feat: introduce `fetchTools` #114

ryoppippi · 2025-10-08T15:08:32Z

Summary

wire StackOne MCP catalog into StackOneToolSet.fetchTools() so tools execute via the RPC client without local specs
add richer tool abstractions (meta tools, execution metadata) and Orama-backed search to support dynamic discovery
document live-catalog usage (fetchTools) and add an example covering real-world execution
note that when used in AI SDK flows, these tools execute by delegating to the StackOne TypeScript SDK's RPC client
TODO documented: expose filters for accounts/providers/actions (e.g., stackone.fetchTools({ accountIDs: [...] })) so callers can scope MCP catalog fetches

Testing

bun test
bun test examples/examples.spec.ts
bun run typecheck

pkg-pr-new · 2025-10-08T15:09:10Z

npm i https://pkg.pr.new/StackOneHQ/stackone-ai-node/@stackone/ai@114

commit: 08d1599

Copilot

Pull Request Overview

This PR introduces MCP-backed dynamic tool discovery to enable RPC actions generated from external catalogs. The implementation adds support for different execution styles (HTTP, RPC, local) through discriminated unions and includes enhanced metadata exposure for AI SDK tools.

Refactors ExecuteConfig into discriminated union (HttpExecuteConfig, RpcExecuteConfig, LocalExecuteConfig)
Adds MCP client integration for dynamic tool fetching with RPC execution support
Introduces execution metadata exposure controls for AI SDK tool conversion

Reviewed Changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/types.ts	Defines discriminated union for execution configurations and tool metadata types
src/toolsets/base.ts	Implements MCP tool fetching and RPC-backed tool creation with StackOne client integration
src/tool.ts	Updates BaseTool to support multiple execution types and metadata exposure controls
src/openapi/parser.ts	Updates OpenAPI parser to use new HttpExecuteConfig format
src/mcp.ts	Adds MCP client factory with proper resource cleanup
Various test files	Updates test fixtures to use new execution config format

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-08T15:09:58Z

src/toolsets/base.ts

+        path: 'path',
+        query: 'query',
+      },
+    } as const satisfies RpcExecuteConfig; // Mirrors StackOne RPC payload layout so metadata/debug stays in sync.


[nitpick] The comment explains the purpose but could be clearer. Consider: 'Configuration mirrors StackOne RPC payload structure to maintain metadata and debug information compatibility.'

Suggested change

} as const satisfies RpcExecuteConfig; // Mirrors StackOne RPC payload layout so metadata/debug stays in sync.

} as const satisfies RpcExecuteConfig; // Configuration mirrors StackOne RPC payload structure to maintain metadata and debug information compatibility.

Copilot · 2025-10-08T15:09:58Z

src/toolsets/base.ts

+  private extractRecord(
+    params: JsonDict,
+    key: 'body' | 'headers' | 'path' | 'query'
+  ): JsonDict | undefined {
+    const value = params[key];
+    if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      return value as JsonDict;
+    }
+    return undefined;
+  }


This method performs type checking and casting that could be more robust. Consider validating that the object has only string keys or use a more specific type guard function.

src/tool.ts

src/openapi/parser.ts

cubic-dev-ai

cubic analysis

1 issue found across 17 files

Prompt for AI agents (all 1 issues)


Understand the root cause of the following 1 issues and fix them.


<file name="src/tool.ts">

<violation number="1" location="src/tool.ts:60">
Rule violated: **Flag Security Vulnerabilities**

createExecutionMetadata now exposes the tool&#39;s live headers (e.g., Authorization tokens) via the AI SDK execution metadata, leaking credentials to downstream consumers. Remove the sensitive header values from the metadata to prevent secret exposure.</violation>
</file>

Linked issue analysis

Linked issue: ENG-11034: Add Dynamic tool fetching via MCP in our SDK

Status	Acceptance criteria	Notes
✅	SDK can use MCP servers under the hood to fetch tools dynamically	Added createMCPClient and integrated in ToolSet base
✅	Provide examples/docs showing how to use MCP-backed dynamic tools	README and examples reference MCP dynamic tool usage

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

cubic-dev-ai · 2025-10-08T15:23:11Z

src/tool.ts

+
+    return {
+      config,
+      headers: this.getHeaders(),


Rule violated: Flag Security Vulnerabilities

createExecutionMetadata now exposes the tool's live headers (e.g., Authorization tokens) via the AI SDK execution metadata, leaking credentials to downstream consumers. Remove the sensitive header values from the metadata to prevent secret exposure.

Prompt for AI agents

Address the following comment on src/tool.ts at line 60: <comment>createExecutionMetadata now exposes the tool's live headers (e.g., Authorization tokens) via the AI SDK execution metadata, leaking credentials to downstream consumers. Remove the sensitive header values from the metadata to prevent secret exposure.</comment> <file context> @@ -21,8 +24,42 @@ export class BaseTool { + + return { + config, + headers: this.getHeaders(), + }; + } </file context>

ryoppippi · 2025-10-08T16:00:57Z

src/toolsets/tests/stackone.mcp-fetch.spec.ts

+async function createMockMcpServer(tools: MockTool[]) {
+  const mcp = new McpServer({ name: 'test-mcp', version: '1.0.0' });
+
+  for (const tool of tools) {
+    mcp.registerTool(
+      tool.name,
+      {
+        description: tool.description,
+        inputSchema: tool.shape,
+      },
+      async ({ params }) => ({
+        content: [],
+        structuredContent: params.arguments ?? {},
+        _meta: undefined,
+      })
+    );
+  }
+
+  const app = new Hono();
+  app.all('/mcp', async (c) => {
+    const transport = new StreamableHTTPTransport();
+    await mcp.connect(transport);
+    return transport.handleRequest(c);
+  });
+
+  const server = Bun.serve({ port: 0, fetch: app.fetch });
+  const origin = server.url.toString().replace(/\/$/, '');
+
+  return {
+    origin,
+    close: () => server.stop(),
+  } as const;
+}


create dummy mcp server with hono/mcp

ryoppippi · 2025-10-08T16:01:21Z

src/mcp.ts

+  transport: StreamableHTTPClientTransport;
+
+  /** cleanup client and transport */
+  [Symbol.asyncDispose](): Promise<void>;


close mcp client with await using

This reverts commit 0797d5e.

NicolasBelissent

lgtm

Copilot AI review requested due to automatic review settings October 8, 2025 15:08

Copilot AI reviewed Oct 8, 2025

View reviewed changes

cubic-dev-ai bot reviewed Oct 8, 2025

View reviewed changes

ryoppippi enabled auto-merge (squash) October 8, 2025 15:26

ryoppippi changed the title ~~feat: introduce MCP-backed dynamic tools~~ feat: introduce fetchTools Oct 8, 2025

ryoppippi force-pushed the ENG-11034-add-dynamic-tool-fetching-via-mcp-in-our-sdk branch from a0b1003 to b6e4146 Compare October 8, 2025 15:55

ryoppippi commented Oct 8, 2025

View reviewed changes

ryoppippi requested a review from a team as a code owner October 8, 2025 16:07

ryoppippi added 20 commits October 8, 2025 17:08

chore(deps): add mcp sdk

a8e6236

feat: fetchTool

3d210e7

feat: headers for mcp

8916c1e

chore(deps): add stackone client sdk dependency

dd22858

feat: execute stackone tools via actions rpc

562581a

test: verify fetchTools against hono mcp

aee9231

Refactor execute config handling

0846baa

test: move mock

c1d4105

test: update snapshot

9ee7d3a

Add inline comments for execution config changes

a32e6c3

Tighten test mock execute config typing

7ef126d

Document execute config union

90cdf03

fix: fallback to env api key for actions client

b8d71ed

docs: document mcp-powered tools

3e16bdb

Revert "docs: document mcp-powered tools"

a73b8d0

This reverts commit 0797d5e.

docs: explain fetchTools usage

a30304a

test: add zod dependency for mcp tests

8e36061

fix: typesafe config

4ee7746

refactor: alias http body type and enforce exhaustive handling

185e5c8

docs: note union exhaustiveness pattern

9137d63

ryoppippi added 2 commits October 8, 2025 17:08

fix: remove default mcp options

d66998f

chore: note future fetchTools filters

08d1599

ryoppippi force-pushed the ENG-11034-add-dynamic-tool-fetching-via-mcp-in-our-sdk branch from 9409b6f to 08d1599 Compare October 8, 2025 16:08

NicolasBelissent approved these changes Oct 8, 2025

View reviewed changes

ryoppippi merged commit ef5efc1 into main Oct 8, 2025
6 checks passed

ryoppippi deleted the ENG-11034-add-dynamic-tool-fetching-via-mcp-in-our-sdk branch October 8, 2025 16:12

github-actions bot mentioned this pull request Oct 8, 2025

chore(main): release 1.0.0 #91

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: introduce `fetchTools` #114

feat: introduce `fetchTools` #114

Uh oh!

ryoppippi commented Oct 8, 2025 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Oct 8, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

cubic-dev-ai bot Oct 8, 2025 •

edited

Loading

Uh oh!

ryoppippi Oct 8, 2025

Uh oh!

ryoppippi Oct 8, 2025

Uh oh!

NicolasBelissent left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	} as const satisfies RpcExecuteConfig; // Mirrors StackOne RPC payload layout so metadata/debug stays in sync.
	} as const satisfies RpcExecuteConfig; // Configuration mirrors StackOne RPC payload structure to maintain metadata and debug information compatibility.

Uh oh!

feat: introduce fetchTools #114

feat: introduce fetchTools #114

Uh oh!

Conversation

ryoppippi commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

pkg-pr-new bot commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

cubic analysis

Linked issue analysis

Uh oh!

cubic-dev-ai bot Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryoppippi Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

ryoppippi Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

NicolasBelissent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

feat: introduce `fetchTools` #114

feat: introduce `fetchTools` #114

ryoppippi commented Oct 8, 2025 •

edited

Loading

pkg-pr-new bot commented Oct 8, 2025 •

edited

Loading

cubic-dev-ai bot Oct 8, 2025 •

edited

Loading