fix: expose MCP health probes - #47
Conversation
📝 WalkthroughWalkthroughThe MCP security configuration now permits unauthenticated liveness and readiness actuator probes. Context tests use MockMvc to verify both probes return 200 and ChangesHealth probe security
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.java`:
- Around line 50-57: Extend
healthProbesRemainPublicWhileTheMcpEndpointRequiresAuthentication with a request
to a non-allowlisted route such as /unmatched, and assert that it returns 403
Forbidden while preserving the existing health and /mcp assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fef90ff0-c4cc-4f7a-8ac0-034f0063c7e0
⛔ Files ignored due to path filters (1)
docs/increments/active/2026-07-25-production-cicd-zm/design.mdis excluded by!docs/**
📒 Files selected for processing (2)
apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaapps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.java
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Backend · Java 25
🧰 Additional context used
📓 Path-based instructions (2)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Record current behavior in architecture/specification documentation only after it exists in code; keep intended behavior in vision, roadmap, or an active increment, and do not duplicate state.
Before using unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult current official documentation via Context7 and the projectorgmemory-*verification skills.
Before retrieval, AI, MCP, permission, upload, graph, or export work, readdocs/guidelines/agent-safety.md.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant verification gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Files:
apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaapps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.java
**/*.{java,kt}
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a verification gate for the Java backend.
Files:
apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaapps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.java
🔇 Additional comments (2)
apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java (1)
22-26: LGTM!apps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.java (1)
5-22: LGTM!Also applies to: 36-38
| @Test | ||
| void healthProbesRemainPublicWhileTheMcpEndpointRequiresAuthentication() | ||
| throws Exception { | ||
| mvc.perform(get("/actuator/health/liveness")).andExpect(status().isOk()); | ||
| mvc.perform(get("/actuator/health/readiness")).andExpect(status().isOk()); | ||
| mvc.perform(get("/mcp")).andExpect(status().isUnauthorized()); | ||
| } | ||
|
|
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Cover the deny-all route contract.
Add an assertion for a non-allowlisted route, such as /unmatched, expecting 403 Forbidden; otherwise a regression that permits another route would remain undetected.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.java`
around lines 50 - 57, Extend
healthProbesRemainPublicWhileTheMcpEndpointRequiresAuthentication with a request
to a non-allowlisted route such as /unmatched, and assert that it returns 403
Forbidden while preserving the existing health and /mcp assertions.
1 participant
Summary
Verification
Summary by CodeRabbit