feat(gitea): establish MCP security baseline (phase 0)

2026-07-14 12:00:53 +08:00
parent 795a852aa9
commit 56fb3a7547
7 changed files with 206 additions and 1 deletions
@@ -0,0 +1,94 @@
+#!/usr/bin/env pwsh
+
+[CmdletBinding()]
+param(
+  [string]$EnvFile = $(
+    if ($env:GITEA_ENV_FILE) {
+      $env:GITEA_ENV_FILE
+    } else {
+      Join-Path $HOME ".codex/gitea.env"
+    }
+  ),
+  [string]$Version = "0.5.1",
+  [switch]$CheckConfig,
+  [Parameter(ValueFromRemainingArguments = $true)]
+  [string[]]$ServerArgs
+)
+
+$ErrorActionPreference = "Stop"
+$utf8 = [System.Text.UTF8Encoding]::new($false)
+[Console]::OutputEncoding = $utf8
+$OutputEncoding = $utf8
+
+if (-not (Test-Path -LiteralPath $EnvFile -PathType Leaf)) {
+  throw "Gitea MCP 配置文件不存在：$EnvFile"
+}
+
+$values = @{}
+foreach ($rawLine in Get-Content -LiteralPath $EnvFile) {
+  $line = $rawLine.Trim()
+  if (-not $line -or $line.StartsWith("#")) {
+    continue
+  }
+
+  $pair = $line -split "=", 2
+  if ($pair.Count -ne 2) {
+    throw "Gitea MCP 配置行必须使用 KEY=VALUE 格式。"
+  }
+
+  $values[$pair[0].Trim()] = $pair[1].Trim()
+}
+
+foreach ($name in @("GITEA_URL", "GITEA_TOKEN")) {
+  if (-not $values.ContainsKey($name) -or [string]::IsNullOrWhiteSpace($values[$name])) {
+    throw "$name 未配置或为空。"
+  }
+}
+
+try {
+  $giteaUri = [Uri]$values["GITEA_URL"]
+} catch {
+  throw "GITEA_URL 不是有效 URL。"
+}
+
+if ($giteaUri.Scheme -notin @("http", "https")) {
+  throw "GITEA_URL 只支持 http 或 https。"
+}
+
+if ($giteaUri.AbsolutePath.Trim("/") -ne "") {
+  throw "GITEA_URL 必须填写实例根地址，不要包含 /api/v1；gitea-mcp 会自动追加 API 路径。"
+}
+
+if ($giteaUri.Scheme -eq "http" -and $values["GITEA_ALLOW_INSECURE_HTTP"] -ne "1") {
+  throw "当前使用 HTTP。确认接受 Token 明文传输风险后，在私有配置中设置 GITEA_ALLOW_INSECURE_HTTP=1。"
+}
+
+foreach ($entry in $values.GetEnumerator()) {
+  if ($entry.Key -like "GITEA_*") {
+    Set-Item -Path "Env:$($entry.Key)" -Value $entry.Value
+  }
+}
+
+$noProxyEntries = @($env:NO_PROXY -split "," | ForEach-Object { $_.Trim() } | Where-Object { $_ })
+if ($noProxyEntries -notcontains $giteaUri.Host) {
+  $noProxyEntries += $giteaUri.Host
+}
+$env:NO_PROXY = $noProxyEntries -join ","
+$env:no_proxy = $env:NO_PROXY
+
+if ($values["GITEA_DIRECT"] -eq "1") {
+  foreach ($proxyVariable in @("ALL_PROXY", "all_proxy", "HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy")) {
+    Remove-Item -Path "Env:$proxyVariable" -ErrorAction SilentlyContinue
+  }
+}
+
+if ($CheckConfig) {
+  Write-Output "Gitea MCP 配置有效：URL=$($giteaUri.GetLeftPart([UriPartial]::Authority))，Token 已设置，版本=$Version。"
+  exit 0
+}
+
+$uvx = Get-Command uvx -ErrorAction Stop
+$stderrLog = Join-Path ([IO.Path]::GetTempPath()) "gitea-mcp-$PID.stderr.log"
+& $uvx.Source --from "gitea-mcp==$Version" gitea-mcp @ServerArgs 2>> $stderrLog
+exit $LASTEXITCODE
+