c48809341b
* feat(external-context): Add provider extension profile Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(external-context): Harden provider extension profile Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(external-context): Harden provider profile bounds Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(external-context): validate provider profile boundaries Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(external-context): harden provider extension example Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(external-context): Use forward proxy for HTTP providers Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> |
||
|---|---|---|
| .. | ||
| qwen-extension.json | ||
| README.md | ||
Remote MCP provider extension example
This manifest is the preferred External Context Provider Extension Profile v1 shape for a provider-operated service.
Before release, the provider owner must:
- Replace the extension and MCP server names with one stable, provider-specific name.
- Replace the HTTPS MCP endpoint, OAuth read scope, and audience.
- Implement exactly the
context_searchinput and output contracts under../../contracts/v1/. - Keep
includeToolsrestricted tocontext_search, even when the same MCP service exposes other tools. - Publish the Extension from a reviewed Git repository, archive, or scoped npm package. An npm release also needs provider-owned package metadata; this manifest-only example is directly usable from Git, an archive, or a local link.
The manifest contains no static credential and cannot set MCP trust. The MCP
service is responsible for OAuth authorization, token audience validation,
rate limiting, request bounds, output sanitization, and provider-side logging.
For a one-off deployment, skip the Extension and register the endpoint directly:
qwen mcp add \
--scope project \
--transport http \
--include-tools context_search \
--oauth-scopes context.read \
--timeout 8000 \
provider-context \
https://context.example.com/mcp
The CLI does not currently expose an OAuth audience flag. If the provider
requires an explicit audience, use the manifest/configuration JSON above or add
oauth.audiences to the generated settings entry before authenticating.
The service should use a shorter internal Provider timeout than this 8000ms MCP call budget so it can return the profile's stable, redacted error before the client terminates the call.