[FEATURE] Authenticated Streamable HTTP MCP connector for GitNexus

Problem

Astron Agent can connect to URL-based MCP servers over Streamable HTTP/SSE, but its current MCP request schema carries only server IDs/URLs, tool arguments, and transport selection. The shared httpx.AsyncClient is created without per-server request headers, so a workflow cannot authenticate to a Bearer-protected MCP endpoint without putting credentials in an unsafe place.

GitNexus is a concrete compatibility fixture. Its dedicated HTTP MCP server:

• binds to loopback by default;
• refuses any non-loopback bind unless --auth-token or GITNEXUS_MCP_AUTH_TOKEN is set;
• expects Authorization: Bearer <token>;
• supports GITNEXUS_MCP_READ_ONLY=1 to remove raw Cypher, rename, group routing, and other non-read-only surfaces.

Astron also intentionally rejects loopback MCP URLs. As a result, the safe GitNexus modes do not currently meet: stdio is not an Astron URL transport, loopback HTTP is rejected, and non-loopback HTTP requires a header Astron cannot supply. Publishing an unauthenticated endpoint would expose indexed source code and is not an acceptable workaround.

Proposed solution

Add a managed authentication contract for URL-based MCP servers, starting with Bearer tokens for Streamable HTTP:

1. Store an optional per-server credential reference in Astron's secret/credential storage; do not persist the token in workflow JSON or return it from read APIs.
2. Resolve the secret only inside the MCP service and add Authorization: Bearer <token> to both tool discovery and tool calls.
3. Keep URL and transport separately configured. Reject credentials embedded in URLs and do not accept arbitrary model-supplied headers.
4. Redact the token and Authorization header from application logs, OTLP spans, Kafka telemetry, exceptions, and API responses.
5. Preserve the existing loopback prohibition and configured domain/IP/network blacklists. Revalidate redirect destinations and never forward credentials to a different origin.
6. Allow operators to restrict the exposed tool set; recommend GitNexus read-only mode by default and require an explicit policy decision before exposing mutating tools.
7. Use the same credential resolution path for agent-bound MCP servers and explicit MCP workflow nodes so behavior cannot diverge.

Acceptance fixture

Pin these baselines:

• abhigyanpatwari/GitNexus@7e993ab8972386294fb96bf14a8665d0b5325397
• iflytek/astron-agent@aaef2a286b9fb8396d42d5d4f6bb7af9b19afa22

Run GitNexus behind a private, routable HTTPS ingress with its dedicated MCP server configured equivalently to:

GITNEXUS_MCP_READ_ONLY=1 \
GITNEXUS_MCP_AUTH_TOKEN=<secret> \
gitnexus mcp --http --host 0.0.0.0 --port 3000

The external MCP URL ends in /mcp; <secret> and the ingress hostname are operator-provided placeholders.

• Missing or incorrect credentials produce 401 and no tool list.
• A valid secret allows Streamable HTTP initialization, list_repos, and a bounded read-only query.
• The Authorization value never appears in workflow JSON, logs, traces, telemetry, or responses.
• rename, raw cypher, and group/mutation surfaces are absent or rejected under GITNEXUS_MCP_READ_ONLY=1.
• Tool listing and later tool execution use the same server credential reference.
• Cross-origin redirects, loopback targets, and configured blacklisted destinations remain blocked without leaking the credential.
• Credential rotation takes effect without rewriting every workflow that references the MCP server.
• Tests cover Streamable HTTP success, 401 failure, redaction, redirect handling, and SSRF-policy preservation.

Current implementation evidence

• GitNexus bearer/non-loopback enforcement: https://github.com/abhigyanpatwari/GitNexus/blob/7e993ab8972386294fb96bf14a8665d0b5325397/gitnexus/src/mcp/http-transport.ts
• GitNexus read-only policy: https://github.com/abhigyanpatwari/GitNexus/blob/7e993ab8972386294fb96bf14a8665d0b5325397/gitnexus/src/mcp/read-only-policy.ts
• Astron MCP request schema (no header/credential field): https://github.com/iflytek/astron-agent/blob/aaef2a286b9fb8396d42d5d4f6bb7af9b19afa22/core/plugin/link/api/schemas/community/tools/mcp/mcp_tools_schema.py
• Astron HTTP client construction and transport selection: https://github.com/iflytek/astron-agent/blob/aaef2a286b9fb8396d42d5d4f6bb7af9b19afa22/core/plugin/link/service/community/tools/mcp/mcp_transport.py
• Astron loopback rejection: https://github.com/iflytek/astron-agent/blob/aaef2a286b9fb8396d42d5d4f6bb7af9b19afa22/core/plugin/link/utils/security/access_interceptor.py

Licensing note

GitNexus uses the PolyForm Noncommercial License 1.0.0. The connector must not imply that Astron's Apache-2.0 license changes GitNexus's license or grants commercial deployment rights; operators must review GitNexus licensing separately.