fix(mcp): tighten stdio server logging and error semantics#1790
Conversation
Four polish items on top of tinyhumansai#1760: - Always install the tracing subscriber when running `openhuman-core mcp`, defaulting to `warn`. Previously `init_for_cli_run` only ran with `--verbose`, so `log::error!` / `log::warn!` events were silently dropped when the server ran as a subprocess of Claude Desktop / Cursor. A user-set `RUST_LOG` still wins. - Route `print_help` through `eprintln!`. The `mcp` subcommand suppresses the banner to keep stdout protocol-only; help output should follow the same contract. - Add `ToolCallError::Internal` and a `code()` / `jsonrpc_message()` dispatcher. Config-load failures inside `enforce_read_policy` now surface as `-32603 Internal error` instead of being mis-labelled as `-32602 Invalid params`. Policy denials remain `InvalidParams` so the caller still sees actionable reason text. - Reject `k > MAX_LIMIT` in `memory.search` / `memory.recall` instead of silently clamping. The schema advertises `maximum: 50`; clamping made the LLM believe it received the page size it requested and prevented the corrective feedback loop.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PR refactors MCP server error handling to distinguish invalid client parameters from server-side failures. ChangesMCP Error Classification and Validation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/openhuman/mcp_server/tools.rs (1)
288-302: ⚡ Quick winAdd debug logging when config load fails.
The coding guidelines require verbose diagnostics logging for external calls and error handling paths. The
load_config_with_timeout()call at line 292 is an external call, and the new error classification (Internal vs InvalidParams) is a behavior change that should be logged for debugging and operational visibility.📊 Suggested logging addition
async fn enforce_read_policy(tool_name: &str) -> Result<(), ToolCallError> { // Config-load failure is an internal/server issue (disk error, corrupt // config), not bad client input — report it as `-32603 Internal error` // rather than `-32602 Invalid params`. - let config = config_rpc::load_config_with_timeout() - .await - .map_err(|err| ToolCallError::Internal(format!("failed to load config: {err}")))?; + let config = match config_rpc::load_config_with_timeout().await { + Ok(config) => config, + Err(err) => { + log::warn!( + "[mcp_server] enforce_read_policy config load failed tool={} error={}", + tool_name, + err + ); + return Err(ToolCallError::Internal(format!("failed to load config: {err}"))); + } + }; let policy = SecurityPolicy::from_config(&config.autonomy, &config.workspace_dir);As per coding guidelines: "In Rust, use
log/tracingatdebugortracelevel for development-oriented diagnostics on new/changed flows, including logs at entry/exit points, branch decisions, external calls, retries/timeouts, state transitions, and error handling paths."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/openhuman/mcp_server/tools.rs` around lines 288 - 302, enforce_read_policy currently classifies a config-load failure as ToolCallError::Internal but does not emit diagnostic logs; add debug-level tracing around the external call to config_rpc::load_config_with_timeout() (e.g., a trace/debug before the call and a debug on error) so the failure and the decision to map it to Internal are visible; specifically, inside enforce_read_policy log the call attempt, and in the map_err closure log the error details and the fact you are returning ToolCallError::Internal (use tracing::debug or log::debug and include err and tool_name to aid debugging).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/openhuman/mcp_server/tools.rs`:
- Around line 288-302: enforce_read_policy currently classifies a config-load
failure as ToolCallError::Internal but does not emit diagnostic logs; add
debug-level tracing around the external call to
config_rpc::load_config_with_timeout() (e.g., a trace/debug before the call and
a debug on error) so the failure and the decision to map it to Internal are
visible; specifically, inside enforce_read_policy log the call attempt, and in
the map_err closure log the error details and the fact you are returning
ToolCallError::Internal (use tracing::debug or log::debug and include err and
tool_name to aid debugging).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cd3b3c89-e35e-4eb9-b995-a765003186e4
📒 Files selected for processing (3)
src/openhuman/mcp_server/protocol.rssrc/openhuman/mcp_server/stdio.rssrc/openhuman/mcp_server/tools.rs
|
Heads-up: the two red rust checks are blocked on what looks like a regression The failing test:
Recent CI runs on The third red is Happy to re-trigger CI once |
Surface the external call's failure through `log::warn!` so `-32603 Internal error` returns are observable on the stderr diagnostic stream (addresses CodeRabbit nitpick on tools.rs:288).
|
Thanks for the merge |
2 participants
Summary
openhuman-core mcp, defaulting towarn, so production errors reach stderr without--verbose.print_helpthrougheprintln!to keep stdout protocol-only, matching the banner-suppression contract.ToolCallError::Internalso config-load failures surface as JSON-RPC-32603 Internal errorinstead of being mis-labelled-32602 Invalid params.k > MAX_LIMITinmemory.search/memory.recallinstead of silently clamping, so the LLM can self-correct on the next call.Problem
Four follow-ups on the Phase 1 MCP server (#1760) noticed during review:
init_for_cli_runran only when--verbosewas passed, solog::error!/log::warn!events were dropped when the server ran as a subprocess of Claude Desktop / Cursor — exactly the contexts where field-debugging requires those events.print_helpusedprintln!while the banner suppression incore/cli.rskeeps stdout clean for JSON-RPC frames. Inconsistent, and a footgun if anyone later wires help into a non-exit path.enforce_read_policywere mapped toToolCallError::InvalidParams, surfacing as-32602 Invalid params. Clients then mis-attribute server-side problems to bad caller arguments.optional_limitclampedk > 50to 50 without telling the caller. The schema advertisesmaximum: 50, so a higher value is a client bug; silent clamping prevents the LLM's corrective feedback loop.Solution
init_mcp_loggingalways installs the subscriber; default level iswarn,--verbosepromotes todebug, and a user-setRUST_LOGalways wins.print_helpnow useseprintln!.ToolCallError::Internal(String)added withcode()+jsonrpc_message()dispatchers.enforce_read_policyusesInternalfor config-load failures and keepsInvalidParamsfor policy denials (which are actionable to the caller).optional_limitreturnsInvalidParams("argumentkmust not exceed N (got M)")fork > MAX_LIMIT.Submission Checklist
tools.rs; the replacedmemory_search_params_default_and_clamp_know becomesmemory_search_params_trim_query_and_use_default_k+memory_search_rejects_k_above_max+memory_search_accepts_k_at_max(boundary).cargo test --lib mcp_server::runs 20 tests (0 failed). New error/clamp paths each have dedicated coverage. CI will confirm the gate.N/A: behaviour-only polish on existing row 11.1.4## RelatedN/A: opt-in MCP server, not on release-cut pathCloses #NNNin the## Relatedsection —N/A: phase 1 (#1760) is the headline implementation; this PR is polish, not the closing PR for #1586Impact
openhuman-core mcpsubcommand only. No HTTP RPC, web, or mobile impact.kvalidation. The schema-advertisedmaximum: 50was already public, so well-behaved clients are unaffected.optional_limit, one subscriber installed earlier in startup.SecurityPolicygate untouched.Related
11.1.4(MCP stdio server)AI Authored PR Metadata (required for Codex/Linear PRs)
Linear Issue
Commit & Branch
Validation Run
pnpm --filter openhuman-app format:check— N/A (no JS/TS changes)pnpm typecheck— N/A (no JS/TS changes)cargo test --lib mcp_server::— 20 passed, 0 failedcargo fmt --checkclean;cargo check --libcompiles;cargo clippy --lib --no-depsno mcp_server warningsapp/src-taurichanges)Validation Blocked
command:N/Aerror:N/Aimpact:N/ABehavior Changes
error/warnlogs reach stderr by default;k > 50returns an error instead of silent clamp; config-load failures surface as-32603.Parity Contract
initialize,ping,tools/list,tools/callunchanged. All existing Phase 1 tests still pass.--verbosestill bumps to debug;ToolCallError::InvalidParamscallers unchanged.Duplicate / Superseded PR Handling
Summary by CodeRabbit
Bug Fixes
Improvements
Tests