Files
oh-my-opencode/src/features/claude-code-mcp-loader/transformer.test.ts
T
YeonGyu-Kim e8c5727a22 fix(mcp): restrict env var expansion in MCP configs
Block sensitive env var interpolation in MCP config expansion so repo and plugin MCP definitions cannot exfiltrate secrets by default.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
2026-04-02 14:55:01 +09:00

77 lines
2.1 KiB
TypeScript

import { describe, expect, it } from "bun:test"
import { transformMcpServer } from "./transformer"
describe("transformMcpServer", () => {
describe("#given a remote MCP server with oauth config", () => {
it("#when transforming the server #then preserves oauth on the remote config", () => {
const transformed = transformMcpServer("remote-oauth", {
type: "http",
url: "https://mcp.example.com",
headers: { Authorization: "Bearer test" },
oauth: {
clientId: "client-id",
scopes: ["read", "write"],
},
})
expect(transformed).toEqual({
type: "remote",
url: "https://mcp.example.com",
headers: { Authorization: "Bearer test" },
oauth: {
clientId: "client-id",
scopes: ["read", "write"],
},
enabled: true,
})
})
})
describe("#given a server config containing sensitive env references", () => {
it("#when transforming a local MCP server #then it strips sensitive env vars from the environment", () => {
// given
process.env.GITHUB_TOKEN = "ghp-secret"
process.env.HOME = "/Users/tester"
// when
const transformed = transformMcpServer("local-secure", {
command: "npx",
args: ["mcp-server", "${HOME}"],
env: {
HOME_DIR: "${HOME}",
AUTH_TOKEN: "${GITHUB_TOKEN}",
},
})
// then
expect(transformed).toEqual({
type: "local",
command: ["npx", "mcp-server", "/Users/tester"],
environment: {
HOME_DIR: "/Users/tester",
AUTH_TOKEN: "",
},
enabled: true,
})
})
it("#when transforming a remote MCP server #then it strips sensitive env vars from the url", () => {
// given
process.env.API_KEY = "secret-key"
// when
const transformed = transformMcpServer("remote-secure", {
type: "http",
url: "https://mcp.example.com/${API_KEY}",
})
// then
expect(transformed).toEqual({
type: "remote",
url: "https://mcp.example.com/",
enabled: true,
})
})
})
})