chore(security): rotate MCP connector token (local dev)#238
Open
0xtsotsi wants to merge 1 commit into
Open
Conversation
Adds `bun run security:rotate-mcp` to swap the connector in `.env` for a fresh bearer. Reads the old hash from `ai_mcp_connectors`, runs a transaction that creates the replacement row, deletes the old one, and verifies both inside the same transaction. Restores the old `INSTATIC_MCP_TOKEN` value on rollback only when the database still proves the rollback happened. This is the local-dev rotation helper; the admin endpoint that returns the plaintext once is the production path. The .env file remains gitignored.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
bun run security:rotate-mcpto swap the connector in./.envfor a fresh bearer without printing either secret.Why
The dev MCP connector token in
./.envwas committed in plaintext. Even though the file is gitignored, it lived under the working tree and would be swept up by any backup/sync tool. The rotation helper:INSTATIC_MCP_TOKENfrom./.env.ai_mcp_connectorsby hash (so an operator cannot rotate a token they don't already possess)../.env(mode 0600) atomically via a temp file +rename(2)../.envvalue on rollback only when the database proves the rollback happened — never overwrites after an ambiguous database outcome.This is the local-dev rotation helper. The admin endpoint that returns the plaintext once is the production path.
./.envremains gitignored.Files
scripts/rotate-mcp-token.ts(new)package.json(one new script:security:rotate-mcp)Verification
bun run security:rotate-mcpon a fresh checkout rotates the token and writes the new bearer to./.env.bun run lintclean.tsc -bclean.