datarelay-link-plugin

ChatGPT Plus / Codex Agent Plugins package and single-user MCP relay PoC for DataRelay Link.

License — Source Available: licensed under the Data Relay Source Available License 1.0 (not Apache-2.0 / not OSI open source). See LICENSE and LICENSING.md.

Core DRLink continues to work without this repository. Direct DRLink MCP remains supported for clients that allow arbitrary remote MCP endpoints. This repo exists so ChatGPT Plus can use DataRelay Link through a published Plugin/App path.

Architecture

ChatGPT Plus
  -> DataRelay Link Plugin
  -> MCP relay (this repo)
  -> bound DRLink Server MCP
  -> DRLink AI Access
  -> Managed Host

The relay is transport/binding only. DRLink Server remains the final authorization source of truth on every tool call.

See docs/architecture.md and docs/openai-plugin-assumptions.md.

Related MCP server: chatgpt-web-agent

Repository layout

Local relay (PoC)

Mock mode (loopback / local tests)

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

export DRLINK_RELAY_UPSTREAM_URL="http://127.0.0.1:9000/mcp"
export DRLINK_RELAY_ALLOW_LOOPBACK_UPSTREAM=1
export DRLINK_RELAY_UPSTREAM_TOKEN="replace-me"
export DRLINK_RELAY_AUTH_MODE=mock
export DRLINK_RELAY_MOCK_PLUGIN_TOKEN="dev-plugin-token"
export DRLINK_RELAY_BIND=127.0.0.1
export DRLINK_RELAY_PORT=8741

PYTHONPATH=. python3 -m relay

MCP: POST http://127.0.0.1:8741/mcp with Authorization: Bearer dev-plugin-token

OAuth mode (single-user ChatGPT-compatible PoC)

export DRLINK_RELAY_UPSTREAM_URL="http://127.0.0.1:9000/mcp"
export DRLINK_RELAY_ALLOW_LOOPBACK_UPSTREAM=1
export DRLINK_RELAY_UPSTREAM_TOKEN="replace-me"
export DRLINK_RELAY_AUTH_MODE=oauth
export DRLINK_RELAY_PUBLIC_BASE_URL="http://127.0.0.1:8741"
export DRLINK_RELAY_OWNER_APPROVAL_SECRET="replace-with-long-runtime-secret"
export DRLINK_RELAY_OAUTH_STATE_PATH="/var/lib/datarelay-link-plugin/oauth-state.json"
export DRLINK_RELAY_BIND=127.0.0.1
export DRLINK_RELAY_PORT=8741

PYTHONPATH=. python3 -m relay

For local ephemeral tests only (loopback), set DRLINK_RELAY_OAUTH_ALLOW_EPHEMERAL=1 instead of a state path. Public / non-loopback OAuth always requires a durable state file (mode 0600, parent dir not group/world-writable).

Discovery:

• GET /.well-known/oauth-protected-resource

• GET /.well-known/oauth-authorization-server

Owner consent uses the runtime approval secret (never commit it). Public HTTPS deployment URLs remain configurable; this repo does not claim public Plugin availability.

Health: GET /health (reports auth_mode, never secrets).

The default mock token is loopback-only. Non-loopback bind should use oauth mode. Legacy mock-on-public requires both DRLINK_RELAY_ALLOW_NON_LOOPBACK_BIND=1 and an explicit non-default DRLINK_RELAY_MOCK_PLUGIN_TOKEN.

mcp.json points at the local PoC relay URL. Production HTTPS (mcp.datarelay.run) and Plugin Directory submission remain out of scope.

Tests

pip install -r requirements-dev.txt
PYTHONPATH=. python3 -m unittest discover -s tests -v

Auth seam

See docs/auth-seam.md for mock vs single-user OAuth PoC vs future multi-user identity. Do not treat mock tokens as production credentials.

Security constraints

• Never commit OAuth client secrets, upstream tokens, or DRLink private keys.

• Relay audit logs redact Authorization and token-like fields.

• Upstream URL is an explicit allowlisted binding with SSRF-resistant validation.

• Upstream TCP connects use bind-time resolved IPs (DNS-rebinding / TOCTOU resistant); HTTPS keeps hostname SNI/certificate verification.

• No generic open proxy; unbound identities are rejected.