Jev judge review feedback

2026-10-31 18:16:49 +08:00

jev_models_test.go

fix: align Jev integration with official System One protocol

2026-11-03 15:53:24 +08:00

llmpool_test.go

feat(llm): add profile failover and pool health

2026-08-24 19:28:18 +08:00

llmpool.go

feat(llm): add profile failover and pool health

2026-08-24 19:28:18 +08:00

llmrec_raw_test.go

feat(llmrec): 录制 LLM 请求/响应 HTTP 原文

2026-08-25 09:40:05 -04:00

llmretry_test.go

feat(llm): 五层重试的次数与间隔可配

2026-09-09 13:35:04 -04:00

llmretry.go

fix(agent): 空转回合注入续跑指令，复用空响应重试次数

2026-09-10 10:49:11 -04:00

logsink.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

manager_delete_files_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

manager_lifecycle_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

manager.go

feat(tasks): stop tasks that miss a configurable findings checkpoint

2026-11-11 14:07:39 +08:00

mcp_server_access.go

feat(mcp): add a source allowlist for the MCP server endpoint

2026-11-14 14:32:39 +08:00

mcp_server_test.go

feat(mcp): add a source allowlist for the MCP server endpoint

2026-11-14 14:32:39 +08:00

mcp_server_tools.go

feat(mcp): expose ARTEX as an MCP server for external agents

2026-11-14 14:08:07 +08:00

mcp_server.go

feat(mcp): add a source allowlist for the MCP server endpoint

2026-11-14 14:32:39 +08:00

mcpdiscover.go

feat: support legacy SSE MCP servers (#117)

2026-09-15 00:56:16 +08:00

mgmt_test.go

fix(security): jwt.key 移出可浏览工作区(存项目根,自动从 data 迁移)

2026-08-11 10:56:39 -04:00

notifier.go

fix(notify): 汇总模式按消息计量限流，批次大小不再被每轮请求预算掐死

2026-10-01 06:43:29 -04:00

notify_api_test.go

fix(notify): 汇总模式按消息计量限流，批次大小不再被每轮请求预算掐死

2026-10-01 06:43:29 -04:00

notify_api.go

fix(notify): 安全审计修复 —— 掩码绕过、SSRF、静默丢失等 12 项

2026-09-30 16:25:06 +08:00

orchestration.go

feat(tasks): stop tasks that miss a configurable findings checkpoint

2026-11-11 14:07:39 +08:00

platform_tools_test.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

platform_tools.go

feat: support legacy SSE MCP servers (#117)

2026-09-15 00:56:16 +08:00

product_errors_test.go

feat: add English interface localization and fix preview crashes

2026-11-10 20:03:14 +08:00

product_errors.go

feat: add English interface localization and fix preview crashes

2026-11-10 20:03:14 +08:00

prompt_vars_test.go

同步

2026-08-24 14:14:15 +08:00

proxy_autoresume_test.go

fix: 代理暂停归入任务暂停语义并为所有成功路径加轮次门控

2026-10-31 19:30:38 +08:00

proxy_autoresume.go

fix: persist custom egress IP probe service (#118)

2026-11-05 16:00:07 +08:00

proxy_pool_test.go

fix: clean up proxy settings and empty pool handling

2026-11-02 17:57:19 +08:00

proxy_pool.go

fix: persist custom egress IP probe service (#118)

2026-11-05 16:00:07 +08:00

remarks_test.go

feat: align list editors with name hover actions

2026-10-19 09:58:32 +08:00

remarks.go

feat: 任务/模板备注展示与 Worker 运行数量配置（Codex gpt-6-astra 重写）

2026-10-24 21:46:03 +08:00

repeater_test.go

feat: edit full HTTP requests and manage replay drafts in bulk

2026-10-26 01:54:33 -07:00

repeater.go

feat: edit full HTTP requests and manage replay drafts in bulk

2026-10-26 01:54:33 -07:00

request_limiter_test.go

fix: enforce strict LLM HTTP request rate limits

2026-10-15 14:53:33 +08:00

scheduler.go

新增日历式计划任务

2026-10-09 23:05:44 +08:00

schedules.go

修复计划暂停来源和时间线刷新

2026-10-10 09:16:28 +08:00

server_mgmt.go

fix: align Jev integration with official System One protocol

2026-11-03 15:53:24 +08:00

server.go

feat(mcp): expose ARTEX as an MCP server for external agents

2026-11-14 14:08:07 +08:00

side_questions_test.go

fix: rebuild btw task fallback from current task context

2026-10-31 11:18:45 +08:00

side_questions.go

fix: rebuild btw task fallback from current task context

2026-10-31 11:18:45 +08:00

skill_upload_test.go

fix(skills): normalize API paths on Windows (#18)

2026-10-19 08:50:06 +08:00

skill_usage.go

feat(skills): track usage and missing dependencies

2026-08-24 19:30:14 +08:00

skill_zip.go

fix(skills): 修复技能压缩包上传失败与中文命名被判非法

2026-08-31 11:37:44 -04:00

sync_scopesentry.go

fix(mcp): http 传输支持跳过 TLS 证书校验(自签证书)

2026-09-11 11:37:56 -04:00

system_metrics_linux.go

fix: support non-Linux resource status builds

2026-10-29 10:41:04 -07:00

system_metrics_test.go

fix: support non-Linux resource status builds

2026-10-29 10:41:04 -07:00

system_metrics_unsupported.go

fix: support non-Linux resource status builds

2026-10-29 10:41:04 -07:00

system_metrics.go

fix: support non-Linux resource status builds

2026-10-29 10:41:04 -07:00

task_admission_test.go

同步

2026-08-24 14:14:15 +08:00

task_archive_package_test.go

fix(task-archive): 遇到符号链接跳过而非整包失败

2026-09-19 11:08:15 -04:00

task_archive_package.go

fix(task-archive): 遇到符号链接跳过而非整包失败

2026-09-19 11:08:15 -04:00

task_archives_test.go

归档

2026-08-28 12:56:29 +08:00

task_archives.go

Merge origin/main into codex/btw-side-question

2026-09-11 00:54:51 +08:00

task_asset_mapping.go

feat: refine agent workflows and settings UI

2026-10-29 16:20:11 +08:00

task_assets.go

feat(assets): add editable company and task scopes

2026-08-24 19:29:14 +08:00

task_categories_test.go

feat(tasks): 任务列表支持批量修改分类

2026-08-24 09:16:44 -04:00

task_categories.go

feat(tasks): 任务列表支持批量修改分类

2026-08-24 09:16:44 -04:00

task_control_routes_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

task_control.go

fix: 代理暂停/恢复屏障在锁内安装并防止复活已耗尽任务

2026-10-31 18:23:40 +08:00

task_delete_barrier_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

task_files_test.go

feat(tasks): add read-only task file browser (GITHUB-3)

2026-11-11 14:14:37 +08:00

task_files.go

feat(tasks): add read-only task file browser (GITHUB-3)

2026-11-11 14:14:37 +08:00

task_intercept.go

feat: 资产拦截接入执行链，新增任务级拦截/允许规则

2026-09-19 09:06:22 -04:00

task_llm_test.go

refactor(engine): 移除从不执行的全局 planner/worker 空壳,就绪信号改用谓词

2026-09-17 09:40:06 -04:00

task_llm.go

Merge pull request #107 from RuoJi6/feat/proxy-pool

2026-11-02 15:45:28 +08:00

task_metadata_test.go

feat: make task global asset sharing opt-in

2026-11-05 16:27:44 +08:00

task_metadata.go

feat: make task global asset sharing opt-in

2026-11-05 16:27:44 +08:00

task_resolution.go

同步

2026-08-24 14:14:15 +08:00

task_runtime_test.go

fix: exclude pause time from task run duration

2026-10-27 13:37:43 +08:00

task_runtime.go

feat(tasks): stop tasks that miss a configurable findings checkpoint

2026-11-11 14:07:39 +08:00

task_templates_test.go

feat(tasks): add categories templates and batch controls

2026-08-24 19:29:46 +08:00

task_templates.go

fix: mock/前端 Worker 与备注校验对齐后端（Codex gpt-6-astra）

2026-10-24 22:31:54 +08:00

testmain_test.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

tool_usage_test.go

抽屉优化

2026-08-25 12:05:26 +08:00

tool_usage.go

抽屉优化

2026-08-25 12:05:26 +08:00

tools_wire_test.go

feat: 任务/模板备注展示与 Worker 运行数量配置（Codex gpt-6-astra 重写）

2026-10-24 21:46:03 +08:00

trigger_merge_test.go

fix(trigger): 合并触发会话按任务去重任务描述/目标，避免长目标重复撑爆消息

2026-09-12 09:26:38 -04:00

triggers.go

feat(trigger): 新增"任务创建"触发机制(on_task_create)

2026-08-09 02:19:29 -04:00

update_settings_test.go

feat: add optional proxy for online updates

2026-10-15 15:44:55 +08:00

update_settings.go

feat: add optional proxy for online updates

2026-10-15 15:44:55 +08:00

update_test.go

feat: add optional proxy for online updates

2026-10-15 15:44:55 +08:00

update.go

feat: add optional proxy for online updates

2026-10-15 15:44:55 +08:00

webui_embed.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

webui_stub.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

worker_message_test.go

重构 worker 对话：复用 resume 机制，改专属 goroutine 运行

2026-08-31 09:00:21 -04:00

worker_pools_test.go

fix: Worker 池评审修复（系统会话可见报错、暂停意图续跑保持绑定模型、加载失败不清空池、原子写入）

2026-10-24 22:55:34 +08:00

workspace.go

feat(tasks): add read-only task file browser (GITHUB-3)

2026-11-11 14:14:37 +08:00