feat(cli): add connect/discover timeout override flags for manual introspect#150
Merged
Conversation
github-actions
Bot
added
area: cli
bug-ops
enabled auto-merge (squash)
July 9, 2026 17:19
…rospect Expose --connect-timeout-secs and --discover-timeout-secs on the manual (non-from-config) introspect and generate commands, routed through the same validate_server_config chokepoint used by mcp.json's connectTimeoutSecs/discoverTimeoutSecs, so both paths accept and reject identical values. Also documents the decision to permanently reject a zero timeout rather than treat it as "no timeout": an unbounded wait would let a hung or malicious server block this tool's non-interactive CLI/MCP-server invocations forever, reopening the DoS exposure these timeouts were introduced to close. Resolves the two TODO(critic) markers left by #136. Closes #144, #145
bug-ops
force-pushed
the
144-145-timeout-overrides
branch
from
July 9, 2026 17:21
0deab80 to
881b6eb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--connect-timeout-secs/--discover-timeout-secsflags to the manual (non---from-config)introspectandgeneratecommands, routed through the samevalidate_server_configchokepoint used by themcp.json(--from-config) path, so both paths accept/reject identical values. Flags conflict with--from-configvia clap.0connect/discover timeout rather than treat it as "no timeout": an unbounded wait would let a hung or malicious server block this tool's non-interactive CLI/MCP-server invocations forever, reopening the DoS exposure these timeouts were introduced to close. No behavior change.TODO(critic)markers left by feat(core): allow mcp.json to override connect/discover timeouts #136.Closes #144, closes #145
Test plan
cargo +nightly fmt --checkcargo +stable clippy --all-targets --all-features --workspace -- -D warningscargo nextest run --all-features --workspace --no-fail-fast(739 passed)cargo test --doc --all-features --workspaceRUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links -D warnings" cargo doc --no-deps --workspace--connect-timeout-secs 0rejected with the same error as themcp.jsonpath;--connect-timeout-secs 5accepted;--from-config X --connect-timeout-secs 5rejected by clap as conflicting args