Skip to content

Enable Google KMS and Azure Key Vault for publisher login tool#696

Merged
domdomegg merged 11 commits intomodelcontextprotocol:mainfrom
joelverhagen:joelverhagen/azkv
Oct 29, 2025
Merged

Enable Google KMS and Azure Key Vault for publisher login tool#696
domdomegg merged 11 commits intomodelcontextprotocol:mainfrom
joelverhagen:joelverhagen/azkv

Conversation

@joelverhagen
Copy link
Contributor

@joelverhagen joelverhagen commented Oct 23, 2025 •
edited
Loading

Motivation and Context

This allows the private key used for DNS or HTTP based authentication to be stored securely in a cloud key management system. These services often provide HSM storage which makes it very hard to leak the private key.

The full context is described in my design document here:
#482 (comment)

How Has This Been Tested?

I have tested it against PROD using an Ed25519 key stored in Google KMS. I have added unit tests. I have tested both ECDSA P-384 and Ed25519 with Az KV and Google KMS against a locally running server.

Breaking Changes

None intended.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

@joelverhagen joelverhagen marked this pull request as draft October 23, 2025 14:37
@joelverhagen joelverhagen force-pushed the joelverhagen/azkv branch 2 times, most recently from 4daf89b to 60001e6 Compare October 23, 2025 15:13
@joelverhagen joelverhagen marked this pull request as ready for review October 23, 2025 15:16
@joelverhagen
Copy link
Contributor Author

joelverhagen commented Oct 27, 2025

@rdimitrov - thanks for fixing main after I broke it with the crypto parse function. I created the PR before we moved back to Go 1.24 and didn't notice 🤦. I have added a length validation since the private key length is known per curve in this PR, to improve user experience (I had it in a previous iteration of this PR).

@joelverhagen
Copy link
Contributor Author

joelverhagen commented Oct 27, 2025

@domdomegg, @toby - this PR is ready for review! Once this is in Microsoft will be able to publish to the MCP Registry :)

domdomegg
domdomegg reviewed Oct 27, 2025
View reviewed changes
domdomegg
domdomegg reviewed Oct 27, 2025
View reviewed changes
domdomegg
domdomegg previously approved these changes Oct 27, 2025
View reviewed changes
Copy link
Member

@domdomegg domdomegg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, happy to merge

domdomegg
domdomegg reviewed Oct 27, 2025
View reviewed changes
domdomegg
domdomegg reviewed Oct 27, 2025
View reviewed changes
domdomegg
domdomegg reviewed Oct 27, 2025
View reviewed changes
domdomegg
domdomegg reviewed Oct 27, 2025
View reviewed changes
@joelverhagen @domdomegg
Update docs/reference/cli/commands.md
617be62 
Co-authored-by: adam jones <domdomegg+git@gmail.com>
joelverhagen and others added 3 commits October 27, 2025 13:28
@joelverhagen @domdomegg
Update docs/reference/cli/commands.md
30895be 
Co-authored-by: adam jones <domdomegg+git@gmail.com>
@joelverhagen @domdomegg
Update docs/reference/cli/commands.md
d97eb80 
Co-authored-by: adam jones <domdomegg+git@gmail.com>
@joelverhagen @domdomegg
Update docs/reference/cli/commands.md
7407198 
Co-authored-by: adam jones <domdomegg+git@gmail.com>
domdomegg
domdomegg previously approved these changes Oct 27, 2025
View reviewed changes
@domdomegg domdomegg merged commit 88c2e1b into modelcontextprotocol:main Oct 29, 2025
3 checks passed
Swathi-MuraliSrinivasan pushed a commit to Swathi-MuraliSrinivasan/paychex-mcp-registry that referenced this pull request Nov 20, 2025
@joelverhagen @domdomegg @Swathi-MuraliSrinivasan
Enable Google KMS and Azure Key Vault for publisher login tool (model…
c9a55fe 
…contextprotocol#696)

<!-- Provide a brief summary of your changes -->

## Motivation and Context

This allows the private key used for DNS or HTTP based authentication to
be stored securely in a cloud key management system. These services
often provide HSM storage which makes it very hard to leak the private
key.

The full context is described in my design document here:

modelcontextprotocol#482 (comment)

## How Has This Been Tested?

I have tested it against PROD using an Ed25519 key stored in Google KMS.
I have added unit tests. I have tested both ECDSA P-384 and Ed25519 with
Az KV and Google KMS against a locally running server.

## Breaking Changes

None intended.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Co-authored-by: adam jones <domdomegg+git@gmail.com>
slimslenderslacks pushed a commit to slimslenderslacks/registry that referenced this pull request Dec 18, 2025
@joelverhagen @domdomegg @slimslenderslacks
Enable Google KMS and Azure Key Vault for publisher login tool (model…
a6f1f56 
…contextprotocol#696)

<!-- Provide a brief summary of your changes -->

## Motivation and Context

This allows the private key used for DNS or HTTP based authentication to
be stored securely in a cloud key management system. These services
often provide HSM storage which makes it very hard to leak the private
key.

The full context is described in my design document here:

modelcontextprotocol#482 (comment)

## How Has This Been Tested?

I have tested it against PROD using an Ed25519 key stored in Google KMS.
I have added unit tests. I have tested both ECDSA P-384 and Ed25519 with
Az KV and Google KMS against a locally running server.

## Breaking Changes

None intended.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Co-authored-by: adam jones <domdomegg+git@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@domdomegg domdomegg domdomegg approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@joelverhagen @domdomegg