Generate a PRM inside the MCP generated manifest

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[augmentcode]

🤖 Augment PR Summary

Summary: This PR extends the MCP manifest generation to optionally include OAuth Protected Resource Metadata (PRM) describing where clients should obtain bearer tokens for the MCP endpoint.

Changes:

• Adds generate_protected_resource_metadata (RFC 9728) in the enterprise index layer and exposes it via the enterprise index header.
• During MCP manifest generation (enterprise builds), reads authentication.bin and emits protectedResourceMetadata when a matching JWT policy/audience exists for /self/v1/mcp.
• Introduces src/index/endpoints.h to centralize all served URI templates and replaces duplicated string literals in the URI template router generator.
• Updates build rules so the MCP artifact depends on authentication.bin, and increases MAX_CONTAINER_DEPENDENCIES to accommodate the additional dependency.

Technical Notes: The PRM emission filters authorization servers to those whose configured JWT audience exactly matches the MCP resource URL derived from configuration.url + the MCP endpoint path.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[cubic-dev-ai]

2 issues found and verified against the latest diff

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="enterprise/index/enterprise_index.cc">

<violation number="1" location="enterprise/index/enterprise_index.cc:182">
P2: This bounds check relies solely on `assert`, which is compiled out in release builds. If `authentication.bin` is malformed or out of sync with the configuration (e.g., due to a corrupted artifact), `index` could be out-of-bounds and `configuration.authentication[index]` would read out-of-bounds memory, causing undefined behavior or a crash. Consider adding an explicit runtime bounds check that skips invalid indices instead of relying only on `assert`.</violation>
</file>

<file name="src/index/rules.h">

<violation number="1" location="src/index/rules.h:291">
P2: Existing incremental-build outputs keep the old MCP manifest without `protectedResourceMetadata`, because this rule change does not invalidate `state.bin`. Include dependency structure in `rules_fingerprint` (or otherwise force this artifact dirty) so upgrading the indexer regenerates the manifest.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Existing incremental-build outputs keep the old MCP manifest without protectedResourceMetadata, because this rule change does not invalidate state.bin. Include dependency structure in rules_fingerprint (or otherwise force this artifact dirty) so upgrading the indexer regenerates the manifest.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/index/rules.h, line 291:

<comment>Existing incremental-build outputs keep the old MCP manifest without `protectedResourceMetadata`, because this rule change does not invalidate `state.bin`. Include dependency structure in `rules_fingerprint` (or otherwise force this artifact dirty) so upgrading the indexer regenerates the manifest.</comment>

<file context>
@@ -286,8 +286,10 @@ inline constexpr DeltaRuleSet<13, 8, 5, 2> INDEX_RULES{
-         .dependency_count = 3},
+               {.kind = ContainerDependencyKind::Global, .filename = nullptr},
+               {.kind = ContainerDependencyKind::Global,
+                .filename = "authentication.bin"}}},
+         .dependency_count = 4},
 
</file context>

[cubic-dev-ai]

P2: This bounds check relies solely on assert, which is compiled out in release builds. If authentication.bin is malformed or out of sync with the configuration (e.g., due to a corrupted artifact), index could be out-of-bounds and configuration.authentication[index] would read out-of-bounds memory, causing undefined behavior or a crash. Consider adding an explicit runtime bounds check that skips invalid indices instead of relying only on assert.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At enterprise/index/enterprise_index.cc, line 182:

<comment>This bounds check relies solely on `assert`, which is compiled out in release builds. If `authentication.bin` is malformed or out of sync with the configuration (e.g., due to a corrupted artifact), `index` could be out-of-bounds and `configuration.authentication[index]` would read out-of-bounds memory, causing undefined behavior or a crash. Consider adding an explicit runtime bounds check that skips invalid indices instead of relying only on `assert`.</comment>

<file context>
@@ -161,4 +161,48 @@ auto generate_mcp_tools(const sourcemeta::core::URITemplateRouterView &router,
+  auto servers{sourcemeta::core::JSON::make_array()};
+  for (const auto index : authentication.governing(
+           sourcemeta::one::Authentication::Path::relative(endpoint))) {
+    assert(index < configuration.authentication.size());
+    const auto &entry{configuration.authentication[index]};
+    if (entry.type !=
</file context>

Suggested change

	assert(index < configuration.authentication.size());
	if (index >= configuration.authentication.size()) {
	continue;
	}

[github-actions]

Benchmark Index (community)

Details

Benchmark suite	Current: fc603ba	Previous: 868f8a0	Ratio
Add one schema (0 existing)	284 ms	320 ms	0.89
Add one schema (100 existing)	24 ms	30 ms	0.80
Add one schema (1000 existing)	92 ms	86 ms	1.07
Add one schema (10000 existing)	836 ms	733 ms	1.14
Update one schema (1 existing)	17 ms	21 ms	0.81
Update one schema (101 existing)	24 ms	29 ms	0.83
Update one schema (1001 existing)	93 ms	86 ms	1.08
Update one schema (10001 existing)	1213 ms	734 ms	1.65
Cached rebuild (1 existing)	6 ms	7 ms	0.86
Cached rebuild (101 existing)	8 ms	9 ms	0.89
Cached rebuild (1001 existing)	26 ms	29 ms	0.90
Cached rebuild (10001 existing)	234 ms	249 ms	0.94
Index 100 schemas	695 ms	645 ms	1.08
Index 1000 schemas	1291 ms	1471 ms	0.88
Index 10000 schemas	12764 ms	14057 ms	0.91
Index 10000 schemas (custom meta-schema)	16283 ms	16806 ms	0.97
Index 10000 schemas ($ref fan-out)	17350 ms	16686 ms	1.04

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Benchmark Index (enterprise)

Details

Benchmark suite	Current: fc603ba	Previous: 868f8a0	Ratio
Add one schema (0 existing)	397 ms	263 ms	1.51
Add one schema (100 existing)	113 ms	262 ms	0.43
Add one schema (1000 existing)	171 ms	126 ms	1.36
Add one schema (10000 existing)	850 ms	941 ms	0.90
Update one schema (1 existing)	105 ms	110 ms	0.95
Update one schema (101 existing)	110 ms	75 ms	1.47
Update one schema (1001 existing)	171 ms	176 ms	0.97
Update one schema (10001 existing)	872 ms	730 ms	1.19
Cached rebuild (1 existing)	9 ms	5 ms	1.80
Cached rebuild (101 existing)	11 ms	6 ms	1.83
Cached rebuild (1001 existing)	34 ms	17 ms	2
Cached rebuild (10001 existing)	284 ms	154 ms	1.84
Index 100 schemas	662 ms	1138 ms	0.58
Index 1000 schemas	1533 ms	1571 ms	0.98
Index 10000 schemas	13653 ms	10542 ms	1.30
Index 10000 schemas (custom meta-schema)	16705 ms	14967 ms	1.12
Index 10000 schemas ($ref fan-out)	16592 ms	15585 ms	1.06

This comment was automatically generated by workflow using github-action-benchmark.