Skip to content

Clarion Assistant v4.5.0

Choose a tag to compare

View all tags
@peterparker57 peterparker57 released this 28 Apr 23:23
v4.5.0
083d55d

External MCP client access (issue #24)

Lets external tools (Claude Desktop, Cline, custom mcp-remote setups) authenticate against ClarionAssistant's local MCP server using a stable user-managed token instead of the per-session token that rotates each IDE start.

What's new

  • New "MCP Server" Settings page with a "Most users can skip this page" intro callout — the toggle is opt-in for users who want CA's IDE tools surfaced in tools outside the IDE.
  • Allow external MCP clients toggle persists across IDE restarts. Off by default.
  • Generate button mints a 64-character hex bearer token, stored in settings.txt. Idempotent: regenerating invalidates any external configs already using the previous token.
  • Live endpoint URL display shows http://localhost:<port>/mcp (port is dynamically chosen at startup).
  • Pre-filled mcp-remote config snippet with Copy config button — ready to paste into the external tool's MCP config.
  • Add to Claude Desktop button — one-click integration: writes the clarion-assistant entry directly into %APPDATA%\Claude\claude_desktop_config.json, backs up the original to .clarionassistant.bak, atomic write. Idempotent (re-click after rotating token to push the update).
  • Dual-token authentication — the per-session token still authenticates in-IDE Claude Code / Copilot / Codex tabs; the static external token is checked additionally when external access is enabled. Both compared in constant time. Settings re-read on every request so toggle/rotation takes effect immediately.

Security posture

  • Server still binds to loopback only — Windows networking refuses connections from any non-loopback IP. The token is unusable without the ability to send a packet to your machine.
  • Host and Origin header validation continues to defend against DNS rebinding and browser drive-bys.
  • Token lives in plain text in settings.txt and (if you use the Add to Claude Desktop button) claude_desktop_config.json. Treat both files as you would any other secrets-bearing config.

SettingsService cross-process hardening (collateral)

Strengthening the settings store to support the External MCP feature surfaced multiple latent issues that affect every settings save:

  • Static lock + named mutex (Local\ClarionAssistant.SettingsService.v1) serializes settings writes across all SettingsService instances within a process AND across multiple ClarionAssistant processes (the addin supports multi-IDE).
  • Reload-before-write merge — rotating Mcp.ExternalToken in one place no longer gets reverted when an unrelated control later saves an unrelated setting.
  • Atomic file replace via temp-file + File.Replace (ReplaceFileW on NTFS) so concurrent readers always see either the old file or the new file, never a half-written one.
  • Reload preserves in-memory state when the file is missing or the read fails — transient delete-then-rename from sync tools / antivirus no longer wipes settings on the next save.
  • SettingsLockedException is thrown when another CA process holds the cross-process mutex past the 5s budget; the settings dialog catches it and surfaces an actionable message instead of silently degrading.

Setup

Same mcp-remote install requirement as the Codex backend (v4.4.0):

npm install -g mcp-remote@0.1.38

Then: Settings → MCP Server → Allow external MCP clients → Generate → Add to Claude Desktop. Restart Claude Desktop.

Closes #24.

Assets 3
Loading