systemprompt-api 0.19.0

Axum-based HTTP server and API gateway for systemprompt.io AI governance infrastructure. Exposes governed agents, MCP, A2A, and admin endpoints with rate limiting and RBAC.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

//! MCP-over-HTTP forwarding for external servers.
//!
//! An external MCP server has no local backend port; instead the gateway mints
//! a per-user provider bearer server-side and forwards the MCP frames to the
//! provider endpoint, withholding the systemprompt credential and the provider
//! URL from the client. A client-mediated `tools/call` is audited under the
//! calling user via the response tap.

use std::collections::HashMap;

use axum::body::Body;
use axum::extract::Request;
use axum::http::{HeaderMap, HeaderName, HeaderValue};
use axum::response::Response;
use systemprompt_mcp::repository::ToolUsageRepository;
use systemprompt_mcp::services::client::McpClient;
use systemprompt_mcp::{McpDomainError, McpServerConfig};
use systemprompt_models::RequestContext;
use systemprompt_runtime::AppContext;

use super::super::audit::{self, McpAudit, parse_tool_call};
use super::super::auth::{AccessValidator, mcp_oauth_requirement};
use super::super::backend::{ProxyError, RequestBuilder, ResponseHandler};
use super::ProxyEngine;

const MCP_PASSTHROUGH_HEADERS: [&str; 4] = [
    "content-type",
    "accept",
    "mcp-session-id",
    "mcp-protocol-version",
];

impl ProxyEngine {
    pub(super) async fn proxy_external_mcp(
        &self,
        service_name: &str,
        request: Request<Body>,
        ctx: AppContext,
        server_config: McpServerConfig,
    ) -> Result<Response<Body>, ProxyError> {
        let req_ctx = request
            .extensions()
            .get::<RequestContext>()
            .cloned()
            .ok_or_else(|| ProxyError::MissingContext {
                message: "external MCP proxy requires an authenticated request context".to_owned(),
            })?;

        let requirement = mcp_oauth_requirement(&ctx, service_name).await?;
        AccessValidator::validate_with_requirement(
            request.headers(),
            service_name,
            &requirement,
            &ctx,
            Some(&req_ctx),
        )?;

        let target = McpClient::resolve_external_proxy_target(&server_config, &req_ctx)
            .await
            .map_err(|e| map_resolve_error(service_name, e))?;

        let method_str = request.method().to_string();
        let incoming_headers = request.headers().clone();
        let body = RequestBuilder::extract_body(request.into_body())
            .await
            .map_err(|source| ProxyError::BodyExtractionFailed { source })?;

        let audit = build_audit(&ctx, &req_ctx, service_name, &body);
        let outbound = outbound_headers(&incoming_headers, target.headers);

        let method = RequestBuilder::parse_method(&method_str)
            .map_err(|reason| ProxyError::InvalidMethod { reason })?;
        let client = self.client_pool.get_default_client();
        let response = RequestBuilder::build_request(&client, method, &target.url, &outbound, body)
            .send()
            .await
            .map_err(|source| ProxyError::ConnectionFailed {
                service: service_name.to_owned(),
                url: target.url.clone(),
                source,
            })?;

        let to_invalid = |reason| ProxyError::InvalidResponse {
            service: service_name.to_owned(),
            reason,
        };
        match audit {
            Some(audit) => audit::record(response, audit).await.map_err(to_invalid),
            None => ResponseHandler::build_response(response).map_err(to_invalid),
        }
    }
}

pub(super) fn outbound_headers(
    incoming: &HeaderMap,
    provider: HashMap<HeaderName, HeaderValue>,
) -> HeaderMap {
    let mut headers = HeaderMap::new();
    for name in MCP_PASSTHROUGH_HEADERS {
        if let Some(value) = incoming.get(name) {
            headers.insert(HeaderName::from_static(name), value.clone());
        }
    }
    for (name, value) in provider {
        headers.insert(name, value);
    }
    headers
}

fn build_audit(
    ctx: &AppContext,
    req_ctx: &RequestContext,
    service_name: &str,
    body: &[u8],
) -> Option<McpAudit> {
    let invocation = parse_tool_call(body)?;
    match ToolUsageRepository::new(ctx.db_pool()) {
        Ok(repo) => Some(McpAudit::new(
            std::sync::Arc::new(repo),
            req_ctx.clone(),
            service_name.to_owned(),
            invocation,
        )),
        Err(e) => {
            tracing::warn!(service = %service_name, error = %e, "Tool-usage repository unavailable; external MCP call not audited");
            None
        },
    }
}

pub(super) fn map_resolve_error(service_name: &str, error: McpDomainError) -> ProxyError {
    match error {
        McpDomainError::AuthRequired(_) => ProxyError::AuthenticationRequired {
            service: service_name.to_owned(),
        },
        McpDomainError::ExternalAuthUnavailable { message, .. } => ProxyError::ServiceNotRunning {
            service: service_name.to_owned(),
            status: message,
        },
        other => ProxyError::InvalidResponse {
            service: service_name.to_owned(),
            reason: other.to_string(),
        },
    }
}