kyleandClaude Opus 4.6
18756f62b7
MCR can now redirect users to MCIAS for login instead of showing its own login form. This enables passkey/FIDO2 authentication since WebAuthn credentials are bound to MCIAS's domain. - Add optional [sso] config section with redirect_uri - Add handleSSOLogin (redirects to MCIAS) and handleSSOCallback (exchanges code for JWT, validates roles, sets session cookie) - SSO is opt-in: when redirect_uri is empty, the existing login form is used (backward compatible) - Guest role check preserved in SSO callback path - Return-to URL preserved across the SSO redirect - Uses mcdsl/sso package (local replace for now) Security: - State cookie uses SameSite=Lax for cross-site redirect compatibility - Session cookie remains SameSite=Strict (same-site only after login) - Code exchange is server-to-server over TLS 1.3 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MCR
Metacircular Container Registry -- an OCI Distribution Spec-compliant container registry for the Metacircular platform. MCR stores and serves container images with authentication delegated to MCIAS and a local policy engine for fine-grained access control. Metadata is stored in SQLite; blobs are stored as content-addressed files on the filesystem.
Quick Start
Build the binaries:
make all
This produces three binaries:
| Binary | Purpose |
|---|---|
mcrsrv |
Registry server (OCI + admin REST + gRPC) |
mcr-web |
Web UI (htmx, communicates with mcrsrv via gRPC) |
mcrctl |
Admin CLI |
Copy and edit the example configuration:
cp deploy/examples/mcr.toml /srv/mcr/mcr.toml
# Edit TLS paths, database path, storage paths, MCIAS URL
Run the server:
./mcrsrv server --config /srv/mcr/mcr.toml
The server starts two listeners:
| Port | Protocol | Purpose |
|---|---|---|
| 8443 | TCP | HTTPS -- OCI Distribution endpoints + admin REST API |
| 9443 | TCP | gRPC admin API (TLS, MCIAS auth) |
Run the web UI:
./mcr-web server --config /srv/mcr/mcr.toml
| Port | Protocol | Purpose |
|---|---|---|
| 8080 | TCP | HTTP -- web UI (repository browsing, policy management) |
Documentation
- ARCHITECTURE.md -- full technical specification, OCI compliance details, database schema, policy engine, and security model.
- RUNBOOK.md -- operational procedures, health checks, backup/restore, incident response, and MCP deployment.
- CLAUDE.md -- context for AI-assisted development.