magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit

MGS9008: local access only

The server answered 403 forbidden because the route only serves a caller on this machine, and the request's peer address was not loopback.

[MGS9008] this route only answers a caller on this machine's loopback interface
  see: .../MGS9008.md

Why

Some routes (starting a "share to phone" session, for one) change what the server exposes to the network. Binding to loopback is the first defense; this check on the connection's peer address is the second, so a misconfigured bind or a proxy cannot hand those routes to another machine.

Resolution

Make the request from the machine the server runs on, directly to 127.0.0.1:<port>. A proxy or port forward in between makes the peer non-loopback.

What this is NOT

  • Not the Host check. A wrong Host or Origin header is MGS9007; this code is about the TCP peer.
AuthPages in this section. sandbox diagnosticsLanding page for the sandbox that confines magus spells to the workspace, plus its MGS2xxx diagnostics for denied reads, writes, execs, and env leaks. ActivityServiceActivityService serves the trail to a viewer, mirroring magus.viewer.v1alpha1's shape: List a page of events (newest first), Get a payload blob by ref. MetricsServiceMetricsService serves the derived dashboard metrics.
MGS9008authloopbackshare403
Last updated (95680f58)
Earlier changes on this page (1)

Full history ↗ · Blame source ↗

Glossary

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Ward

A coded diagnostic that inspects a resolved op and nudges or blocks an anti-pattern before it runs. See wards.

Server

The background process a person starts with magus server start. It serves MCP, the console, background jobs and the warm knowledge graph, and adopts nested magus calls into one pool. See server.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

Placeholders

Angle brackets mark a value you replace with your own - never type the brackets:

magus run <target>
magus completion <shell>    # e.g. bash, zsh, fish

<target>, <path>, <shell>, <name> and the like are stand-ins, not literal text.