kami
95ae900a58
docs/plans/06-mcp-support.md asks for the host direction — Maven connects OUT
to MCP servers and consumes what they offer. This is the client half: the
protocol, the transports, the connection manager, the config block. Nothing is
wired into a turn yet, and nothing here exposes Maven's own capabilities to an
outside caller.
internal/mcp:
- hand-rolled JSON-RPC 2.0 (the wire format is four fields, and the repo
vendors its deps, so a library would cost more than it saves);
- two transports: a stdio subprocess on this box, and streamable HTTP, which
accepts a plain JSON reply or an SSE frame because servers disagree about
which they send;
- Client: initialize handshake, tools/list, tools/call, resources/list,
resources/read. Text content only — everything downstream is a sentence;
- Manager: lazy dial, per-server failure that never blocks boot or the other
servers, backoff reconnect, Status for a web surface, graceful Close;
- the allowlist encoding: a discovered tool becomes the store row
"vikunja_list_tasks" with cmd ["mcp","vikunja","list_tasks"], scope
"mcp:vikunja". No new column, no migration, and ProposeTool, EnableTool,
the act matcher and the confirm turn all keep working untouched.
Constraints held, in code rather than in prose:
- OFF unless configured, and a server is dark until "enabled": true.
- A url server goes through internal/webfetch, so the SSRF guard, the size
cap, the redirect cap and the per-host rate limit apply. Reaching loopback
needs allow_private on THAT server, and each server gets its own fetcher so
one loopback exemption cannot become a hole for a public endpoint.
- readOnlyHint decides destructive: no hint means "assume it mutates", which
will route the call through the existing confirm turn. Guessing wrong in
that direction only costs a question.
- The catalogue stays small on purpose — allow_tools, and max_tools=12 per
server. The resident model is a 1.7B with a 4096-token context; a tool name
it half-remembers is a wrong act.
- Only the tool name and the router's arguments are sent. There is no API
here through which a note, a fact or the persona block could travel.
webfetch grows Post (JSON-RPC cannot be a GET) and surfaces response headers
for Mcp-Session-Id. It shares Get's guards exactly: a body buys a caller
nothing, a POST to the LAN is refused for the same reason a GET is.
Verified against the real Vikunja MCP server on homesrv
(http://localhost:9100/mcp): handshake, three discovered tools with update_task
correctly NOT read-only, a live list_projects call, a tool excluded by
allow_tools refused, and the same server refused outright once allow_private
was dropped. Tests cover both transports (the stdio one against a real
subprocess), SSE and JSON framing, session echo, reconnect, and the config
validation.
83 lines
2.6 KiB
Go
83 lines
2.6 KiB
Go
package config
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestMCPAbsentIsOff(t *testing.T) {
|
|
c, err := Load(writeConfig(t, `{}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if c.MCP != nil {
|
|
t.Error("no mcp block ⇒ nil")
|
|
}
|
|
if got := c.MCPServers(); got != nil {
|
|
t.Errorf("MCPServers() = %+v, want nil", got)
|
|
}
|
|
}
|
|
|
|
// A described-but-not-enabled server must not be wired. This is how a block can
|
|
// sit in the config file, reviewed, before it is switched on.
|
|
func TestMCPDisabledServerIsOff(t *testing.T) {
|
|
c, err := Load(writeConfig(t, `{"mcp":{"servers":[
|
|
{"name":"vikunja","url":"http://localhost:9100/mcp","allow_private":true}]}}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if c.MCP != nil {
|
|
t.Errorf("a block with nothing enabled must normalise to nil, got %+v", c.MCP)
|
|
}
|
|
if got := c.MCPServers(); len(got) != 0 {
|
|
t.Errorf("MCPServers() = %+v", got)
|
|
}
|
|
}
|
|
|
|
func TestMCPEnabledServerMapping(t *testing.T) {
|
|
c, err := Load(writeConfig(t, `{"mcp":{
|
|
"timeout":"5s",
|
|
"servers":[
|
|
{"name":"vikunja","url":"http://localhost:9100/mcp","allow_private":true,
|
|
"allow_tools":["list_tasks"],"max_tools":3,"enabled":true},
|
|
{"name":"files","command":"mcp-server-fs","args":["/srv"],"timeout":"1s","enabled":true},
|
|
{"name":"off","command":"nope"}
|
|
]}}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got := c.MCPServers()
|
|
if len(got) != 2 {
|
|
t.Fatalf("servers = %+v", got)
|
|
}
|
|
if got[0].Name != "vikunja" || !got[0].AllowPrivate || got[0].MaxTools != 3 ||
|
|
len(got[0].AllowTools) != 1 || got[0].Timeout != 5*time.Second {
|
|
t.Errorf("vikunja mapped wrong: %+v", got[0])
|
|
}
|
|
if got[1].Command != "mcp-server-fs" || len(got[1].Args) != 1 || got[1].Timeout != time.Second {
|
|
t.Errorf("files mapped wrong: %+v", got[1])
|
|
}
|
|
// allow_private is per server and must not leak to the other one.
|
|
if got[1].AllowPrivate {
|
|
t.Error("allow_private leaked between servers")
|
|
}
|
|
}
|
|
|
|
func TestMCPBadServerFailsAtStartup(t *testing.T) {
|
|
cases := map[string]string{
|
|
"no name": `{"mcp":{"servers":[{"command":"x","enabled":true}]}}`,
|
|
"both": `{"mcp":{"servers":[{"name":"a","command":"x","url":"http://a.test","enabled":true}]}}`,
|
|
"neither": `{"mcp":{"servers":[{"name":"a","enabled":true}]}}`,
|
|
"bad scheme": `{"mcp":{"servers":[{"name":"a","url":"unix:///run/x.sock","enabled":true}]}}`,
|
|
"duplicate": `{"mcp":{"servers":[{"name":"a","command":"x","enabled":true},{"name":"a","command":"y","enabled":true}]}}`,
|
|
"spacey name": `{"mcp":{"servers":[{"name":"a b","command":"x","enabled":true}]}}`,
|
|
}
|
|
for name, body := range cases {
|
|
t.Run(name, func(t *testing.T) {
|
|
if _, err := Load(writeConfig(t, body)); err == nil {
|
|
t.Fatal("want a startup error")
|
|
}
|
|
})
|
|
}
|
|
}
|