mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-21 06:11:31 +08:00
krishicksandddurst
7bce1223dc
Add policy schema, proto, provider profile, OPA, and L7 proxy support for `protocol: json-rpc` and `protocol: mcp`. Generic JSON-RPC endpoints match exact method names only, with `method: "*"` as the all-method sentinel; wildcard/glob methods and params matchers are rejected. Parse JSON-RPC request bodies and batches in the forward proxy, deny response-shaped client frames, limit receive-stream GET allowance to MCP endpoints, and redact params in decision logs. Preserve L7 rule params on the proto load path so MCP `tools/call` tool filters behave like YAML-loaded policies. Add MCP conformance coverage, JSON-RPC L7 e2e coverage, and docs for the new protocols and current matcher limitations. Signed-off-by: Kris Hicks <khicks@nvidia.com> Co-authored-by: ddurst <267424412+ddurst-nvidia@users.noreply.github.com>
62 lines
1.9 KiB
TOML
62 lines
1.9 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[package]
|
|
name = "openshell-supervisor-network"
|
|
description = "Network component of the OpenShell supervisor: proxy, L7 enforcement, OPA, inference routing, denial aggregator"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
|
|
[dependencies]
|
|
openshell-core = { path = "../openshell-core" }
|
|
openshell-ocsf = { path = "../openshell-ocsf" }
|
|
openshell-policy = { path = "../openshell-policy" }
|
|
openshell-router = { path = "../openshell-router" }
|
|
|
|
apollo-parser = { workspace = true }
|
|
aws-sigv4 = { version = "1", features = ["sign-http", "http1"] }
|
|
aws-credential-types = { version = "1", features = ["hardcoded-credentials"] }
|
|
aws-smithy-runtime-api = { version = "1", features = ["client"] }
|
|
http = { workspace = true }
|
|
base64 = { workspace = true }
|
|
bytes = { workspace = true }
|
|
flate2 = "1"
|
|
glob = { workspace = true }
|
|
hex = "0.4"
|
|
ipnet = "2"
|
|
miette = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
regorus = { version = "0.9", default-features = false, features = ["std", "arc", "glob"] }
|
|
reqwest = { workspace = true }
|
|
rustls = { workspace = true }
|
|
rustls-pemfile = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
serde_yml = { workspace = true }
|
|
sha1 = "0.10"
|
|
sha2 = { workspace = true }
|
|
spiffe = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tokio-rustls = { workspace = true }
|
|
tower-mcp-types = { workspace = true }
|
|
tracing = { workspace = true }
|
|
uuid = { workspace = true }
|
|
webpki-roots = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
openshell-core = { path = "../openshell-core", features = ["test-helpers"] }
|
|
tempfile = "3"
|
|
temp-env = "0.3"
|
|
tokio-tungstenite = { workspace = true }
|
|
futures = { workspace = true }
|
|
|
|
[target.'cfg(unix)'.dev-dependencies]
|
|
libc = "0.2"
|
|
|
|
[lints]
|
|
workspace = true
|