user bf935a556c fix(mcp): remove auto-promote of unknown client IP to internal sentinel ... Previously _get_allowed_mcp_servers fell back to INTERNAL_REQUEST when both the explicit client_ip and the auth-context IP were missing, defeating the new fail-closed gate at the wrapper layer. An external request with no attributable client IP could reach internal-only MCP servers via tool/list/resource calls. Drop the auto-promote: pass None through, which now fails closed in filter_server_ids_by_ip_with_info. Internal callers must opt in to INTERNAL_REQUEST explicitly. Update test_mcp_routing_with_conflicting_alias_and_group_name to mock _get_client_ip_from_context with a real internal IP — the unit test has no HTTP request context so it would otherwise be filtered out by the fail-closed gate. Update test_mcp_ip_filtering tests to assert the new fail-closed behavior on missing IP and the INTERNAL_REQUEST escape hatch.		2026-05-11 20:14:48 +00:00
..
mcp_server	fix(mcp): remove auto-promote of unknown client IP to internal sentinel	2026-05-11 20:14:48 +00:00