feat: mcp to CLI by adityathebe · Pull Request #33 · flanksource/captain

adityathebe · 2026-07-23T10:48:08Z

resolves: #17

Summary by CodeRabbit

Tests
- Added end-to-end coverage for MCP server registration, listing, authentication, schema-based tool flags, tool execution, auditing, and offline schema usage.
- Added a local MCP test fixture with an echo tool and request auditing.
- Added an automated CI job and task for running the MCP end-to-end tests.
Chores
- Updated MCP and related development dependencies.
- Aligned React type packages and enabled esbuild builds for the web app.

pnpm 11 ignores package-level override configuration and rejects the frozen install when it differs from the lockfile. It also blocks esbuild's required install script unless explicitly approved. Move overrides and the esbuild allowlist into pnpm-workspace.yaml, align React declarations with the React 18 runtime and linked clicky-ui package, and add the Node declarations required by the Vite config.

coderabbitai · 2026-07-23T10:48:19Z

Walkthrough

Changes

The PR adds an authenticated streamable MCP fixture with an echo tool and audit logging, introduces black-box CLI tests covering registration, listing, invocation, authentication, and offline caching, updates related dependencies, and adds local and CI test commands.

MCP CLI end-to-end testing

Layer / File(s)	Summary
Dependency and toolchain alignment `go.mod`, `pkg/cli/webapp/package.json`, `pkg/cli/webapp/pnpm-workspace.yaml`	Updates MCP and clicky dependencies, adds JSON-schema dependencies, removes an unused dependency, and adjusts webapp type and build settings.
Authenticated MCP fixture `tests/e2e/mcp2cli/fixture/main.go`	Adds a loopback MCP server with Basic Auth, JSONL auditing, readiness signaling, graceful shutdown, and a typed deterministic `echo` tool.
Black-box MCP CLI scenarios `tests/e2e/mcp2cli/mcp2cli_test.go`	Builds and runs Captain and the fixture, then tests registration, catalog listing, typed tool invocation, rejected authentication, audit records, offline cached schemas, process cleanup, and secret redaction.
Local and CI execution wiring `Taskfile.yaml`, `.github/workflows/test.yml`	Adds the `test:e2e:mcp` task and an `mcp-e2e` GitHub Actions job with tagged test execution and bounded timeouts.

Suggested reviewers: moshloop

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The summary shows tests, fixtures, and dependency/build updates, but not the requested MCP CLI commands, registry, cache, or flag-generation implementation.	Add the missing MCP CLI implementation in the reviewed source files, including add/list/remove/run, registry/cache handling, schema-driven flags, and offline help.
Out of Scope Changes check	⚠️ Warning	The webapp pnpm/React/Node dependency changes are unrelated to the CLI-only MCP issue and look out of scope.	Move the webapp build fixes to a separate PR or link a matching issue if they are intended to ship together.
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the MCP CLI feature work in this PR.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/webapp-pnpm11-build

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/webapp-pnpm11-build

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/test.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

Taskfile.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

go.mod

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

2 others

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-07-23T10:48:47Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
golang/github.com/mark3labs/mcp-go@v0.29.0 ⏵ v0.56.0	^-23
golang/github.com/flanksource/clicky@v1.21.44 ⏵ v1.21.45	⁺¹
npm/@types/react@19.2.17 ⏵ 18.3.28		⁺¹
npm/@types/node@24.13.3
golang/github.com/flanksource/clicky/aichat@v1.21.44 ⏵ v1.21.45

View full report

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Line 36: Update the actions/checkout@v4 step to set persist-credentials to
false, ensuring the build and test job does not retain GITHUB_TOKEN credentials
in the repository configuration.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f790678b-7dbc-4221-bf8b-01d438a891ce

📥 Commits

Reviewing files that changed from the base of the PR and between 1f6ba38 and f7c2adc.

⛔ Files ignored due to path filters (2)

go.sum is excluded by !**/*.sum
pkg/cli/webapp/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

.github/workflows/test.yml
Taskfile.yaml
go.mod
pkg/cli/webapp/package.json
pkg/cli/webapp/pnpm-workspace.yaml
tests/e2e/mcp2cli/fixture/main.go
tests/e2e/mcp2cli/mcp2cli_test.go

coderabbitai · 2026-07-23T12:27:02Z

+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4


🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Set persist-credentials: false on checkout. The actions/checkout step leaves the GITHUB_TOKEN in .git/config for the job's lifetime. Since this job only builds and tests, it does not need persisted credentials; disabling them is a low-cost hardening.

🔒️ Proposed hardening

- uses: actions/checkout@v4 + with: + persist-credentials: false - uses: actions/setup-go@v5

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

- uses: actions/checkout@v4

- uses: actions/checkout@v4

with:

persist-credentials: false

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 36-36: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test.yml at line 36, Update the actions/checkout@v4 step to set persist-credentials to false, ensuring the build and test job does not retain GITHUB_TOKEN credentials in the repository configuration.

Source: Linters/SAST tools

adityathebe added 3 commits July 23, 2026 16:28

feat: MCP to CLI

9fbbb5e

chore: Remove unrelated

f835b04

e2e MCP

f7c2adc

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: mcp to CLI#33

feat: mcp to CLI#33
adityathebe wants to merge 4 commits into
mainfrom
fix/webapp-pnpm11-build

adityathebe commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

❌ Failed checks (3 warnings)

Uh oh!

socket-security Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

adityathebe commented Jul 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (3 warnings)

Uh oh!

socket-security Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

adityathebe commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

socket-security Bot commented Jul 23, 2026 •

edited

Loading