From 11522f88b0414d5ea8c3716864278e18b86ed238 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Tue, 16 Jun 2026 20:50:17 +0200 Subject: [PATCH] refactor(auth): drop built-in well-known MCP client list The client registry derived display names from a hardcoded map of "well-known" MCP clients (claude-desktop, claude-ai, continue-dev, zed-editor, vscode-mcp). This baked a recognized-client list into the server even though admission already requires explicit opt-in via ALLOWED_MCP_CLIENTS (fail-closed when unset). Mirror the management-API surface (ALLOWED_MGMT_CLIENT), which has no built-in client list: remove the map and derive the display name generically from the client_id. Default remains none; clients must be added explicitly and DCR stays off unless ENABLE_DCR=true. Co-Authored-By: Claude Opus 4.8 (1M context) --- nextcloud_mcp_server/auth/client_registry.py | 17 ++++++++--------- tests/unit/test_client_registry.py | 5 ++++- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/nextcloud_mcp_server/auth/client_registry.py b/nextcloud_mcp_server/auth/client_registry.py index 590b2317..0f5dc08f 100644 --- a/nextcloud_mcp_server/auth/client_registry.py +++ b/nextcloud_mcp_server/auth/client_registry.py @@ -140,15 +140,14 @@ class ClientRegistry: ) def _get_client_name(self, client_id: str) -> str: - """Get human-readable name for client_id.""" - known_names = { - "claude-desktop": "Claude Desktop", - "claude-ai": "Claude AI", - "continue-dev": "Continue IDE Extension", - "zed-editor": "Zed Editor", - "vscode-mcp": "VS Code MCP Extension", - } - return known_names.get(client_id, client_id.replace("-", " ").title()) + """Derive a human-readable display name from a client_id. + + There is no built-in list of "well-known" clients: every client must be + opted in explicitly via ``ALLOWED_MCP_CLIENTS`` (mirroring the + management-API ``ALLOWED_MGMT_CLIENT`` allowlist). The display name is + derived generically from the client_id. + """ + return client_id.replace("-", " ").title() def validate_client( self, diff --git a/tests/unit/test_client_registry.py b/tests/unit/test_client_registry.py index 75d27308..8242501b 100644 --- a/tests/unit/test_client_registry.py +++ b/tests/unit/test_client_registry.py @@ -157,8 +157,11 @@ def test_validate_redirect_uri_localhost_wildcard(monkeypatch): def test_client_name_resolution(monkeypatch): - registry = _get_registry(monkeypatch, "claude-desktop, custom-tool") + # Names are derived generically from the client_id — there is no built-in + # "well-known" client map, so previously special-cased ids now title-case. + registry = _get_registry(monkeypatch, "claude-desktop, claude-ai, custom-tool") assert registry.get_client("claude-desktop").name == "Claude Desktop" + assert registry.get_client("claude-ai").name == "Claude Ai" assert registry.get_client("custom-tool").name == "Custom Tool"