feat(agent-connect): mount MCP-over-HTTP at /mcp on the dashboard#12
Merged
Merged
Conversation
Owner
Author
Council Gate Verdict — APPROVERisk level: high | Agreement: 1.0 | Council session: Per-model scores (rubric: correctness / safety / style / tests / complexity)
Engraphis referenceCouncil verdict persisted as
|
Coding-Dev-Tools
added
the
council-approved
MCP-native agents (Claude Code, Cursor, ...) point one URL at the cloud instance (https://team.engraphis.com/mcp) with a per-user bearer token and reuse the same v2 store the dashboard reads — no local install. Team-gated (402) + member-authed (401), exactly like /api/remember. - mcp_server: set_service(svc) injects the dashboard's MemoryService so the MCP tools share ONE writer (no second SQLite connection -> no WAL lock contention). - dashboard_app: build the streamable-http ASGI app up front and give the app a lifespan that initializes the MCP session manager (a mounted sub-app's own lifespan does not run in Starlette -> 'Task group is not initialized'); mount at /mcp with the endpoint at '/' inside the sub-app so the prefix lines up. The mcp import + session-manager build are fully inside a try so the dashboard still starts if the mcp extra is absent (MCP mount is genuinely optional). Reset _session_manager per create_app() so multiple apps in one process (tests) each get a fresh, runnable instance (run() is once-per-instance). - _auth_gate: protect /mcp (Team license 402 + member token/cookie 401) before the existing /api/* logic; disable MCP's DNS-rebinding host allowlist on the mounted instance (default localhost-only would 421 a real domain like team.engraphis.com; the dashboard gate is the real auth boundary; standalone mcp_server_http is unaffected as its own process). - v2_team.connect-info: mcp_over_http + mcp_url now reflect whether /mcp is mounted. - docs/AGENT_CONNECT.md updated (/mcp now live + config snippet); CHANGELOG. - tests/test_agent_connect_mcp.py: 5 tests (401, 402, handshake+tools/list, write-shares-dashboard-store, connect-info reports /mcp). Suite green (one pre-existing flaky inspector test fails under load but passes in isolation, on main too).
Coding-Dev-Tools
force-pushed
the
feat/agent-connect-mcp
branch
from
7fb16f3 to
8ef6403
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What (stacked on #11)
MCP-native agents (Claude Code, Cursor, …) point one URL at the cloud instance —
https://team.engraphis.com/mcpwith a per-user bearer token — and reuse the same v2 store the dashboard reads. No local install. Team-gated (402) + member-authenticated (401), exactly like/api/remember.This is the
/mcpfollow-up I deferred from #11. Base isfeat/agent-connect(stacked) — rebase ontomainand switch the base tomainafter #11 merges.Changes
mcp_server.py:set_service(svc)injects the dashboard'sMemoryServiceso the MCP tools share one writer (no second SQLite connection → no WALdatabase is lockedcontention — the exact problemmcp_server_http.pywas written to avoid).dashboard_app.py\**: build the streamable-http ASGI app up front and give the app a **lifespan that initializes the MCP session manager** (a mounted sub-app's own lifespan does not run in Starlette →Task group is not initialized). Mount at/mcpwith the endpoint at/inside the sub-app so the prefix lines up. **Reset_session_managerpercreate_app()** so multiple apps in one process (tests) each get a fresh, runnable instance (run()` is once-per-instance)._auth_gate: protect/mcp(Team license 402 + member token/cookie 401) before the existing/api/*logic. Disable MCP's DNS-rebinding host allowlist on the mounted instance — its default localhost-only allowlist would 421 a real domain liketeam.engraphis.com; the dashboard gate is the real auth boundary. The standalonemcp_server_http.pyis unaffected (its own process).docs/AGENT_CONNECT.mdupdated (/mcpnow live + a config snippet) + CHANGELOG.Tests
tests/test_agent_connect_mcp.py— 4 tests, speaking the streamable-http JSON-RPC protocol directly over the TestClient (no real socket): 401 without auth, 402 without a Team license, handshake +tools/listreturns the engraphis tools, andtools/call engraphis_rememberwrites a memory that is immediately found via the dashboard's/api/recall(proves the shared single-writer store). Suite: 705 passed, 3 skipped, 0 failed. Ruff clean.Trade-off flagged
Disabling MCP's host validation reduces defense-in-depth, but
/mcpis already behind the dashboard's auth gate (Team license + per-user member token), so an attacker can't reach the MCP tools without a valid seat's token. Documented inAGENT_CONNECT.md.Not in this PR