Skip to content

feat(mcp): onboarding tools — review, correct, reclassify via MCP - #249

Merged
thewrz merged 4 commits into
mainfrom
feat/issue-140
Jun 24, 2026
Merged

feat(mcp): onboarding tools — review, correct, reclassify via MCP#249
thewrz merged 4 commits into
mainfrom
feat/issue-140

Conversation

@thewrz

@thewrz thewrz commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Why

MCP parity for the onboarding loop (#140, Wave 4 / O-13) so an AI agent can drive the whole flow over POST /mcp — import a master, inspect what the classifier decided and why, correct it, and re-run after a convention change — without falling back to REST. Closes #140 (blockers #135/#136/#137/#139 all merged).

What

Five new MCP tools, each a thin adapter over the same db/index.js query its REST counterpart calls, so the two surfaces cannot drift:

  • review_editability — per-paragraph effective editability (value, confidence, evidence, and a human override when set) via the shared getSpecTree query; optional maxConfidence filter returns only the low-confidence review queue.
  • get_onboarding_report — spec-keyed onboarding report reusing the shared summarizeEditability builder plus persisted style-source state.
  • set_editability_override / clear_editability_override — the feat(api): editability corrections + reclassify with before/after diff #136 PATCH /specs/:id/paragraphs/:nodeId/editability as tools (shared setSpecEditabilityOverride / clearSpecEditabilityOverride).
  • reclassify_specPOST /specs/:id/reclassify as a tool; returns the same ReclassifyReport before/after diff. preview: true diffs without persisting.

Handlers live in src/mcp/onboarding-handlers.ts; registration in src/mcp/onboarding-tools.ts (split out so tools.ts stays under the 400-line cap). The pure editability summarizer moved from src/api/onboarding-report.ts to src/lib/editability-summary.ts (re-exported from the API module) so MCP shares one implementation without reaching into src/api.

Design decisions

  • get_onboarding_report spec→report mapping. The REST report (GET /libraries/import/jobs/:jobId) is job-keyed and built at import time from three inputs, two of which depend on the original uploaded bytes that are not persisted: styleDerivation (consensus audit from analyzeDocxStyles(buffer)) and parseWarnings (tree.warnings, absent from the DB-stored tree). Only the editability summary (pure over the persisted tree) and the style-source assignment are reconstructable from a specId. So the spec-keyed tool reuses the exact summarizeEditability builder REST uses (single source) plus getSpecStyleSource / getOnboardingStatus, and explicitly marks the two import-time-only sections as unavailable in a note field rather than fabricating them. The pure summarizer was extracted to src/lib/ to keep the MCP module off the src/api boundary.
  • Single source = literally the same query. review_editability evidence/confidence comes from getSpecTree's deriveEditability — byte-identical to REST and get_spec. A parity test asserts this directly.
  • No new rate limiter. All five tools register inside registerTools and run under the existing transport-level mcpRateLimit on POST /mcp (security(mcp): rate limit POST /mcp — parse_document and generate_docx DoS hardening #69); the expensive reclassify_spec path is already throttled. No second route or limiter added.
  • Handlers never throw — every failure path returns { isError: true } (unknown spec, wrong-spec node, malformed uuid, no resolvable convention, unsafe rules). No thrown handler reaches the transport.

No openapi.yaml change — MCP tools are not part of the REST contract; no REST endpoint was touched.

Testing

  • Unit tests pass (pnpm test — 1012 tests across 75 files green with DATABASE_URL set)
  • Integration tests pass (all 4 MCP suites green — 54 tests, including the new onboarding.integration.test.ts: 13 tests covering each tool's happy path + isError shape, the single-source parity assertion, maxConfidence filtering, override flip/clear round-trip, and preview)
  • Lint clean (pnpm lint: eslint + tsc + prettier)
  • CI green
  • Note: two docs.integration.test.ts failures are pre-existing and environmental — Express sendFile rejects the dot-prefixed .worktrees/ path via its default dotfile guard (proven: a bare sendFile of openapi.yaml from this path returns 404). They are unrelated to this PR (no docs/openapi files touched) and pass on a normal checkout path.

🤖 Co-authored by Claude Opus 4.8. Closes #140.

Summary by CodeRabbit

Release Notes

  • New Features

    • Added MCP onboarding tools for reviewing editability, generating onboarding reports, setting/clearing editability overrides, and reclassifying specifications.
    • Documented the Streamable HTTP POST /mcp MCP tool surface.
  • Documentation

    • Updated README and ARCHITECTURE with MCP tools details and tool behavior.
    • Added an onboarding implementation plan for MCP editability tooling.
  • Refactor

    • Moved editability summarization into a shared utility for reuse by the REST and MCP layers.
  • Tests

    • Added integration tests covering onboarding tool inputs, outputs, filtering, and error handling.

thewrz and others added 3 commits June 23, 2026 16:49
…euse

The onboarding-report editability summarizer is moved out of src/api into
src/lib/editability-summary.ts so the MCP get_onboarding_report tool (#140) can
share the exact builder the REST report uses without crossing the api module
boundary. src/api/onboarding-report.ts re-exports it to keep the REST import path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
)

Five MCP tools give AI agents parity with the REST onboarding loop. Each is a
thin adapter over the SAME db/index.js query the matching REST handler calls, so
the two surfaces cannot drift:

- review_editability  — per-paragraph value/confidence/evidence/override from the
  shared getSpecTree query; optional maxConfidence low-confidence review filter.
- get_onboarding_report — spec-keyed report reusing the shared summarizeEditability
  builder plus persisted style-source state. styleDerivation/parseWarnings are
  import-time-only (raw bytes not persisted) and explicitly marked unavailable.
- set_/clear_editability_override — the #136 PATCH as tools (shared override query).
- reclassify_spec — POST /specs/:id/reclassify as a tool; returns the before/after
  ReclassifyReport. preview=true diffs without persisting.

Handlers in onboarding-handlers.ts, registration in onboarding-tools.ts (keeps
tools.ts under the 400-line cap). All run under the existing /mcp transport rate
limiter (#69) — no new route or limiter. Handlers never throw: every failure
returns { isError: true }.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
#140)

Add an MCP tools table to the README API Surface section listing all tools
including the new review_editability, get_onboarding_report,
set_/clear_editability_override, and reclassify_spec; extend the ARCHITECTURE
file-structure map with onboarding-tools.ts / onboarding-handlers.ts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Jun 24, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 37a8bd47-2c9e-4a2c-bf23-52bf1b132a01

📥 Commits

Reviewing files that changed from the base of the PR and between 50e2790 and 15cbc55.

📒 Files selected for processing (3)
  • ARCHITECTURE.md
  • README.md
  • docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md
✅ Files skipped from review due to trivial changes (3)
  • docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md
  • README.md
  • ARCHITECTURE.md

📝 Walkthrough

Walkthrough

Five MCP onboarding tools (review_editability, get_onboarding_report, set_editability_override, clear_editability_override, reclassify_spec) are added. The editability-summary logic is extracted from src/api/onboarding-report.ts into a shared src/lib/editability-summary.ts. New handler and tool-registration modules are created and wired into the existing MCP tool registry, with integration tests and documentation updates.

Changes

MCP Onboarding & Editability Tools

Layer / File(s) Summary
Shared editability-summary utility and REST re-export
src/lib/editability-summary.ts, src/api/onboarding-report.ts
src/lib/editability-summary.ts is introduced with LOW_CONFIDENCE_THRESHOLD, an internal tree-walker, and summarizeEditability. src/api/onboarding-report.ts is reduced to a re-export of those symbols from the new shared module.
MCP handler implementations
src/mcp/onboarding-handlers.ts
Adds five exported handler functions with shared ToolResult types, jsonResult/ownershipError helpers, and a recursive collectEditability walker. Each handler wraps DB calls in try/catch and returns { isError: true } payloads instead of throwing.
Zod schemas and MCP tool registration
src/mcp/onboarding-tools.ts, src/mcp/tools.ts
onboarding-tools.ts defines specId/nodeId Zod validators and registers all five tools via registerReviewTools and registerOverrideTools. tools.ts imports and calls registerOnboardingTools(server) inside registerTools.
Integration tests for all five MCP tools
src/mcp/onboarding.integration.test.ts
Express harness with mcpTool JSON-RPC helper (supporting both JSON and text/event-stream), seeded spec/classifications, and per-tool test cases covering happy paths, filtering, persistence vs. preview, and isError error paths.
Documentation and architecture updates
ARCHITECTURE.md, README.md, docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md
ARCHITECTURE.md module layout is extended; README.md gains a MCP tools subsection enumerating all exposed tools; the implementation plan document is added under docs/superpowers/plans/.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related issues

Possibly related PRs

  • wrzonance/SpecR#55: Both PRs modify registerTools(server) in src/mcp/tools.ts to wire additional tool groups into the MCP tool registry.
  • wrzonance/SpecR#241: Both PRs extend registerTools(server) in src/mcp/tools.ts with a new register*Tools(server) call, making the wiring pattern directly parallel.
  • wrzonance/SpecR#248: This PR's handleGetOnboardingReport consumes onboardingStatus from the DB layer introduced in that PR, creating a direct runtime dependency.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: introducing five MCP onboarding tools (review, correct/set-clear overrides, reclassify) that enable AI agents to drive the onboarding loop via MCP without REST fallback.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/issue-140

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (3)
README.md (1)

63-65: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Minor: Clarify the phrasing "read-or-correct over db/index.js queries".

The phrase could be more natural. Consider: "read or correct using db/index.js queries" or "thin adapters over db/index.js queries for reading and correction."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 63 - 65, The phrase "read-or-correct over
`db/index.js` queries" in the README description of the Streamable HTTP server's
POST /mcp endpoint is awkwardly phrased and unclear. Replace it with more
natural wording such as "read or correct using `db/index.js` queries" or "thin
adapters over `db/index.js` queries for reading and correction" to improve
clarity and readability of the documentation.
docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md (1)

5-5: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Minor: Remove redundant "exact" for brevity.

Line 5 contains a static analysis style flag: "exact same" is more verbose than necessary. Suggested revision: "each reusing the same db/index.js queries the REST handlers use."

📝 Suggested revision
-**Goal:** Add 5 MCP tools so AI agents can drive the onboarding loop (report, review, correct, reclassify) over `POST /mcp`, each reusing the exact same `db/index.js` queries the REST handlers use.
+**Goal:** Add 5 MCP tools so AI agents can drive the onboarding loop (report, review, correct, reclassify) over `POST /mcp`, each reusing the same `db/index.js` queries the REST handlers use.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md` at line 5, The
Goal statement contains redundant wording with "exact same" which can be
simplified for brevity. In the Goal section where it states "each reusing the
exact same `db/index.js` queries the REST handlers use", remove the word "exact"
to make it read "each reusing the same `db/index.js` queries the REST handlers
use." This maintains the meaning while improving conciseness.

Source: Linters/SAST tools

ARCHITECTURE.md (1)

724-724: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Update tools.ts description to acknowledge delegated onboarding tool registration.

The tools.ts comment lists eight tools directly registered within that module, but per the context, registerTools() also calls registerOnboardingTools(server) (line 341 of tools.ts), which adds five more tools. The comment should clarify this delegation so readers consulting ARCHITECTURE.md understand the complete set of tools exposed via registerTools().

📝 Suggested revision for line 724
-│   │   ├── tools.ts             # registerTools(server): search_library, list_sections, get_spec, get_paragraph, parse_document, generate_docx, load_files, coordination_report
+│   │   ├── tools.ts             # registerTools(server): delegates to registerLibraryTools, registerProjectTools, registerSpecTools, registerParserTools, registerGeneratorTools, registerLoaderTools, registerCoordinationTools, and registerOnboardingTools

Alternatively, if you prefer a more concise approach:

-│   │   ├── tools.ts             # registerTools(server): search_library, list_sections, get_spec, get_paragraph, parse_document, generate_docx, load_files, coordination_report
+│   │   ├── tools.ts             # registerTools(server): wires all tool groups (search, spec, parser, generator, loader, coordination, onboarding)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ARCHITECTURE.md` at line 724, The comment for tools.ts on line 724 of
ARCHITECTURE.md currently only lists the eight tools that are directly
registered within the tools module, but it does not acknowledge that the
registerTools function also calls registerOnboardingTools(server) which
registers five additional tools. Update the comment to clarify that
registerTools() delegates tool registration to registerOnboardingTools(server)
in addition to the eight tools directly registered, so that readers understand
the complete set of tools exposed through the registerTools() function.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ARCHITECTURE.md`:
- Line 724: The comment for tools.ts on line 724 of ARCHITECTURE.md currently
only lists the eight tools that are directly registered within the tools module,
but it does not acknowledge that the registerTools function also calls
registerOnboardingTools(server) which registers five additional tools. Update
the comment to clarify that registerTools() delegates tool registration to
registerOnboardingTools(server) in addition to the eight tools directly
registered, so that readers understand the complete set of tools exposed through
the registerTools() function.

In `@docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md`:
- Line 5: The Goal statement contains redundant wording with "exact same" which
can be simplified for brevity. In the Goal section where it states "each reusing
the exact same `db/index.js` queries the REST handlers use", remove the word
"exact" to make it read "each reusing the same `db/index.js` queries the REST
handlers use." This maintains the meaning while improving conciseness.

In `@README.md`:
- Around line 63-65: The phrase "read-or-correct over `db/index.js` queries" in
the README description of the Streamable HTTP server's POST /mcp endpoint is
awkwardly phrased and unclear. Replace it with more natural wording such as
"read or correct using `db/index.js` queries" or "thin adapters over
`db/index.js` queries for reading and correction" to improve clarity and
readability of the documentation.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2234037d-a89a-4452-9896-fa718c5c5207

📥 Commits

Reviewing files that changed from the base of the PR and between 8a69093 and 50e2790.

📒 Files selected for processing (9)
  • ARCHITECTURE.md
  • README.md
  • docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md
  • src/api/onboarding-report.ts
  • src/lib/editability-summary.ts
  • src/mcp/onboarding-handlers.ts
  • src/mcp/onboarding-tools.ts
  • src/mcp/onboarding.integration.test.ts
  • src/mcp/tools.ts

…on note

- README: 'reading or correcting via db/index.js queries' (clearer than 'read-or-correct over')
- ARCHITECTURE: note registerTools delegates to registerOnboardingTools (tree comment was stale)
- plan doc: drop redundant 'exact' from 'exact same'

All three are CodeRabbit body nitpicks (🔵 trivial); doc-only, no src/ change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@thewrz

thewrz commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

CodeRabbit body nitpicks (🧹 Nitpick comments, 3) — all addressed in 15cbc55 (docs-only, no src/ change):

  • README.md — reworded "read-or-correct over db/index.js queries" → "reading or correcting via db/index.js queries".
  • docs/superpowers/plans/2026-06-23-mcp-onboarding-tools.md — dropped the redundant "exact" from "exact same".
  • ARCHITECTURE.md — the tools.ts tree comment was stale; noted that registerTools also delegates to registerOnboardingTools (onboarding-tools.ts). Note: I did not apply CodeRabbit's suggested diff verbatim, since it referenced registerLibraryTools/registerProjectTools/etc. functions that don't exist — tools.ts registers its 8 tools inline and delegates only the onboarding group. The applied wording reflects the actual structure.

@thewrz
thewrz merged commit 7c6f046 into main Jun 24, 2026
5 checks passed
@thewrz
thewrz deleted the feat/issue-140 branch June 24, 2026 02:00
thewrz added a commit that referenced this pull request Jul 1, 2026
#325)

* docs(readme): sync capabilities to last month of merged PRs

Reflect shipped work in the README's "Included Today", "API Surface", and MCP
tool table, validated against the merged diffs and current main:

- PDF ingest (text-layer + OCR + font-encoding recovery) accepted by POST /parse
  (#287, #290, #311)
- coordination / E&O report + submittal register (#241, #269, #277, #282, #283,
  #284) and article-role tagging (#273)
- onboarding pipeline: library import, editability review/override, reclassify,
  finalize/reopen, open-comments (#243, #247, #248, #249, #272)
- spec/project soft-delete + restore (#257, #313), document concurrency (#197),
  revision/addendum manual rendering (#221), numbering profiles (#317, #322)
- add missing MCP tools get_numbering_profile, submittal_register,
  open_comments_report; document GET /docs (Scalar) (#213, #285)
- add Example Client pointer to examples/web_ui_demo (#225)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(roadmap): move shipped work to done; re-date to 2026-07-01

Reconcile the roadmap with merged reality (was stamped 2026-06-17). Moved from
planned/in-progress to Included, each validated against the diff:

- PDF ingest (#287, #290, #311) — remove from "Later"
- deep paragraph nesting pr6/pr7 (#215)
- revision nomenclature (#216) + revision/addendum manual rendering (#221) —
  the two "Near Term" Phase 2e items are done
- coordination / E&O report, required-sections, article-role, submittal register
  (#239, #241, #269, #273, #277, #282, #283, #284) — new "Coordination and
  Semantics" section; removed "coordination report" from planned Phase 4
- onboarding APIs (#243, #247, #248, #249, #272) — API done; UI remains planned
- soft-delete/withdraw (#257, #313), section-number format (#266, #271),
  external-content associations (#242), structural numbering profiles (#317)

Kept as planned (foundation only): header/footer composition (#222, #314) and
keynote surfacing (#315) — DB/AST exist, no resolution/render/export yet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(architecture): reflect merged structural changes

Update the architecture spec for shipped work, validated against the diffs and
current schema/routes:

- Tech Stack + Data Flow: Parse — PDF text-layer (unpdf/pdfjs-dist) + OCR
  (tesseract.js/@napi-rs/canvas) path and numberingProfileId override (#287,
  #290, #311, #317; ADR-034, ADR-039)
- DB schema — specs.onboarding_status/withdrawn_at, projects.section_number_format
  /deleted_at/deleted_by, paragraphs.source_facts/classification/
  editability_override; "Additional tables" summary for editing_conventions,
  paragraph_associations, required_sections, keynotes, header_footer_configs,
  numbering_profiles, revision_nomenclature_profiles (foundation-only tables
  flagged) (ADR-021/022/023/028/031/032; #187, #242)
- new Coordination Report / E&O section (finding vocabulary) and Document
  Concurrency section (locks/optimistic/lifecycle) (#197, #241, #269, #277,
  #282, #283, #284; ADR-018, ADR-033/035/036/037)
- AST meta.articleRole (#273, ADR-033); API-surface note pointing at the
  CI-enforced openapi.yaml + GET /docs; refreshed MCP tool list

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(mcp): onboarding tools — review, correct, reclassify via MCP

1 participant