feat: RFC 6570 URI templates with operator-aware security#2356

Draft

maxisbey wants to merge 47 commits intomainfrom

feat/uri-template-rfc6570

Commits on Mar 26, 2026

feat: add RFC 6570 URI template utility with bidirectional support
maxisbey
committed
feat: add filesystem path safety primitives
maxisbey
committed
feat: integrate UriTemplate into MCPServer resource templates
maxisbey
committed
feat: wire ResourceSecurity into MCPServer configuration
maxisbey
committed
docs: add migration guide entry for resource template changes
maxisbey
committed
refactor: accept plain set for ResourceSecurity.exempt_params
maxisbey
committed
docs: add resources guide covering templates, security, and low-level usage
maxisbey
committed
feat: reject duplicate variable names in URI templates
maxisbey
committed
test: add adversarial security test cases for layered defense
maxisbey
committed
feat: add UriTemplate.is_template() static method
maxisbey
committed
feat: add URI length guard to UriTemplate.match()
maxisbey
committed
test: add edge-case coverage for literal handling and anchoring
maxisbey
committed
feat: reject null bytes in safe_join path components
maxisbey
committed
fix: decide template vs static purely on URI variables
maxisbey
committed
fix: correct ; operator matching and expansion per RFC 6570
maxisbey
committed
refactor: remove post-decode structural checks from UriTemplate.match
maxisbey
committed
feat: lenient query param matching for {?var} and {&var}
maxisbey
committed
fix: tighten parse-time validation and document matching limits
maxisbey
committed
fix: preserve pct-triplets in reserved expansion; allow empty match captures
maxisbey
committed
refactor: use lists instead of tuples for variable-length sequences
maxisbey
committed
docs: trim migration guide to breaking changes only
maxisbey
committed
docs: clarify query leniency and fix exempt_params example
maxisbey
committed
fix: reject template patterns causing O(n²) regex backtracking
maxisbey
committed
docs: address reviewer feedback on migration guide and resources doc
maxisbey
committed
test: close coverage gaps in lenient-query branch and test handlers
maxisbey
committed
fix: correct lenient query matching for +, fragments, and standalone {&var}
maxisbey
committed
docs: fix stale docstrings and export DEFAULT_MAX_* constants
maxisbey
committed
test: move new resource tests to module level per repo convention
maxisbey
committed
test: close coverage gaps in _parse_query and _split_query_tail fallbacks
maxisbey
committed
fix: preserve empty list items in explode matching
maxisbey
committed
refactor: simplify explode split since regex guarantees leading separator
maxisbey
committed
fix: fall back to strict regex when path contains {#...} or literal #
maxisbey
committed

Commits on Mar 27, 2026