Generic HTTP/REST connector — call any API as config (#95) - #105
Merged
Conversation
#95) Add an `http` connector (auth:"token", grantModel:"user", read+write) exposing ONE `http_request` ToolDef so any REST API is callable as CONFIGURATION, not bespoke Worker code — the piece that makes Google Places a config, not a Worker. - `http_request` input: method, url (or base+path), query, headers, JSON body — all with `{{param}}` interpolation from `inputs`; optional dotted `responseMap` extraction (incl. `array[].{a,b:path}` projection) and a `pagination` descriptor returning the next cursor/offset for the caller to fan out pages. - Auth modes: `none`, and api-key where a vault-stored key (user_api_keys, provider "http") is minted via connectorClient (#86) and injected into a configurable header or query param (e.g. Places X-Goog-Api-Key). Key value is never inlined, returned, or logged. - All outbound calls go through `safeFetch` (SSRF guard, https-only, redirect-revalidated). - Just a ToolDef in a Connector → instantly callable via runtime, MCP proxy, and POST /v1/instances/:id/tools/http_request. No bespoke route. Tests: schema/registration, {{param}} interpolation, responseMap extraction, api-key-from-vault injection (mocked), SSRF path, generic-route dispatch, and a Google Places searchText call expressed purely as http_request config. Full suite green (1174, +20; 0 regressions). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closed
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #95. Part of #94. Builds on #86 (connectorClient).
Adds an
httpconnector with onehttp_requestToolDef:{method,url|base+path,query,headers,body,inputs,auth,responseMap,pagination},{{param}}interpolation, dotted/array-projection responseMap (no JSONPath dep), pagination cursor. Auth:noneorapi-key(in header|query) read from theuser_api_keysvault via connectorClient — never in inputs/schema/output (asserted). All calls viasafeFetch(SSRF-safe; 169.254.169.254/http rejected pre-network).Auto-registers → callable via runtime, MCP proxy, and
POST /v1/instances/:id/tools/http_request(no bespoke route). Google Places searchText/searchNearby are now pure config (proof test included).Verify:
tscclean · 1174 api tests pass (+20, 0 regressions) · biome clean.🤖 Generated with Claude Code