@@ -10,26 +10,41 @@ components:
2: The server accepts the Cooked password from COOKED_LOGIN_PASSWORD.
3: The server accepts the Cooked username from TOML user.name.
4: The server accepts the Cooked password from TOML user.password.
- 5: The server accepts a command for producing the Cooked username from TOML user.name_cmd.- 6: The server accepts a command for producing the Cooked password from TOML user.password_cmd.
+ 5:
+ requirement: The server accepts a command for producing the Cooked username from TOML user.name_cmd.
+ deprecated: true
+ 6:
+ requirement: The server accepts a command for producing the Cooked password from TOML user.password_cmd.
+ deprecated: true
7: A credential command returns the credential on stdout.
7-1: Trailing newlines are trimmed from credential command stdout.
7-2: Empty credential command output is rejected.
- 8: The server rejects ambiguous TOML credential configuration for a single credential field.- 8-1: user.name and user.name_cmd are mutually exclusive.- 8-2: user.password and user.password_cmd are mutually exclusive.
+ 8:
+ requirement: The server rejects ambiguous TOML credential configuration for a single credential field.
+ deprecated: true
+ 8-1:
+ requirement: user.name and user.name_cmd are mutually exclusive.
+ deprecated: true
+ 8-2:
+ requirement: user.password and user.password_cmd are mutually exclusive.
+ deprecated: true
9: The server reports missing username or password configuration before serving.
10: The server obtains Cooked session cookies by logging in with configured username and password credentials.
- 11: COOKED_LOGIN_USERNAME takes precedence over TOML user.name and user.name_cmd.- 12: COOKED_LOGIN_PASSWORD takes precedence over TOML user.password and user.password_cmd.
+ 11: COOKED_LOGIN_USERNAME takes precedence over TOML user.name.
+ 12: COOKED_LOGIN_PASSWORD takes precedence over TOML user.password.
13: Browser-provided Cooked session cookies are not supported in this version.
14: Social-login and passwordless Cooked accounts are not supported in this version.
- 15: Credential command fields are TOML strings executed as shell commands.- 16: Credential commands must exit successfully within 5 seconds.- 17: Credential command stdout read by the server is capped at 64 KiB.
+ 15: Credential command config values are TOML strings beginning with !.
+ 16: Credential command config values must exit successfully within 10 seconds.
+ 17: Credential command config value stdout read by the server is bounded.
18: Credential command stdout is trimmed of leading and trailing ASCII whitespace before use.
19: Credential command stderr is not included in logs or user-facing errors.
20: Non-zero credential command exits are reported as credential resolution failures without command output.
+ 21: TOML user.name uses config-values.RESOLUTION.1.
+ 22: TOML user.password uses config-values.RESOLUTION.1.
+ 23: TOML user.name may reference any existing environment variable through config value syntax.
+ 24: TOML user.password may reference any existing environment variable through config value syntax.
+ 25: Separate TOML user.name_cmd and user.password_cmd fields are not supported in this version.
LOGIN:
requirements:
1: The server logs in to Cooked with the configured username and password when an authenticated request needs a session.
@@ -0,0 +1,45 @@
+feature:
+ name: config-values
+ product: cooked-mcp
+ description: Resolve TOML configuration strings that may be literals, environment references, or shell commands.
+
+components:
+ RESOLUTION:
+ requirements:
+ 1: TOML fields documented as config values use Pi-style config value resolution.
+ 2: Plain config value strings resolve as literal values.
+ 3: Config value strings beginning with ! execute the remainder as a shell command.
+ 4: Command config values resolve to trimmed stdout.
+ 5: Command config values with empty stdout are unresolved.
+ 6: Config value strings interpolate $ENV_VAR references using existing environment variables.
+ 7: Config value strings interpolate ${ENV_VAR} references using existing environment variables.
+ 8: Config value strings treat $$ as a literal dollar sign.
+ 9: Config value strings treat $! as a literal exclamation mark.
+ 10: Missing environment variables make the config value unresolved.
+ 11: Empty environment variables make the config value unresolved.
+ 12: Required settings reject unresolved config values before serving.
+ COMMANDS:
+ requirements:
+ 1: Command config values execute through the platform shell.
+ 2: Command config values have a bounded runtime.
+ 2-1: Command config values time out after 10 seconds.
+ 3: Command config value results are cached for the process lifetime.
+ 4: Command config value stderr is discarded.
+ 5: Command config value stdout is never logged.
+ 6: Command config value stderr is never logged.
+ 7: Non-zero command exits make the config value unresolved.
+ ERRORS:
+ requirements:
+ 1: Unresolved command config values are reported without command stdout or stderr.
+ 2: Unresolved environment references are reported with the missing environment variable names.
+ 3: Config value errors identify the setting being resolved.
+
+constraints:
+ SECRETS:
+ requirements:
+ 1: Config value resolution never logs resolved values for secret settings.
+ 2: Config value resolution never includes resolved secret values in user-facing errors.
+ VERIFICATION:
+ requirements:
+ 1: Config value resolution is verified without invoking real credential managers.
+ 2: Config value command tests use fake shell commands.
@@ -46,13 +46,18 @@ constraints:
2: HTTP authentication secrets are never logged.
3: HTTP transport supports bearer-token authentication.
4: HTTP bearer tokens can be configured through COOKED_MCP_HTTP_TOKEN.
- 5: HTTP bearer tokens can be configured through TOML mcp.http_token or mcp.http_token_cmd.
+ 5: HTTP bearer tokens can be configured through TOML mcp.http_token.
6: HTTP bearer authentication uses the Authorization header with the Bearer scheme.
7: When an HTTP token is configured, every MCP HTTP request must provide the matching bearer token.
- 8: TOML mcp.http_token and mcp.http_token_cmd are mutually exclusive.- 9: COOKED_MCP_HTTP_TOKEN takes precedence over TOML mcp.http_token and mcp.http_token_cmd.- 10: TOML mcp.http_token_cmd follows the same command execution, trimming, timeout, and secrecy rules as Cooked credential commands.
+ 8:
+ requirement: TOML mcp.http_token and mcp.http_token_cmd are mutually exclusive.
+ deprecated: true
+ 9: COOKED_MCP_HTTP_TOKEN takes precedence over TOML mcp.http_token.
+ 10: TOML mcp.http_token follows the same config value resolution, trimming, timeout, and secrecy rules as Cooked credential settings.
11: Empty HTTP bearer tokens are rejected before serving.
+ 12: TOML mcp.http_token uses config-values.RESOLUTION.1.
+ 13: TOML mcp.http_token may reference any existing environment variable through config value syntax.
+ 14: Separate TOML mcp.http_token_cmd is not supported in this version.
COMPATIBILITY:
requirements:
1: The server does not require MCP resource support from clients.