MCPcopy Create free account
hub / github.com/github/gh-aw / validateServerSecrets

Function validateServerSecrets

pkg/cli/mcp_validation.go:26–168  ·  view source on GitHub ↗

validateServerSecrets checks if required environment variables/secrets are available

(config parser.RegistryMCPServerConfig, verbose bool, useActionsSecrets bool)

Source from the content-addressed store, hash-verified

24
25// validateServerSecrets checks if required environment variables/secrets are available
26func validateServerSecrets(config parser.RegistryMCPServerConfig, verbose bool, useActionsSecrets bool) error {
27 mcpValidationLog.Printf("Validating server secrets: server=%s, type=%s, useActionsSecrets=%v", config.Name, config.Type, useActionsSecrets)
28
29 // Extract secrets from the config
30 requiredSecrets := extractSecretsFromConfig(config)
31
32 // Special case: Check for GH_AW_GITHUB_TOKEN when GitHub tool is in remote mode
33 if config.Name == "github" && config.Type == "http" {
34 mcpValidationLog.Print("GitHub remote mode detected, checking for GH_AW_GITHUB_TOKEN")
35 // GitHub remote mode requires GH_AW_GITHUB_TOKEN secret
36 // Check if a custom token is already specified in the env
37 hasCustomToken := false
38 for _, value := range config.Env {
39 if strings.Contains(value, "secrets.") && !strings.Contains(value, "GH_AW_GITHUB_TOKEN") {
40 // Custom token specified, no need to check GH_AW_GITHUB_TOKEN
41 hasCustomToken = true
42 break
43 }
44 }
45
46 if !hasCustomToken {
47 // Add GH_AW_GITHUB_TOKEN to required secrets if not already present
48 alreadyPresent := false
49 for _, secret := range requiredSecrets {
50 if secret.Name == "GH_AW_GITHUB_TOKEN" {
51 alreadyPresent = true
52 break
53 }
54 }
55 if !alreadyPresent {
56 requiredSecrets = append(requiredSecrets, SecretInfo{
57 Name: "GH_AW_GITHUB_TOKEN",
58 EnvKey: "GITHUB_TOKEN",
59 })
60 }
61 }
62 }
63
64 if len(requiredSecrets) == 0 {
65 mcpValidationLog.Printf("No required secrets found, validating %d environment variables", len(config.Env))
66 // No secrets required, proceed with normal env var validation
67 for key, value := range config.Env {
68 // Check if value contains variable references
69 if strings.Contains(value, "${") {
70 // Extract variable name (simplified parsing)
71 if strings.Contains(value, "secrets.") {
72 // This should have been caught by extractSecretsFromConfig
73 continue
74 }
75 if strings.Contains(value, "GH_TOKEN") || strings.Contains(value, "GITHUB_TOKEN") || strings.Contains(value, "GITHUB_PERSONAL_ACCESS_TOKEN") {
76 if token, err := parser.GetGitHubToken(); err != nil {
77 return errors.New("GitHub token not found in environment (set GH_TOKEN or GITHUB_TOKEN)")
78 } else {
79 config.Env[key] = token
80 }
81 }
82 // Handle our placeholder for GitHub token requirement
83 if strings.Contains(value, "GITHUB_TOKEN_REQUIRED") {

Callers 2

inspectMCPServerFunction · 0.85

Calls 10

GetGitHubTokenFunction · 0.92
FormatInfoMessageFunction · 0.92
FormatSuccessMessageFunction · 0.92
FormatWarningMessageFunction · 0.92
extractSecretsFromConfigFunction · 0.85
checkSecretsAvailabilityFunction · 0.85
PrintMethod · 0.80
GetenvMethod · 0.80
PrintfMethod · 0.45
ErrorfMethod · 0.45

Tested by 1