nonesilva-contributions/vscode-tlaplus-mcp-bind-measurements
Developer tools이 페이지는 AI로 자동 번역되었습니다. 기술적인 세부 사항은 원문을 확인하세요. 원문 보기
Reproducible measurements behind a vscode-tlaplus fix: binding the MCP server to loopback and advertising that address (Node 20/22, Docker). https://github.com/tlaplus/vscode-tlaplus/pull/544
개요
Measurements behind a proposed change to tlaplus/vscode-tlaplus: bind the TLA+ extension's MCP server to loopback. src/lm/MCPServer.ts calls app.listen(port) with no host. Node then binds the unspecified address ::, which serves IPv4 and IPv6. The socket answers on every interface of the machine, not only on loopback. POST /mcp has no authentication. The transport is built with { sessionIdGenerator: undefined } and nothing else, so there is no Host or Origin check either. An initialize that reaches the port is answered. So a machine on the same network can talk to the server with no credential, as long as the firewall of the host allows it. The port is open by default: tlaplus.mcp.port is 0, and src/main.ts reads 0 as "take a free port". Only a value outside 0 and 1024-65535, such as -1, keeps the server from starting. Source at commit c869f2a: https://github.com/tlaplus/vscode-tlaplus/blob/c869f2a/src/lm/MCPServer.ts. Read from the history of the file.
README
원문 README의 일부입니다. 원문 보기.
vscode-tlaplus-mcp-bind-measurements
A
*-measurementsrepository measures how open source software behaves, to choose what to test. Only the behaviors that matter become tests in the pull request, so the project’s repository does not get a lot of unnecessary tests.
This repository supports the pull request https://github.com/tlaplus/vscode-tlaplus/pull/544.
How a reviewer reads this repository
For each request that you made in the review:
- find its row in the table below, in the column “Reviewer request”
- read the decision, “Becomes a test” and “Needs a code fix”, a summary of the report
- read the report of the row: click “see report”
- see what the patch changes in the code, in
ast-diff/results/ - check the tests in
patches/, and their results insuite/results/: a partial run, not all the tests of the extension
Each use case stands alone. A “-” in “Reviewer request” marks a case that the author found.
What becomes a test or needs a code fix
| # | Reviewer request | Use case | Use case version | Becomes a test | Needs a code fix | Report | Owner check |
|---|---|---|---|---|---|---|---|
| 01 | make it a preference, default localhost | the shipped bind answers outside loopback | v1 | y | y | see report | done |
| 02 | bind address as a VS Code setting | a bind fixed to 127.0.0.1 refuses `` and ::1 |
v1 | y | y | see report | done |
| 03 | - | a Host allowlist answers a foreign Host with 403 |
v1 | - | - | see report | done |
설치
This server does not publish a one-line install command.
Open the repository installation guide MCP 초보자라면? mcpskill.org 가이드부터 시작하세요 →