mirror of
https://github.com/cline/cline.git
synced 2026-08-29 03:52:41 +08:00
Saoud Rizwan
7d366ce7d4
* fix(vscode): enforce enterprise MCP controls on the Customize marketplace The unified Customize marketplace replaced the old MCP marketplace without carrying over enterprise remote-config enforcement: the catalog RPC returned every MCP entry and installs were never policy-checked, so orgs with mcpMarketplaceEnabled=false or an allowedMCPServers allowlist saw (and could install) all marketplace MCP servers. - Filter MCP entries out of getMarketplaceCatalog when the marketplace is disabled, and restrict entries to the allowlist when configured (matching entry id, display name, installed server name, or source repo URL, mirroring legacy GitHub-URL allowlist ids) - Reject installMarketplaceEntry requests that violate the policy - Map the published catalog's repo/homepage fields onto sourceUrl/homepageUrl so URL-based allowlists can match - Update the enterprise MCP server controls docs Co-authored-by: Saoud Rizwan <saoudrizwan@users.noreply.github.com> * refactor: simplify MCP marketplace policy enforcement Fold the policy check into marketplace-helpers, drop the dedicated test suite, and trim the docs edit to the strictly necessary line. Co-authored-by: Saoud Rizwan <saoudrizwan@users.noreply.github.com> --------- Co-authored-by: Saoud Rizwan <saoudrizwan@users.noreply.github.com>