feat: add certificate trust configuration for MCP servers #8357

roomote · 2025-09-28T18:47:50Z

Summary

This PR addresses Issue #8355 by adding certificate trust configuration support for MCP servers using HTTPS connections (SSE and StreamableHTTP transports).

Problem

MCP servers using self-signed or internal CA-signed certificates cannot be used because there's no way to specify trust information for these certificates. This prevents users from connecting to MCP servers in development environments or corporate networks with internal certificate authorities.

Solution

Added a certificateTrust configuration option for SSE and StreamableHTTP server types with three settings:

allowSelfSigned: Allow self-signed certificates (for development)
caCertPath: Path to custom CA certificate file (for internal CAs)
rejectUnauthorized: Control certificate validation (defaults to true for security)

Changes

✅ Added CertificateTrustSchema to validate certificate trust configuration
✅ Implemented HTTPS agent configuration for SSE transport using custom fetch
✅ Implemented HTTPS agent configuration for StreamableHTTP transport
✅ Added comprehensive test coverage for all configuration scenarios
✅ Created detailed documentation with examples and security considerations

Testing

All existing tests pass
Added 6 new test cases covering certificate trust configuration
TypeScript type checking passes
Linting passes

Security Considerations

Defaults to secure settings (rejectUnauthorized: true)
Documentation includes clear warnings about development-only settings
Proper error handling for certificate file loading

Documentation

Added comprehensive documentation in docs/mcp-certificate-trust.md including:

Configuration examples for all scenarios
Security best practices
Certificate format conversion instructions
Troubleshooting guide

Fixes #8355

Important

Adds certificate trust configuration for MCP servers using HTTPS, with support for self-signed and custom CA certificates.

Behavior:
- Adds certificateTrust configuration for SSE and StreamableHTTP transports in McpHub.ts.
- Supports allowSelfSigned, caCertPath, and rejectUnauthorized options.
- Defaults rejectUnauthorized to true for security.
Schema:
- Introduces CertificateTrustSchema for validating certificate trust settings.
Implementation:
- Configures HTTPS agent in connectToServer() for streamable-http and sse types.
- Handles certificate loading and error logging.
Testing:
- Adds tests in McpHub.spec.ts for various certificate trust configurations.
- Ensures correct behavior for SSE and StreamableHTTP with and without certificate trust.
Documentation:
- Adds mcp-certificate-trust.md with configuration examples and security notes.

^{This description was created by}^{for b73bd7c. You can customize this summary. It will automatically update as commits are pushed.}

- Add certificateTrust configuration options for SSE and StreamableHTTP transports - Support allowSelfSigned, caCertPath, and rejectUnauthorized options - Implement HTTPS agent configuration for Node.js fetch operations - Add comprehensive tests for certificate trust configuration - Add documentation explaining usage and security considerations Fixes #8355

- Use spread operator with type assertion for Node.js-specific agent property - Ensures compatibility with standard RequestInit type while allowing HTTPS agent

ellipsis-dev · 2025-09-28T18:49:34Z

src/services/mcp/McpHub.ts

+					headers: configInjected.headers,
+				}
+
+				// Apply certificate trust settings if configured


The certificate trust configuration logic for both the 'streamable-http' and 'sse' branches is nearly identical. Consider extracting this duplicated code into a shared helper function to improve maintainability.

^{This comment was generated because it violated a code review rule: irule_tTqpIuNs8DV0QFGj.}

roomote

Self-reviewing my own code like a linter staring into a mirror; flagging issues without mercy.

roomote · 2025-09-28T18:58:18Z

.review/pr-8274

@@ -0,0 +1 @@
+Subproject commit e46929b8d8add0cd3c412d69f8ac882c405a4ba9


[P0] Accidental submodule/gitlink committed. Please remove this file from the PR and add the .review directory to .gitignore to prevent future commits.

roomote · 2025-09-28T18:58:18Z

tmp/pr-8287-Roo-Code

@@ -0,0 +1 @@
+Subproject commit 88a473b017af37091c85ce3056e444e856f80d6e


[P0] Accidental submodule/gitlink committed. Please remove this file from the PR and add the tmp directory to .gitignore to prevent future commits.

roomote · 2025-09-28T18:58:18Z

src/services/mcp/McpHub.ts

+
+						// Create HTTPS agent with certificate trust settings
+						const agent = new https.Agent(agentOptions)
+						;(requestInit as any).agent = agent


[P1] Using https.Agent and assigning requestInit.agent will be ignored by Node’s built-in fetch (Undici). Use undici.Agent (or Pool) and pass it via the RequestInit "dispatcher" option so TLS settings (ca/rejectUnauthorized) actually apply for streamable-http.

roomote · 2025-09-28T18:58:18Z

src/services/mcp/McpHub.ts

+							return fetch(url, {
+								...init,
+								headers,
+								...({ agent } as any),


[P1] The custom fetch for SSE sets an "agent" option, which Undici-based fetch ignores. Build an Undici Agent/Pool and pass it via the "dispatcher" option here to ensure certificateTrust takes effect during reconnects.

roomote · 2025-09-28T18:58:18Z

src/services/mcp/McpHub.ts

+						const agentOptions: any = {}
+
+						// Handle certificate rejection
+						if (rejectUnauthorized === false || allowSelfSigned === true) {


[P2] Precedence between allowSelfSigned and rejectUnauthorized is implicit (this forces rejectUnauthorized=false if allowSelfSigned=true). Consider validating mutually exclusive/precedence in schema and documenting it to avoid confusing combos.

roomote · 2025-09-28T18:58:18Z

src/services/mcp/McpHub.ts

+						// Load CA certificate if provided
+						if (caCertPath) {
+							try {
+								const caCert = await fs.readFile(caCertPath, "utf-8")


[P2] caCertPath: consider supporting multiple CA files (array) and validating absolute vs relative paths with clearer error messages. Node agents accept an array for "ca".

roomote · 2025-09-28T18:58:18Z

src/services/mcp/McpHub.ts

+					headers: configInjected.headers,
+				}
+
+				// Apply certificate trust settings if configured


[P3] The certificate-trust wiring is duplicated across streamable-http and sse branches. Consider factoring a helper that returns the proper fetch options (Undici dispatcher) to reduce drift.

roomote · 2025-09-28T18:58:18Z

src/services/mcp/McpHub.ts

+						const https = await import("https")
+						const fs = await import("fs/promises")
+
+						const agentOptions: any = {}


[P3] agentOptions is typed as any. Replace with a typed shape (and avoid casting requestInit as any) to improve maintainability.

roomote · 2025-09-28T18:58:18Z

src/services/mcp/__tests__/McpHub.spec.ts

 	})

+	describe("Certificate trust configuration", () => {
+		it("should accept SSE server with certificate trust configuration", () => {


[P3] These tests cover schema parsing only. Add runtime tests that assert a dispatcher/agent is passed to fetch and that TLS options (ca/rejectUnauthorized) are honored (can be done with mocked Undici fetch).

…/Roo-Code#8357)

daniel-lxs · 2025-10-14T18:33:43Z

Messy PR

roomote added 2 commits September 28, 2025 18:43

fix: resolve TypeScript type error for agent property in fetch

b73bd7c

- Use spread operator with type assertion for Node.js-specific agent property - Ensures compatibility with standard RequestInit type while allowing HTTPS agent

roomote bot requested review from cte, jr and mrubens as code owners September 28, 2025 18:47

github-project-automation bot added this to Roo Code Roadmap and Roo Code Roadmap Sep 28, 2025

github-project-automation bot moved this to New in Roo Code Roadmap Sep 28, 2025

github-project-automation bot moved this to Triage in Roo Code Roadmap Sep 28, 2025

dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. documentation Improvements or additions to documentation enhancement New feature or request labels Sep 28, 2025

roomote bot mentioned this pull request Sep 28, 2025

[ENHANCEMENT] MCP server using self or internal CA signed certificate cannot be used #8355

Open

2 tasks

ellipsis-dev bot reviewed Sep 28, 2025

View reviewed changes

roomote bot commented Sep 28, 2025

View reviewed changes

hannesrudolph added the Issue/PR - Triage New issue. Needs quick review to confirm validity and assign labels. label Sep 28, 2025

daniel-lxs added a commit to DanCodeInc/RooCode that referenced this pull request Oct 2, 2025

docs: upstream PR 8357 notes — title and description only (RooCodeInc…

84140c7

…/Roo-Code#8357)

daniel-lxs mentioned this pull request Oct 2, 2025

docs: import upstream Roo-Code#8357 title & description DanCodeInc/RooCode#4

Closed

daniel-lxs closed this Oct 14, 2025

github-project-automation bot moved this from New to Done in Roo Code Roadmap Oct 14, 2025

github-project-automation bot moved this from Triage to Done in Roo Code Roadmap Oct 14, 2025

		@@ -0,0 +1 @@
		Subproject commit e46929b8d8add0cd3c412d69f8ac882c405a4ba9

		@@ -0,0 +1 @@
		Subproject commit 88a473b017af37091c85ce3056e444e856f80d6e

feat: add certificate trust configuration for MCP servers #8357

feat: add certificate trust configuration for MCP servers #8357

Uh oh!

Conversation

roomote bot commented Sep 28, 2025 • edited by ellipsis-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Solution

Changes

Testing

Security Considerations

Documentation

Uh oh!

ellipsis-dev bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot left a comment

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

roomote bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

daniel-lxs commented Oct 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

roomote bot commented Sep 28, 2025 •

edited by ellipsis-dev bot

Loading