Sep 16, 2025 · Sep 12, 2025 · Sep 16, 2025
diff --git a/cli/server.go b/cli/server.go
 provider.DisplayName = v.Value
 case "DISPLAY_ICON":
 provider.DisplayIcon = v.Value
 case "MCP_URL":
 provider.MCPURL = v.Value
 case "MCP_TOOL_ALLOW_REGEX":
 provider.MCPToolAllowRegex = v.Value
 case "MCP_TOOL_DENY_REGEX":
 provider.MCPToolDenyRegex = v.Value
 }
 providers[providerNum] = provider
 }
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/externalauth/externalauth.go b/coderd/externalauth/externalauth.go
 // AppInstallationsURL is an API endpoint that returns a list of
 // installations for the user. This is used for GitHub Apps.
 AppInstallationsURL string
 // MCPURL is the endpoint that clients must use to communicate with the associated
 // MCP server.
 MCPURL string
 // MCPToolAllowRegex is a [regexp.Regexp] to match tools which are explicitly allowed to be
 // injected into Coder AI Bridge upstream requests.
 // In the case of conflicts, [MCPToolDenylistPattern] overrides items evaluated by this list.
 // This field can be nil if unspecified in the config.
 MCPToolAllowRegex *regexp.Regexp
 // MCPToolDenyRegex is a [regexp.Regexp] to match tools which are explicitly NOT allowed to be
 // injected into Coder AI Bridge upstream requests.
 // In the case of conflicts, items evaluated by this list override [MCPToolAllowRegex].
 // This field can be nil if unspecified in the config.
 MCPToolDenyRegex *regexp.Regexp
 }

 // GenerateTokenExtra generates the extra token data to store in the database.
 instrumented = instrument.NewGithub(entry.ID, oauthConfig)
 }

 var mcpToolAllow *regexp.Regexp
 var mcpToolDeny *regexp.Regexp
 if entry.MCPToolAllowRegex != "" {
 mcpToolAllow, err = regexp.Compile(entry.MCPToolAllowRegex)
 if err != nil {
 return nil, xerrors.Errorf("compile MCP tool allow regex for external auth provider %q: %w", entry.ID, entry.MCPToolAllowRegex)
 }
 }
 if entry.MCPToolDenyRegex != "" {
 mcpToolDeny, err = regexp.Compile(entry.MCPToolDenyRegex)
 if err != nil {
 return nil, xerrors.Errorf("compile MCP tool deny regex for external auth provider %q: %w", entry.ID, entry.MCPToolDenyRegex)
 }
 }

 cfg := &Config{
 InstrumentedOAuth2Config: instrumented,
 ID:                       entry.ID,
 DisplayName:              entry.DisplayName,
 DisplayIcon:              entry.DisplayIcon,
 ExtraTokenKeys:           entry.ExtraTokenKeys,
 MCPURL:                   entry.MCPURL,
 MCPToolAllowRegex:        mcpToolAllow,
 MCPToolDenyRegex:         mcpToolDeny,
 }

 if entry.DeviceFlow {
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
 ExtraTokenKeys      []string `json:"-" yaml:"extra_token_keys"`
 DeviceFlow          bool     `json:"device_flow" yaml:"device_flow"`
 DeviceCodeURL       string   `json:"device_code_url" yaml:"device_code_url"`
 MCPURL              string   `json:"mcp_url" yaml:"mcp_url"`
 MCPToolAllowRegex   string   `json:"mcp_tool_allow_regex" yaml:"mcp_tool_allow_regex"`
 MCPToolDenyRegex    string   `json:"mcp_tool_deny_regex" yaml:"mcp_tool_deny_regex"`
 // Regex allows API requesters to match an auth config by
 // a string (e.g. coder.com) instead of by it's type.
 //
diff --git a/codersdk/deployment_test.go b/codersdk/deployment_test.go
 Regex:               "^https://example.com/.*$",
 DisplayName:         "GitHub",
 DisplayIcon:         "/static/icons/github.svg",
 MCPURL:              "https://api.githubcopilot.com/mcp/",
 MCPToolAllowRegex:   ".*",
 MCPToolDenyRegex:    "create_gist",
 }

 // Input the github section twice for testing a slice of configs.
diff --git a/codersdk/testdata/githubcfg.yaml b/codersdk/testdata/githubcfg.yaml
      - token
    device_flow: true
    device_code_url: https://example.com/device
    mcp_url: https://api.githubcopilot.com/mcp/
    mcp_tool_allow_regex: .*
    mcp_tool_deny_regex: create_gist
    regex: ^https://example.com/.*$
    display_name: GitHub
    display_icon: /static/icons/github.svg
diff --git a/docs/reference/api/general.md b/docs/reference/api/general.md
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
diff --git a/.../DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx b/.../DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx
 device_code_url: "",
 display_icon: "",
 display_name: "GitHub",
 mcp_url: "",
 mcp_tool_allow_regex: "",
 mcp_tool_deny_regex: "",
 },
 ],
 },
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2722,6 +2722,12 @@ func parseExternalAuthProvidersFromEnv(prefix string, environ []string) ([]coder
		provider.DisplayName = v.Value
		case "DISPLAY_ICON":
		provider.DisplayIcon = v.Value
		case "MCP_URL":
		provider.MCPURL = v.Value
		case "MCP_TOOL_ALLOW_REGEX":
		provider.MCPToolAllowRegex = v.Value
		case "MCP_TOOL_DENY_REGEX":
		provider.MCPToolDenyRegex = v.Value
		}
		providers[providerNum] = provider
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -81,6 +81,19 @@ type Config struct {
		// AppInstallationsURL is an API endpoint that returns a list of
		// installations for the user. This is used for GitHub Apps.
		AppInstallationsURL string
		// MCPURL is the endpoint that clients must use to communicate with the associated
		// MCP server.
		MCPURL string
		// MCPToolAllowRegex is a [regexp.Regexp] to match tools which are explicitly allowed to be
		// injected into Coder AI Bridge upstream requests.
		// In the case of conflicts, [MCPToolDenylistPattern] overrides items evaluated by this list.
		// This field can be nil if unspecified in the config.
		MCPToolAllowRegex *regexp.Regexp
		// MCPToolDenyRegex is a [regexp.Regexp] to match tools which are explicitly NOT allowed to be
		// injected into Coder AI Bridge upstream requests.
		// In the case of conflicts, items evaluated by this list override [MCPToolAllowRegex].
		// This field can be nil if unspecified in the config.
		MCPToolDenyRegex *regexp.Regexp
		}

		// GenerateTokenExtra generates the extra token data to store in the database.
Expand DownExpand Up		@@ -608,6 +621,21 @@ func ConvertConfig(instrument *promoauth.Factory, entries []codersdk.ExternalAut
		instrumented = instrument.NewGithub(entry.ID, oauthConfig)
		}

		var mcpToolAllow *regexp.Regexp
		var mcpToolDeny *regexp.Regexp
		if entry.MCPToolAllowRegex != "" {
		mcpToolAllow, err = regexp.Compile(entry.MCPToolAllowRegex)
		if err != nil {
		return nil, xerrors.Errorf("compile MCP tool allow regex for external auth provider %q: %w", entry.ID, entry.MCPToolAllowRegex)
		}
		}
		if entry.MCPToolDenyRegex != "" {
		mcpToolDeny, err = regexp.Compile(entry.MCPToolDenyRegex)
		if err != nil {
		return nil, xerrors.Errorf("compile MCP tool deny regex for external auth provider %q: %w", entry.ID, entry.MCPToolDenyRegex)
		}
		}

		cfg := &Config{
		InstrumentedOAuth2Config: instrumented,
		ID: entry.ID,
Expand All		@@ -620,6 +648,9 @@ func ConvertConfig(instrument *promoauth.Factory, entries []codersdk.ExternalAut
		DisplayName: entry.DisplayName,
		DisplayIcon: entry.DisplayIcon,
		ExtraTokenKeys: entry.ExtraTokenKeys,
		MCPURL: entry.MCPURL,
		MCPToolAllowRegex: mcpToolAllow,
		MCPToolDenyRegex: mcpToolDeny,
		}

		if entry.DeviceFlow {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -742,6 +742,9 @@ type ExternalAuthConfig struct {
		ExtraTokenKeys []string `json:"-" yaml:"extra_token_keys"`
		DeviceFlow bool `json:"device_flow" yaml:"device_flow"`
		DeviceCodeURL string `json:"device_code_url" yaml:"device_code_url"`
		MCPURL string `json:"mcp_url" yaml:"mcp_url"`
		MCPToolAllowRegex string `json:"mcp_tool_allow_regex" yaml:"mcp_tool_allow_regex"`
		MCPToolDenyRegex string `json:"mcp_tool_deny_regex" yaml:"mcp_tool_deny_regex"`
		// Regex allows API requesters to match an auth config by
		// a string (e.g. coder.com) instead of by it's type.
		//
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -399,6 +399,9 @@ func TestExternalAuthYAMLConfig(t *testing.T) {
		Regex: "^https://example.com/.*$",
		DisplayName: "GitHub",
		DisplayIcon: "/static/icons/github.svg",
		MCPURL: "https://api.githubcopilot.com/mcp/",
		MCPToolAllowRegex: ".*",
		MCPToolDenyRegex: "create_gist",
		}

		// Input the github section twice for testing a slice of configs.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -17,6 +17,9 @@ externalAuthProviders:
		- token
		device_flow: true
		device_code_url: https://example.com/device
		mcp_url: https://api.githubcopilot.com/mcp/
		mcp_tool_allow_regex: .*
		mcp_tool_deny_regex: create_gist
		regex: ^https://example.com/.*$
		display_name: GitHub
		display_icon: /static/icons/github.svg
Original file line number	Diff line number	Diff line change
Expand Up		@@ -23,6 +23,9 @@ const meta: Meta<typeof ExternalAuthSettingsPageView> = {
		device_code_url: "",
		display_icon: "",
		display_name: "GitHub",
		mcp_url: "",
		mcp_tool_allow_regex: "",
		mcp_tool_deny_regex: "",
		},
		],
		},
Expand Down