feat(mcp): full MCP server + 14 platforms / 374 tools, per-user creds, audit-clean (#6)#8
Merged
teslashibe merged 3 commits intomainfrom Apr 22, 2026
Merged
Conversation
Implements Issue #6 end-to-end: - New mcptool contract (github.com/teslashibe/mcptool, v0.1.0) drives schema-from-Go-structs and Provider/Tool definitions across all scrapers. - Each of 13 scraper packages (linkedin-go, x-go, x-viral-go, reddit-go, redditviral-go, hn-go, facebook-go, instagram-go, tiktok-go, producthunt-go, nextdoor-go, elevenlabs-go, codegen-go) ships its own mcp/ subpackage and coverage test, all merged + tagged in lockstep. - agent-setup owns transport (JSON-RPC 2.0 over HTTP), per-user JWT auth (header + URL-path variants), the Registry, the ResponseShaper (limit=10 default, max=50, 800-char truncation, 64 KB cap, compact JSON), and structured error mapping (credential_missing, credential_invalid, etc.). - Per-user Anthropic Agent + Environment provisioning via agent.Provisioner — lazy, idempotent, cached on users.anthropic_* columns. Each user's agent is configured with its own MCP URL /mcp/u/<jwt>/v1. - AES-GCM encrypted platform_credentials store; per-user Settings → Platform Connections UI (mobile) with cookie/token/extra fields per platform; chat UI surfaces a Reconnect CTA when MCP returns a credential_* error. - Generated docs/mcp-inventory.md (331 tools across 13 platforms), docs/mcp-architecture.md, docs/credentials-setup.md. - Cursor rule .cursor/rules/mcp-tool-conventions.mdc documents naming, schema, exclusion-list, and shaping conventions. - Dependabot config + nightly-deps.yml workflow keep all 14 scraper packages and mcptool in lockstep, opening a dependency-drift issue on any compile/test/coverage failure. Out of this PR: threads-go MCP wrapper (in-progress upstream; will land as a one-line registry add). All 14 scraper repos remain in scope.
…/14) Forensic audit per .cursor/rules/issue-audit-user-stories.mdc. Every acceptance criterion in agent-setup#6 is now satisfied. High-severity fixes (each with a regression test): - ResponseShaper infinite-recursed on numeric values (every tool that returned a number would crash the API process). Added explicit type- switch cases for all JSON-native primitives in mcp/shape.go. - ResponseShaper never set `truncated:true` on paged responses because it recursed into children before checking the items length. Detect the original length first. - threads-go MCP wrapper landed (teslashibe/threads-go v1.2.0, +43 tools); wired Threads() plugin into the registry; added Threads to the mobile settings UI; nightly-deps.yml + dependabot.yml extended. We are now 14/14 in-scope packages with 374 tools. - Mobile UI now accepts both Cookie-Editor JSON arrays and raw Cookie: header strings via parseExtensionInput(), with a paste-mode toggle on every credential form. Medium: - credentials.Service.Platforms() now sorts alphabetically so the settings UI shows a stable order across restarts and replicas. - internal/mcp gained its first unit tests (shape_test.go) — the H1/H2 bugs above were uncovered by writing them. Low: - README + docs updated from "13 platforms / 331 tools" to "14 / 374" to match the regenerated inventory. Audit deliverable: docs/mcp-audit.md (findings, gaps, user stories, testable ACs, risks).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6.
Summary
Lands the MCP integration spec end-to-end:
github.com/teslashibe/mcptool@v0.1.0definesTool/Provider/ response helpers; every scraper depends on it.mcp/subpackage with a coverage test that fails CI if a contributor adds an exported*Clientmethod without exposing it:linkedin-go,x-go,x-viral-go,reddit-go,redditviral-go,hn-go,facebook-go,instagram-go,tiktok-go,threads-go(added in this PR via teslashibe/threads-go#1 →v1.2.0, +43 tools),producthunt-go,nextdoor-go,elevenlabs-go,codegen-go.agent-setup/backend/internal/mcpowns transport (JSON-RPC 2.0 over HTTP —POST /api/mcp/v1with header JWT +POST /mcp/u/<jwt>/v1for Anthropic Managed Agents), per-user JWT auth (header + URL-path variants), theRegistry, theResponseShaper(limit=10default,max=50, 800-char rune truncation, 64 KB total cap, compact JSON), and structured error mapping (credential_missing,credential_invalid,credential_unreadable,binding_misconfigured).users.anthropic_*. Each user's agent is configured with its own MCP URL/mcp/u/<jwt>/v1so credentials never cross tenants.platform_credentialstable (CREDENTIALS_ENCRYPTION_KEY); per-user Settings → Platform Connections UI on mobile with both field-by-field input and Cookie-Editor JSON / rawCookie:header paste; chat surfaces a Reconnect CTA when MCP returns acredential_*error.docs/mcp-inventory.md(374 tools across 14 platforms),docs/mcp-architecture.md,docs/credentials-setup.md,docs/mcp-audit.md(this PR's forensic audit per.cursor/rules/issue-audit-user-stories.mdc), and.cursor/rules/mcp-tool-conventions.mdc.nightly-deps.ymlworkflow keep all 15 mods in lockstep, opening adependency-driftissue on any compile/test/coverage failure. Coverage tests run in every scraper'smcp-ci.yml.High-severity bugs found and fixed in this audit
ResponseShaperinfinite-recurses on numeric values (every tool returning a number would 1 GB-stack-overflow the API process). Fixed by adding explicit type-switch cases for all JSON-native primitives. Regression test:TestShape_StructFallback,TestShape_ByteCapHardCeiling.truncated:trueflag was never set on paged responses, so agents had no signal to re-call with a cursor. Fixed by detecting items length BEFORE recursing into children. Regression test:TestShape_PageItemsTruncatedFlag.parseExtensionInput()that auto-detects Cookie-Editor JSON arrays, rawCookie:header strings, or bare JSON objects, plus a paste-mode toggle on every form.Test plan
go test ./...(backend, all packages green incl. newinternal/mcp/shape_test.go)npm run typecheck(mobile, clean)go run ./cmd/mcp-inventoryregenerated → 14 platforms / 374 tools.cursor/rules/issue-audit-user-stories.mdcdocumented indocs/mcp-audit.md(findings, ACs, risks)agent-setup, prune thefeat/mcp-integrationworktreeOut of scope (per spec)