feat: added grain mcp initial implementation #71

aline-pereira · 2025-12-29T17:19:44Z

Summary by cubic

Initial Grain MCP implementation to browse and fetch Grain meeting recordings via MCP. Adds list/search and per-recording detail tools with API-key auth, plus automatic webhooks and database indexing.

New Features
- MCP server with Grain API client, types, and two tools: LIST_RECORDINGS and GET_RECORDING.
- Listing supports limit/offset, date range, status, and search; returns titles, owners, duration, summaries, transcript URLs, notes, and cursor.
- GET returns detailed recording info including summary points, transcript segments, highlights, and asset URLs.
- Automatic webhook setup; incoming recording events are indexed into Postgres via the DATABASE binding.
- HTTP app connection (app.json) with DATABASE binding.
Migration
- Use a Grain API key as Authorization: Bearer when connecting.
- Webhooks are auto-created; ensure the DATABASE binding is available in production.
- Install and run: bun install; bun run dev. Publish/register via app.json if needed.

^{Written for commit ff00cee. Summary will update on new commits.}

github-actions · 2025-12-29T17:20:22Z

🚀 Preview Deployments Ready!

Your changes have been deployed to preview environments:

📦 `grain`

🔗 View Preview

These previews will be automatically updated with new commits to this PR.

_{Deployed from commit: 65d786c}

cubic-dev-ai

1 issue found across 16 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="grain/test-api.ts">

<violation number="1" location="grain/test-api.ts:9">
P0: **Critical Security Issue**: Hardcoded API key committed to repository. This secret is now exposed in git history and should be immediately revoked. Use the commented-out environment variable approach instead (`process.env.GRAIN_API_KEY`).</violation>
</file>

_{Reply to cubic to teach it or ask questions. Tag @cubic-dev-ai to re-run a review.}

grain/test-api.ts

cubic-dev-ai

2 issues found across 11 files (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="grain/server/lib/grain-client.ts">

<violation number="1" location="grain/server/lib/grain-client.ts:174">
P2: The new webhook methods duplicate fetch and error-handling logic instead of reusing the existing `get`/`post` helpers. Consider extending the helpers to accept an `includeApiVersion` parameter rather than bypassing them, which would improve maintainability.</violation>
</file>

<file name="grain/server/lib/postgres.ts">

<violation number="1" location="grain/server/lib/postgres.ts:28">
P1: Manual SQL escaping is problematic here. If `DATABASES_RUN_SQL` uses proper parameterized queries (which its API signature suggests), this escaping is unnecessary and could cause double-escaping issues. If it doesn&#39;t parameterize properly, this escaping is incomplete and gives a false sense of security.

Remove the manual sanitization and rely on the database binding&#39;s parameterization, or verify how `DATABASES_RUN_SQL` handles parameters.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

grain/server/lib/grain-client.ts

grain/server/lib/postgres.ts

cubic-dev-ai

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="grain/server/lib/postgres.ts">

<violation number="1" location="grain/server/lib/postgres.ts:29">
P1: Missing null check on `response` after optional chaining. If `MESH_REQUEST_CONTEXT` or `state` is undefined, `response` will be `undefined`, and accessing `response.result` will throw a runtime error. Either add a null check or throw a meaningful error if the database binding is unavailable.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

grain/server/lib/postgres.ts

cubic-dev-ai

2 issues found across 3 files (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="grain/server/main.ts">

<violation number="1" location="grain/server/main.ts:63">
P2: Error handling wraps entire loop - one failing event prevents processing of all subsequent events. Consider moving try-catch inside the loop to handle each event independently and continue processing.</violation>
</file>

<file name="grain/app.json">

<violation number="1" location="grain/app.json:10">
P0: Removing the `DATABASE` binding will break webhook-based recording indexing. The server code (`server/main.ts` and `server/lib/postgres.ts`) still expects this binding to access `@deco/postgres` for indexing recordings. Either restore the binding or remove the database-dependent code.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

grain/app.json

cubic-dev-ai · 2026-01-06T16:53:33Z

grain/server/main.ts

+        try {
+          console.log("[GRAIN_MCP] Handling events:", events.length);
+
+          for (const event of events) {


P2: Error handling wraps entire loop - one failing event prevents processing of all subsequent events. Consider moving try-catch inside the loop to handle each event independently and continue processing.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At grain/server/main.ts, line 63: <comment>Error handling wraps entire loop - one failing event prevents processing of all subsequent events. Consider moving try-catch inside the loop to handle each event independently and continue processing.</comment> <file context> @@ -46,7 +47,46 @@ export interface Registry extends BindingRegistry { + try { + console.log("[GRAIN_MCP] Handling events:", events.length); + + for (const event of events) { + console.log("[GRAIN_MCP] Processing event:", { + type: event.type, </file context>

mcandeia · 2026-01-07T14:14:34Z

grain/server/main.ts

+
+        const grainClient = new GrainClient({ apiKey: grainToken });
+
+        const webhookUrl = `${meshUrl}/events/grain_recording?sub=${connectionId}`;


Suggested change

const webhookUrl = `${meshUrl}/events/grain_recording?sub=${connectionId}`;

const orgId = env.MESH_REQUEST_CONTEXT?.organizationId;

const webhookUrl = `${meshUrl}/org/${orgId}/events/grain_recording?sub=${connectionId}`;

mcandeia · 2026-01-07T14:14:52Z

grain/server/main.ts

+/**
+ * Event names that this MCP handles
+ */
+export const GRAIN_EVENTS = ["grain_recording"];


Suggested change

export const GRAIN_EVENTS = ["grain_recording"];

export const GRAIN_EVENTS = ["public:grain_recording"];

cubic-dev-ai bot reviewed Dec 29, 2025

View reviewed changes

grain/test-api.ts Outdated Show resolved Hide resolved

cubic-dev-ai bot reviewed Jan 2, 2026

View reviewed changes

grain/server/lib/grain-client.ts Show resolved Hide resolved

grain/server/lib/postgres.ts Outdated Show resolved Hide resolved

aline-pereira added 2 commits January 5, 2026 15:24

feat: added grain mcp initial implementation

0ab23a6

added webhook and indexing

193dbe6

aline-pereira force-pushed the feat/grain-mcp branch from 8c55c2b to 193dbe6 Compare January 5, 2026 18:25

updated database env

08a7b2c

cubic-dev-ai bot reviewed Jan 5, 2026

View reviewed changes

grain/server/lib/postgres.ts Outdated Show resolved Hide resolved

added event to runtime

4ce7fb6

cubic-dev-ai bot reviewed Jan 6, 2026

View reviewed changes

initial refactor

ff00cee

mcandeia requested changes Jan 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: added grain mcp initial implementation #71

feat: added grain mcp initial implementation #71

Uh oh!

aline-pereira commented Dec 29, 2025 •

edited by cubic-dev-ai bot

Loading

Uh oh!

github-actions bot commented Dec 29, 2025 •

edited

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai bot Jan 6, 2026 •

edited

Loading

Uh oh!

mcandeia Jan 7, 2026

Uh oh!

mcandeia Jan 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		const grainClient = new GrainClient({ apiKey: grainToken });

		const webhookUrl = `${meshUrl}/events/grain_recording?sub=${connectionId}`;

	const webhookUrl = `${meshUrl}/events/grain_recording?sub=${connectionId}`;
	const orgId = env.MESH_REQUEST_CONTEXT?.organizationId;
	const webhookUrl = `${meshUrl}/org/${orgId}/events/grain_recording?sub=${connectionId}`;

	export const GRAIN_EVENTS = ["grain_recording"];
	export const GRAIN_EVENTS = ["public:grain_recording"];

feat: added grain mcp initial implementation #71

Are you sure you want to change the base?

feat: added grain mcp initial implementation #71

Uh oh!

Conversation

aline-pereira commented Dec 29, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

github-actions bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Preview Deployments Ready!

📦 grain

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcandeia Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

mcandeia Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aline-pereira commented Dec 29, 2025 •

edited by cubic-dev-ai bot

Loading

github-actions bot commented Dec 29, 2025 •

edited

Loading

📦 `grain`

cubic-dev-ai bot Jan 6, 2026 •

edited

Loading