- httpx.ASGITransport is async-only; the sync client made every
tools/call fail with "'ASGITransport' object has no attribute
'__enter__'". Run the in-process request on the API loop from the
tool worker thread instead.
- http_json_many fanned out on a plain thread pool without the caller's
context, so batch requests fell back to the server MCP token file.
Copy the context per request so RBAC uses the caller's token.
- Real-TCP regression: tools/call getTopologyTree must reach the API.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- netx_api/mcp_remote: ops / topology / bizMonitor tools, Bearer auth,
per-tool RBAC filtering, ?groups= filter, readOnlyHint and group meta.
- Mount the official MCP Streamable HTTP app at /mcp (stateless);
AuthAuditMiddleware is pure ASGI and skips /mcp.
- Let uvicorn chunk MCP responses; some Windows LSPs rewrite
Content-Length replies on */mcp* paths into broken chunked framing.
- NETX_MCP_ALLOWED_HOSTS opts into DNS-rebinding checks (off by default
so LAN and reverse-proxy hosts work; Bearer is the gate).
- Remove the three stdio Python MCP packages; tests moved to /mcp,
including real-TCP framing regressions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
