Josep Piguillem
748b485c9b
mcp/ exposes both APIs as MCP tools, one per operation in openapi.yaml, named after the Laravel route each lands on (public_projects_index, admin_pages_update, ...). Nothing is written by hand: the tools are derived from the document the target application serves, which the contract tests already hold to the truth. Two transports over one core: - stdio (`node mcp/server.mjs`), registered in .mcp.json, signing in with credentials from the environment and refreshing the token. - Streamable HTTP (`--http`), stateless, deployed as the landing-mcp service. It holds no credentials: each request brings its caller's Pireon Basic credentials or bearer token, so the API applies that person's permissions. Sessions live in memory keyed by a hash, refused credentials are remembered for a minute, and the spec is reloaded every minute so new endpoints appear without a redeploy. Left out on purpose: the token exchange, telemetry, and the contact and apply forms, which notify real people. The preview secret is never sent for anonymous callers, and is unset in the deployment by default. A CI job runs the Node tests, including the HTTP mode end to end against a fake application. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
82 lines
3.1 KiB
JavaScript
82 lines
3.1 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { readFile } from 'node:fs/promises';
|
|
import { test } from 'node:test';
|
|
import { parse } from 'yaml';
|
|
import { buildTools } from '../src/tools.mjs';
|
|
|
|
// The document in this checkout: the one the application serves.
|
|
const spec = parse(await readFile(new URL('../../public/openapi.yaml', import.meta.url), 'utf8'));
|
|
const tools = buildTools(spec);
|
|
const byName = new Map(tools.map((tool) => [tool.name, tool]));
|
|
|
|
test('names follow the Laravel routes', () => {
|
|
const expected = {
|
|
public_site: 'GET /public/v1/site',
|
|
public_good_first_issues: 'GET /public/v1/good-first-issues',
|
|
public_projects_index: 'GET /public/v1/projects',
|
|
public_projects_show: 'GET /public/v1/projects/{slug}',
|
|
public_clients: 'GET /public/v1/clients',
|
|
admin_me: 'GET /v1/me',
|
|
admin_pages_index: 'GET /v1/pages',
|
|
admin_pages_store: 'POST /v1/pages',
|
|
admin_pages_update: 'PATCH /v1/pages/{page}',
|
|
admin_pages_destroy: 'DELETE /v1/pages/{page}',
|
|
admin_pages_restore: 'POST /v1/pages/{page}/restore',
|
|
admin_roles_catalogue: 'GET /v1/roles/catalogue',
|
|
};
|
|
|
|
for (const [name, route] of Object.entries(expected)) {
|
|
const tool = byName.get(name);
|
|
assert.ok(tool, `missing ${name}`);
|
|
assert.equal(`${tool.operation.method} ${tool.operation.path}`, route);
|
|
}
|
|
});
|
|
|
|
test('names are valid MCP tool names', () => {
|
|
for (const { name } of tools) assert.match(name, /^[a-z0-9_]{1,64}$/);
|
|
});
|
|
|
|
test('leaves out what is not for an operator', () => {
|
|
const routes = tools.map(({ operation }) => `${operation.method} ${operation.path}`);
|
|
|
|
assert.ok(!routes.includes('POST /v1/auth/token'));
|
|
assert.ok(!routes.some((route) => route.includes('/telemetry/')));
|
|
assert.ok(!routes.includes('POST /public/v1/contact'));
|
|
assert.ok(!routes.includes('POST /public/v1/calls/{slug}/apply'));
|
|
});
|
|
|
|
test('every other documented operation is a tool', () => {
|
|
const documented = Object.values(spec.paths)
|
|
.flatMap((item) => ['get', 'post', 'put', 'patch', 'delete'].filter((m) => item[m])).length;
|
|
|
|
// auth/token, two telemetry endpoints, contact and apply.
|
|
assert.equal(tools.length, documented - 5);
|
|
});
|
|
|
|
test('schemas are self-contained JSON Schema', () => {
|
|
for (const tool of tools) {
|
|
const json = JSON.stringify(tool.inputSchema);
|
|
|
|
assert.ok(!json.includes('"$ref"'), `${tool.name} still has a $ref`);
|
|
assert.ok(!json.includes('"nullable"'), `${tool.name} still has nullable`);
|
|
}
|
|
});
|
|
|
|
test('path parameters are required, headers are not offered', () => {
|
|
const show = byName.get('public_projects_show');
|
|
|
|
assert.deepEqual(show.inputSchema.required, ['slug']);
|
|
assert.ok(!('X-Preview-Token' in show.inputSchema.properties));
|
|
});
|
|
|
|
test('a create requires its fields, an update does not', () => {
|
|
assert.deepEqual(byName.get('admin_pages_store').inputSchema.properties.body.required, ['title', 'slug']);
|
|
assert.equal(byName.get('admin_pages_update').inputSchema.properties.body.required, undefined);
|
|
});
|
|
|
|
test('only the admin API is marked as needing a token', () => {
|
|
for (const tool of tools) {
|
|
assert.equal(tool.operation.requiresAuth, tool.name.startsWith('admin_'), tool.name);
|
|
}
|
|
});
|