feat: thunderbolt-stdio-bridge — bridge local stdio ACP agents and MCP servers#989
feat: thunderbolt-stdio-bridge — bridge local stdio ACP agents and MCP servers#989ital0 wants to merge 28 commits into
Conversation
Semgrep Security ScanNo security issues found. |
PR Metrics
Updated Tue, 23 Jun 2026 20:30:26 GMT · run #2018 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
ital0
changed the title
…e relay at startup
…catalog-bridge-agent-link-outs
…dge-agent-link-outs' into italomenezes/thu-601-acp-marketplace-acp-bridge-run-local-stdio-agents-in
…catalog-bridge-agent-link-outs
…acp-marketplace-acp-bridge-run-local-stdio-agents-in # Conflicts: # src/components/settings/agents/add-custom-agent-dialog.tsx
…lace-browse-catalog-bridge-agent-link-outs' into italomenezes/thu-601-acp-marketplace-acp-bridge-run-local-stdio-agents-in
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d841be2. Configure here.
| else endJson(res, 503, jsonRpcError(JSONRPC_INTERNAL_ERROR, 'Agent process exited')) | ||
| } | ||
| openResponses.clear() | ||
| }) |
There was a problem hiding this comment.
MCP flush skipped on agent exit
Medium Severity
When the stdio MCP child exits, superviseChild’s exit listener runs first and calls process.exit after closeFace, which only invokes face.close() (server.close + transport.close). The MCP face’s second child.on('exit') handler that 503s tracked openResponses often never runs, so in-flight Streamable HTTP requests can hang instead of failing promptly.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit d841be2. Configure here.
d841be2 to
aa4e5d9
Compare
|
Superseded by #1021, which delivers the full |
|
Preview environment destroyed 🧹 Stack |
1 participant
Note
Medium Risk
Changes ACP/MCP routing to bypass the cloud proxy on loopback (intentional, tested); incorrect loopback detection could weaken proxy SSRF protections for remote URLs. The new bridge exposes a privileged local agent and relies on Origin/bearer gates.
Overview
Adds
thunderbolt-stdio-bridge, a local CLI that relays a stdio ACP agent to a loopback WebSocket (--mode acp) or a stdio MCP server to Streamable HTTP at/mcp(--mode mcp), with Origin allowlisting, PII-safe logging, optional cloudflared tunnel + bearer for MCP only, and a GitHub Actions workflow that esbuild-bundlesbridge.cjsand smoke-tests ACP/MCP boot.So Thunderbolt can reach those endpoints from the web app, loopback targets skip the cloud proxy: new
isLoopbackUrl/isLoopbackHostdrives direct WebSocket forremote-acp(including in the browser) and nativefetchfor MCP viaresolveMcpFetch, with tests that non-loopback routing stays proxied.Settings UX for the bridge path: agent catalog cards get Connect via bridge (
BridgeConnectDialog+ registry-derivedcomposeBridgeCommand), Add the agent hands off to Add Custom Agent; loopback URLs show a local network permission hint in that dialog.Reviewed by Cursor Bugbot for commit aa4e5d9. Bugbot is set up for automated code reviews on this repo. Configure here.