[Copilot]

HTTP MCP upstreams using private CAs could not be trusted without changing runner-wide trust. Add per-server CA configuration that preserves system trust and standard TLS verification.

• Configuration: Support caCertFile in JSON stdin and ca_cert_file in TOML for HTTP servers.
• TLS behavior: Add the configured CA to that server’s outbound connection only; certificate and hostname verification remain enabled. Missing or invalid CA files return clear errors without exposing certificate contents.
• Example:

  {
    "type": "http",
    "url": "https://mcp.internal.example",
    "caCertFile": "/etc/mcp/internal-ca.pem"
  }

• Coverage and docs: Document the fields and cover private-CA connections, trust isolation, invalid files, and unchanged default TLS behavior.

• Fixes Support per-server custom CA certificates for HTTP MCP upstreams #15065

[Copilot]

🟡 Changes recommended

CA loading can silently omit certificates that passed validation when their PEM blocks contain headers.

1 open finding

• Add all validated CA certificates to the trust pool · New

What changed in this PR

Adds per-server custom CA configuration for HTTP MCP upstreams without changing global trust or disabling TLS verification.

Changes:

• Add JSON and TOML CA file settings with HTTP-only validation.
• Load custom certificates into connection-local trust pools.
• Add configuration and TLS tests plus documentation.

File	Description
internal/​mcp/​connection.go	Load custom CAs for HTTP connections.
internal/​mcp/​connect_timeout_test.go	Test private trust, isolation, and invalid files.
internal/​launcher/​launcher.go	Pass CA configuration to HTTP connections.
internal/​config/​validation_server.go	Reject CA settings on non-HTTP servers.
internal/​config/​validation_schema_test.go	Cover the JSON CA field.
internal/​config/​schema/​mcp-gateway-config.schema.json	Define caCertFile.
internal/​config/​config_stdin.go	Parse and propagate JSON CA configuration.
internal/​config/​config_stdin_test.go	Test CA field conversion.
internal/​config/​config_core.go	Add TOML CA configuration and validation.
internal/​config/​config_core_test.go	Test TOML CA field loading.
docs/​CONFIGURATION.md	Document CA settings and TLS behavior.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Fixed in commit 3eb3bad: each validated certificate is now added directly to the root pool, and the regression test covers a header-bearing CA in a multi-certificate bundle.