feat(mcp): prefer Local HTTP over opening SQLite

[tomymaritano]

Summary

Wire @dripnex/mcp-server to Dripnex Local HTTP so Cursor / Grok / Claude talk Bearer loopback instead of opening SQLite when the HTTP env is set. Settings → Integrations → MCP now copies that same HTTP env.

• Prefer DRIPNEX_LOCAL_SERVER_URL + DRIPNEX_LOCAL_TOKEN (loopback only). SQLite (DRIPNEX_DB_PATH) remains the fallback when those are unset.
• Map existing tools onto the real routes in localServer.ts (notes, search, books=notebooks, tags).
• Add the missing HTTP surfaces: dripnex_status, notebook CRUD, tag create/update, dripnex_get_changes.
• Soft-delete vs hard-delete follows the desktop handler: DELETE /api/notes/:id is trash; ?permanent=1 is hard delete (dripnex_trash_note permanent).
• Writes stay gated by Settings → Integrations → Allow writes (mcp.json) / DRIPNEX_MCP_WRITES. Enabling Local HTTP is not a write grant (verified: httpApiEnabled vs mcpWrites are separate). Flipping Allow writes does not change the copied snippet.
• Settings snippets: Claude Code / Codex copy DRIPNEX_LOCAL_SERVER_URL + DRIPNEX_LOCAL_TOKEN (the URL and token already shown in the panel) when Local HTTP or MCP is on. DRIPNEX_DB_PATH is only used when HTTP is off. The launch path stays the real mcp-server entry when the app knows it; otherwise /ABS/PATH/... remains a placeholder — HTTP env is still preferred.
• HTTP client unit tests use mocked fetch. HTTP store mapping is covered with a stub client. Snippet tests use placeholder-token and /tmp paths only.

docs/ai/ is not on develop — it lives on docs/ai-mcp-plan. Env and Cursor/Grok config are in packages/mcp-server/README.md (placeholders only; no tokens).

Type of Change

• New feature
• Documentation update

Checklist

• PR targets develop branch (not main)
• MCP tests: 35 passed (http client/config/store, writes, notes, sqliteRepo)
• Snippet tests: 7 passed
• Monorepo typecheck passed on push
• fts5-triggers fails in this cloud Node build (no such module: fts5) — pre-existing, file not changed

  

[coderabbitai]

Warning

Review limit reached

@tomymaritano, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 8 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 11d9b147-32bf-48fd-8919-8b729f7a64de

📥 Commits

Reviewing files that changed from the base of the PR and between d35220f and e266aa7.

📒 Files selected for processing (15)

• apps/desktop/src/renderer/pages/settings/sections/McpCard.tsx
• apps/desktop/src/renderer/utils/__tests__/mcpSnippets.test.ts
• apps/desktop/src/renderer/utils/mcpSnippets.ts
• packages/mcp-server/README.md
• packages/mcp-server/src/__tests__/httpClient.test.ts
• packages/mcp-server/src/__tests__/httpConfig.test.ts
• packages/mcp-server/src/__tests__/httpStore.test.ts
• packages/mcp-server/src/__tests__/notes.test.ts
• packages/mcp-server/src/__tests__/writes.test.ts
• packages/mcp-server/src/db.ts
• packages/mcp-server/src/http.ts
• packages/mcp-server/src/httpStore.ts
• packages/mcp-server/src/index.ts
• packages/mcp-server/src/sqliteStore.ts
• packages/mcp-server/src/store.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tomymaritano]

Pushed a fix for the CodeQL js/polynomial-redos (high) alert on packages/mcp-server/src/http.ts.

rawUrl.replace(/\/+$/, '') backtracks quadratically on a long run of slashes that is not at the end of the string — measured ~1.3s for 40k slashes. Replaced with a linear scan, plus a test that fails if it regresses (100ms budget on that input) and one covering multiple trailing slashes.

mcp-server tests: 42/42 green.

[github-actions]

🎉 This PR is included in version 0.17.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀