Conversation
Two new pages under AI: - Scoping Tools with Exposed Services: the per-endpoint allowlist of database/file services, empty-means-none, the scope_tools / MCP_SCOPE_TOOLS tri-state (a non-empty list always applies), the upgrade backfill snapshot, automatic rename/delete sync, how scoping composes with Built-in Tools (disabled_tools), and the leaner catalog (short descriptions, all_* aggregators only with 2+ services). - API Key Authentication for MCP: the per-service Allow API Key Authentication opt-in, X-DreamFactory-API-Key (active app with a role, role x Exposed Services), Bearer precedence, optional X-DreamFactory-Session-Token layering, security guidance and mcp_request_log auditing. Deployment page gains MCP_INTERNAL_BASE_URL (external-port-differs callback failures), an Upgrading to 7.7.1 section with the export/import caveat, and two troubleshooting rows. The MCP overview, creation guide and FAQ no longer claim every service is auto-exposed, and the creation guide documents the two new Advanced Options fields. Four admin-UI screenshots added under static/img/ai/mcp-access/. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
✅ Deploy Preview for dreamfactory-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this documents
DreamFactory 7.7.1 adds two MCP features (df-mcp-server PRs #55 and #56): a per-endpoint Exposed Services allowlist that scopes
tools/list, and per-service API key authentication for the MCP endpoint. This PR documents both, including the automatic rename/delete sync that keepsexposed_servicesin step with backend service changes.New pages
docs/AI/mcp-exposed-services.md) — the per-MCP-endpoint allowlist of database/file services, the admin multi-select, empty-means-none (deliberate; custom tools,search/fetchand global tools still register), thescope_tools/MCP_SCOPE_TOOLStri-state with a combination table (a non-empty list always applies, even with scoping switched off), the upgrade backfill (frozen snapshot — nothing shrinks; later-added services are selected manually), automatic rename/delete sync, how scoping composes with Built-in Tools (disabled_tools: scoping first, then the per-tool denylist), and the leaner catalog (trimmed descriptions;all_*aggregators only register with 2+ services of a category).docs/AI/mcp-api-key-auth.md) — the per-service Allow API Key Authentication opt-in (off by default),X-DreamFactory-API-Keywith a standard DF app key (app must be active and have a role; role ∩ Exposed Services governs tools), Bearer/OAuth precedence, optionalX-DreamFactory-Session-Tokenlayering for user-specific RBAC, curl examples, and security guidance (treat keys as secrets, keys never written to logs at the default level,mcp_request_logauditing with app/role attribution).Updated pages
MCP_INTERNAL_BASE_URLandMCP_SCOPE_TOOLSconfiguration rows plus a dedicated callback-URL section (external port ≠ internal port ⇒ connecting andtools/listwork but every tool call fails), two new troubleshooting rows, and an Upgrading to 7.7.1 section covering the migration backfill, the reconnect-clients note, and the export/import caveat in both directions.sidebar_position: 4).Screenshots
Four admin-UI screenshots under
static/img/ai/mcp-access/: the MCP Servers list, the Exposed Services multi-select open, the Allow API Key Authentication toggle, and the Built-in Tools per-tool toggles. OAuth credential fields are redacted in the images.Verification
npm run build(Docusaurus 3.6, Node 20) passes with no broken links or anchors.🤖 Generated with Claude Code