From 70ef33b2462c914d386ce1d6c93020e7a2872e1e Mon Sep 17 00:00:00 2001
From: unknown <2314530442@qq.com>
Date: Fri, 28 Aug 2026 01:12:59 +0800
Subject: [PATCH] fix: reject unsupported MCP transport methods

---
 actionagent/config/routes.rb                |  3 +++
 actionagent/test/engine_integration_test.rb | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/actionagent/config/routes.rb b/actionagent/config/routes.rb
index 4c42e059..7203d4c5 100644
--- a/actionagent/config/routes.rb
+++ b/actionagent/config/routes.rb
@@ -135,6 +135,9 @@
   # dashboard API key rather than a session, so it sits outside the api
   # namespace's session-authenticated controllers.
   post "mcp", to: "api/mcp#create"
+  match "mcp", to: ->(_env) { [ 405, { "Allow" => "POST" }, [] ] },
+    via: [ :get, :delete ],
+    constraints: ->(request) { request.delete? || !request.format.html? }
 
   # Everything else under the mount is a client-side route: render the
   # dashboard and let the browser resolve it. Anchored last so it can only
diff --git a/actionagent/test/engine_integration_test.rb b/actionagent/test/engine_integration_test.rb
index 054053ce..b324e9fc 100644
--- a/actionagent/test/engine_integration_test.rb
+++ b/actionagent/test/engine_integration_test.rb
@@ -115,6 +115,25 @@ def setup
     assert_includes response.body, "active-agent-dashboard"
   end
 
+  test "mcp endpoint rejects unsupported transport methods" do
+    get "/activeagents/mcp", headers: { "Accept" => "text/event-stream" }
+
+    assert_response :method_not_allowed
+    assert_equal "POST", response.headers["Allow"]
+
+    delete "/activeagents/mcp"
+
+    assert_response :method_not_allowed
+    assert_equal "POST", response.headers["Allow"]
+  end
+
+  test "mcp dashboard route still renders for browsers" do
+    get "/activeagents/mcp", headers: { "Accept" => "text/html" }
+
+    assert_response :success
+    assert_includes response.body, "active-agent-dashboard"
+  end
+
   test "dashboard refuses unauthenticated access in production when no auth is configured" do
     Rails.env.stub(:local?, false) do
       get "/activeagents/console/traces"