Spaces:
Running
Running
Commit History
-
Fix MCP API key bypass vulnerability Running
CRITICAL SECURITY FIX: - Add strict MCP request path detection (/mcp/, /gradio_api/mcp) - Enforce mandatory API key for all MCP endpoint requests - Prevent bypass via --transport sse-only parameter - Add detailed request debugging and path analysis - Improve error messages with clear configuration examples Changes: - Detect MCP requests by URL path analysis - Block Space API key usage for MCP endpoints - Add comprehensive request logging for debugging - Ensure MCP clients cannot access without proper API key This prevents the security issue where MCP clients could access the service without API keys using sse-only transport.37495c1 -
Enhance API key retrieval and validation for MCP clients
98727e9 -
Fix critical security issue: Enforce API key requirement for MCP clients
SECURITY FIX: - MCP clients were bypassing API key requirement and using Space API key - Now properly distinguish between web browser requests and MCP client requests - Space API key only used for web browser demo requests - MCP clients MUST provide their own API key via headers Changes: - Add User-Agent detection to identify web browsers vs MCP clients - Enforce strict API key requirement for all MCP client requests - Provide detailed error message with configuration example - Maintain web demo functionality for browser users This ensures: ✅ Web demo works for browser users (limited usage) ❌ MCP clients cannot use Space API key (security) ✅ MCP clients must provide own API key (production usage)c1359fb -
Implement dual-mode authentication strategy
- Space demo: Uses provided API key for demonstration (limited usage) - MCP clients: Must provide own API key for production usage - Check SPACE_ID environment variable to detect Hugging Face Space - Update documentation to clarify API key requirements - Add comprehensive authentication strategy logging - Ensure security: client API keys required for production use Features: ✅ Space demo works with pre-configured API key ✅ MCP clients must provide their own API key ✅ Clear documentation for both usage modes ✅ Production-ready authentication strategyafb386c -
Add comprehensive MCP documentation to all tool pages
- Add MCP client configuration instructions on every tool page - Include detailed A1D API key acquisition guide - Show Claude Desktop configuration with proper JSON format - List all available MCP tools and endpoints - Use gr.Blocks layout for better documentation integration - Ensure users can access MCP setup info from any tool tab Features added: - Step-by-step A1D API key setup guide - Complete Claude Desktop MCP configuration - MCP endpoints and schema URLs - Tool descriptions for MCP clientsf4114e2 -
Deploy final complete A1D MCP Server
- Use original app.py with full functionality - Enable MCP server with mcp_server=True parameter - Support all 6 AI tools with complete interfaces: * Background Removal * Image Upscaler (2x/4x/8x/16x) * Video Upscaler * Image Vectorization * Image Extension * Image Generator - Add comprehensive startup logging - Ready for production deployment on Hugging Face Spaces0466140 -
Implement official Gradio MCP server
- Follow official Gradio MCP documentation - Use gradio[mcp]>=5.0.0 with mcp_server=True - Create official_app.py with proper MCP tool functions - Add detailed docstrings for all AI tools - Support background removal, image upscaling, generation, vectorization, extension, and video upscaling - Update README.md to use official implementationd45a618 -
Create simple Gradio app to fix JSON schema issues
- Add simple_app.py with minimal Gradio interface - Downgrade to Gradio 4.32.0 for better stability - Use basic components to avoid complex type inference - Focus on core functionality: background removal, upscaling, generation - Update README.md to use simple_app.py as main app file63d8486 -
Fix Gradio compatibility issues
- Downgrade to Gradio 4.44.0 for stability - Remove show_label=True parameters causing JSON schema errors - Fix TypeError in gradio_client utils - Ensure compatibility with Hugging Face Spaces environment2ca01e7 -
Fix Gradio launch parameters
- Remove unsupported mcp_server parameter - Fix TypeError in Blocks.launch() - Maintain basic Gradio functionality - Ready for Space deployment985dde8 -
Merge with remote repository and resolve conflicts
- Resolved README.md merge conflicts - Added deployment documentation and scripts - Maintained complete A1D MCP Server functionality - Ready for Hugging Face Space deployment565a26a -
Initial commit: A1D MCP Server with Gradio interface
- Complete MCP server implementation with Gradio web interface - Support for 6 AI tools: background removal, image upscaling, video upscaling, image vectorization, image extension, and image generation - Dual API key support: header-based (recommended) and environment variable - Real-time SSE processing with detailed logging - Media preview support for images and videos - Production-ready with comprehensive error handling - Full documentation with MCP client configuration examplesaaa3e82
-
initial commit
Verified signature8398c98