fix: trusted bot config conformance with spec §4.1.3.4#2213
Merged
Conversation
- Reject empty trusted-bots array per spec (MUST be non-empty when present) - Add trustedBots to gateway schema patch (not yet in v0.62.2 schema) - Add Go config parsing tests: TOML, JSON stdin, convertStdinConfig - Add Go guard tests: empty array, whitespace-only, no-mutation, preserve-all - Add Go server test: getTrustedBots accessor with nil/empty/configured - Add Rust tests: PR integrity for configured bots, combined built-in + configured bot detection, unknown bot rejection Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates trusted-bot configuration handling to align with MCP Gateway Specification §4.1.3.4, ensuring empty trusted bot lists are rejected and adding cross-layer test coverage for the new behavior.
Changes:
- Enforce stricter validation for
trusted-botsinbuildStrictLabelAgentPayload(reject empty arrays; improve error messaging). - Patch the fetched JSON schema to include
gatewayConfig.trustedBotswithminItems: 1to prevent schema-validation failures for valid configs. - Add Go + Rust tests covering trusted-bot parsing/propagation and integrity elevation behavior.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/server/unified_test.go | Adds unit tests for UnifiedServer.getTrustedBots() accessor behavior. |
| internal/guard/wasm.go | Tightens trusted-bots validation (non-empty array when present). |
| internal/guard/wasm_test.go | Expands coverage for trusted-bots validation and payload construction immutability. |
| internal/config/validation_schema.go | Patches upstream schema to include gatewayConfig.trustedBots. |
| internal/config/config_test.go | Adds TOML + stdin JSON parsing tests for trusted bots. |
| internal/config/config_stdin_test.go | Adds conversion tests verifying trustedBots propagation behavior. |
| guards/github-guard/rust-guard/src/labels/mod.rs | Adds Rust tests ensuring configured trusted bots elevate integrity and combine with built-ins. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This was referenced Mar 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ensures trusted bot configuration conforms to MCP Gateway Specification §4.1.3.4 (Trusted Bot Identity Configuration) and adds comprehensive test coverage across all layers.
Spec Conformance Fix
Empty array validation —
buildStrictLabelAgentPayloadnow rejectstrusted-bots: []per spec: "trustedBots MUST be a non-empty array of strings when present".Schema Patch
The v0.62.2 JSON schema doesn't include
trustedBotsingatewayConfig(it's in v1.9.0/main). Added it tofetchAndFixSchema()alongside existingregistry/guard-policiespatches to prevent schema validation failures for valid configs.New Tests
wasm_test.go)config_test.go)config_stdin_test.go)convertStdinConfiground-trip: present, empty, nil, no gatewayunified_test.go)getTrustedBots: configured, empty, nil gatewaymod.rs)Verification
make agent-finishedpasses (format, build, lint, all tests)