github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-28 23:59:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Do not register developer tools in multi-user MCP mode

Browse Source 
Prevent developer tools from being exposed when the MCP server runs in multi-user mode. Keep them available for local devenv usage and document the mode restriction. Add regression coverage for the registration policy.

Closes #11291

AI-assisted-by: gpt-5.6-luna
This commit is contained in:
Andrey Antukh 2026-08-19 12:58:03 +00:00
parent c378ec9218
commit 94cb683e26
3 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mcp/README.md
View File

@ -266,7 +266,7 @@ The Penpot MCP server can be configured using environment variables.
| `PENPOT_MCP_WEBSOCKET_PORT` | Port for the WebSocket server (plugin connection) | `4402` |
| `PENPOT_MCP_REPL_PORT` | Port for the REPL server (development/debugging) | `4403` |
| `PENPOT_MCP_REMOTE_MODE` | Enable remote mode (disables file system access). Set to `true` to enable. | `false` |
| `PENPOT_MCP_DEVENV` | Enable Penpot development environment tools. Set to `true` to enable. | `false` |
| `PENPOT_MCP_DEVENV` | Enable Penpot development environment tools in local single-user mode. Set to `true` to enable. | `false` |
| `PENPOT_MCP_TOOL_TIMEOUT_S` | Timeout, in seconds, for tool calls dispatched to the Penpot plugin | `120` |
| `PENPOT_MCP_EXPORT_SHAPE_MAX_PARALLEL_REQUESTS` | Maximum number of parallel export shape requests (multi-user mode only). | `0` (no limit) |
| `PENPOT_MCP_REDIS_URI` | Redis connection URI (e.g. `redis://host:6379`) enabling multi-instance horizontal scaling via Redis pub/sub task routing (multi-user mode only). When unset, the server runs in single-instance mode, requiring the plugin and MCP client to connect to the same instance. | (unset) |

15
mcp/packages/server/src/PenpotMcpServer.test.ts Normal file
View File

@ -0,0 +1,15 @@
import assert from "node:assert/strict";
import test from "node:test";
import { shouldRegisterDeveloperTools } from "./PenpotMcpServer";
test("registers developer tools in local devenv mode", () => {
assert.equal(shouldRegisterDeveloperTools(true, false), true);
});
test("does not register developer tools in multi-user devenv mode", () => {
assert.equal(shouldRegisterDeveloperTools(true, true), false);
});
test("does not register developer tools when devenv mode is disabled", () => {
assert.equal(shouldRegisterDeveloperTools(false, false), false);
});

9
mcp/packages/server/src/PenpotMcpServer.ts
View File

@ -50,6 +50,13 @@ class ToolInfo {
) {}
}
/**
* Indicates whether developer tools may be registered for the current server mode.
*/
export function shouldRegisterDeveloperTools(isDevEnv: boolean, isMultiUserMode: boolean): boolean {
return isDevEnv && !isMultiUserMode;
}
export class PenpotMcpServer {
/**
* Timeout, in minutes, for idle sessions (Streamable HTTP and SSE) before they are automatically closed and removed.
@ -219,7 +226,7 @@ export class PenpotMcpServer {
if (this.isFileSystemAccessEnabled()) {
toolInstances.push(new ImportImageTool(this));
}
if (this.isDevEnv()) {
if (shouldRegisterDeveloperTools(this.isDevEnv(), this.isMultiUserMode())) {
const nreplClient = new NreplClient();
toolInstances.push(new CljsReplTool(this, nreplClient));
toolInstances.push(new ImportPenpotFileTool(this, nreplClient));