Add mandatory API key authentication and TLS encryption#44
Open
Add mandatory API key authentication and TLS encryption#44
Conversation
Server: - Add require_api_key decorator protecting all /api/ endpoints - Health check (/health) remains unauthenticated (standard practice) - API key set via --api-key flag, --generate-api-key, or MKS_API_KEY env var - Uses hmac.compare_digest for constant-time comparison (prevents timing attacks) - Gracefully degrades: no key configured = auth disabled (backward compatible) - Returns 401 for missing key, 403 for invalid key Client: - Add --api-key flag and MKS_API_KEY env var support - Sends X-API-Key header on all requests when configured Config/Docs: - Updated mcp-kali-server.json with --api-key placeholder - Updated README with auth docs, examples, and all command snippets - Added .env to .gitignore to prevent accidental key commits Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Server always requires an API key: provided via --api-key, MKS_API_KEY env var, or auto-generated at startup if neither is set - Remove --generate-api-key flag (auto-generation is now the default) - Remove skip-auth path from require_api_key decorator - Update README to reflect mandatory auth and remove optional language Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…erts Server: - HTTPS by default using self-signed RSA 4096 certificates - Certs auto-generated on first run, stored in ~/.mcp-kali-server/certs/ - --insecure-http flag to disable TLS (warns loudly, local-only use) - --cert/--key flags for custom certificates - Key file permissions restricted to 0600 Client: - Default server URL changed to https://localhost:5000 - --skip-verify flag for self-signed certificate support - Suppresses urllib3 InsecureRequestWarning when --skip-verify is used - verify parameter passed to all requests calls Config/Docs: - All URLs updated to https:// throughout README and config - Documented --insecure-http, --skip-verify, --cert, --key flags - Added *.pem, *.crt, *.key to .gitignore Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two new security features that make MCP-Kali-Server secure by default:
1. Mandatory API Key Authentication
/api/endpoints require a validX-API-Keyheader/health) remains open for monitoringhmac.compare_digest()for constant-time comparison (prevents timing attacks)--api-keyflag >MKS_API_KEYenv var > auto-generate2. TLS Encryption by Default
openssl, stored in~/.mcp-kali-server/certs/0600--insecure-httpto disable TLS (displays loud warning, intended for local-only use)--cert/--keyflags for custom certificates--skip-verifyfor self-signed cert supportFiles Changed
server.py--insecure-http/--cert/--keyflagsclient.py--api-key,--skip-verifyflags,X-API-Keyheader, default URL →https://README.mdhttps://mcp-kali-server.json--api-key,--skip-verify, URL →https://.gitignore.env,*.pem,*.crt,*.keyTest plan
API Key:
--api-key mykey— uses provided keyX-API-Keyheader → 401/healthworks without any keyTLS:
~/.mcp-kali-server/certs/--skip-verifyconnects to self-signed server--skip-verifyfails on self-signed cert (expected)--insecure-httpdisables TLS, shows warning--cert/--keywith custom cert works🤖 Generated with Claude Code