feat(pilot): add Pilot MCP - workflow-based AI agent #80
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Restaura arquivos de integração com Supabase que foram perdidos: - registry/server/lib/supabase-client.ts - Cliente Supabase com CRUD - registry/scripts/create-table.sql - Script DDL da tabela mcp_servers - registry/scripts/populate-supabase.ts - Script de sincronização com Registry API Estes arquivos são necessários para a funcionalidade do registry com Supabase.
Atualiza o registry completo com implementação baseada em Supabase: Changes: - package.json: adiciona @supabase/supabase-js e scripts de sync - main.ts: remove registryUrl do StateSchema (usa env vars) - registry-binding.ts: simplifica drasticamente (-365/+159 linhas) - Usa Supabase client diretamente ao invés da API do Registry - Remove lógica complexa de fallback e cache - Mantém apenas allowlist e blacklist Migração completa de API fetch → Supabase queries para melhor performance.
Code review fixes: - Remove unused 'version' parameter from ListInputSchema - Add is_latest filter to stats fallback queries - Add sanitization for search input to prevent PostgREST injection - Fix RLS policy to hide unlisted items from public access Translations: - Translate all comments and strings from PT-BR to English - Update scripts: enrich-with-ai.ts, populate-supabase.ts - Update server files: supabase-client.ts, registry-binding.ts - Keep code consistent and professional in English
- Add escape for underscore (_) character in sanitizeSearchInput - Underscore is a single-char wildcard in SQL LIKE/ILIKE - Without escaping, users could inject wildcard patterns - Example: 'ai_exa' would match 'ai.exa', 'ai-exa', 'ai exa', etc.
🚨 CRITICAL SECURITY FIX 🚨 - Remove hardcoded OPENROUTER_API_KEY from source code - Use process.env.OPENROUTER_API_KEY instead - Add validation to check for missing API key at startup - Pass API key as parameter through function calls⚠️ ACTION REQUIRED: The exposed API key (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) must be IMMEDIATELY REVOKED at OpenRouter dashboard and a new key generated. The old key is now exposed in git history and should be considered compromised.
- Add .env to .gitignore to prevent accidental commits - Create ENV_SETUP.md with instructions for environment setup - Create .env template file (not tracked by git)
- Update COLLECTION_REGISTRY_APP_GET docs to reflect actual behavior - GET always returns LATEST version (is_latest: true) - Version suffix in 'name@version' is accepted but IGNORED - Remove misleading reference to GET supporting specific versions - Clarify that COLLECTION_REGISTRY_APP_VERSIONS should be used for version queries The implementation was correct, only the documentation was inaccurate.
Feat/registry updates from main
- Add 'tags' parameter to filter by tags (ANY match) - Add 'categories' parameter to filter by categories (ANY match) - Add 'verified' parameter to filter by verification status - Add 'hasRemote' parameter to filter servers with remote support - Update tool description to reflect new filtering capabilities - Backend support already existed, now exposed via API Valid categories: productivity, development, data, ai, communication, infrastructure, security, monitoring, analytics, automation Examples: - tags: ['search', 'api'] → returns servers with 'search' OR 'api' tag - categories: ['ai', 'development'] → returns AI or development servers
…ories
- Add COLLECTION_REGISTRY_APP_FILTERS tool
- Returns all available tags and categories with usage counts
- Sorted by count (most used first)
- Shows how many servers use each filter value
- Helps users discover what filters they can use
Example response:
{
tags: [
{ value: 'search', count: 45 },
{ value: 'api', count: 32 },
...
],
categories: [
{ value: 'development', count: 120 },
{ value: 'ai', count: 89 },
...
]
}
Feat/registry updates from main
fix rogue y
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
4 issues found across 11 files (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="pilot/server/main.ts">
<violation number="1" location="pilot/server/main.ts:290">
P1: Using `console.log` in an STDIO-based MCP server will corrupt the MCP protocol stream. The stdout channel is reserved for JSON-RPC communication. All logging must go to stderr via `console.error`, which is the pattern used consistently throughout this file.</violation>
</file>
<file name="pilot/server/core/workflow-executor.ts">
<violation number="1" location="pilot/server/core/workflow-executor.ts:977">
P1: The `publishEvent` call in the catch block can throw an unhandled promise rejection. Consider wrapping it in a try-catch to prevent silent failures when notifying about task failures.</violation>
<violation number="2" location="pilot/server/core/workflow-executor.ts:1340">
P2: The `wrappedOnProgress` callback doesn't return the result of the original callback. Since `await ctx.onProgress?.()` is used elsewhere, consider returning the original callback's result to maintain async behavior.</violation>
</file>
<file name="pilot/workflows/execute-multi-step.json">
<violation number="1" location="pilot/workflows/execute-multi-step.json:37">
P2: The description says this step skips if no task is provided, but `skipIf` actually checks for empty tools (`toolsForSmartAgent`), not the task. This mismatch could cause the step to run with an empty prompt if tools are provided but no task is set. Consider checking the task instead, or updating the description to match the actual behavior.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
pilot/server/main.ts
Outdated
| } | ||
|
|
||
| // Debug logging for LLM calls | ||
| console.log( |
There was a problem hiding this comment.
P1: Using console.log in an STDIO-based MCP server will corrupt the MCP protocol stream. The stdout channel is reserved for JSON-RPC communication. All logging must go to stderr via console.error, which is the pattern used consistently throughout this file.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pilot/server/main.ts, line 290:
<comment>Using `console.log` in an STDIO-based MCP server will corrupt the MCP protocol stream. The stdout channel is reserved for JSON-RPC communication. All logging must go to stderr via `console.error`, which is the pattern used consistently throughout this file.</comment>
<file context>
@@ -254,6 +286,17 @@ const callLLM: LLMCallback = async (model, messages, tools) => {
}
+ // Debug logging for LLM calls
+ console.log(
+ `[pilot] [callLLM] Model: ${model}, Messages: ${messages.length}, Tools: ${tools.length}`,
+ );
</file context>
Suggested change
| console.log( | |
| console.error( |
✅ Addressed in b01da0a
| `[pilot] Progress persisted: ${stepName} → ${message.slice(0, 50)}... (saved: ${!!saved})`, | ||
| ); | ||
| // Call the original callback for event publishing | ||
| options.config.onProgress!(taskId, stepName, message); |
There was a problem hiding this comment.
P2: The wrappedOnProgress callback doesn't return the result of the original callback. Since await ctx.onProgress?.() is used elsewhere, consider returning the original callback's result to maintain async behavior.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pilot/server/core/workflow-executor.ts, line 1340:
<comment>The `wrappedOnProgress` callback doesn't return the result of the original callback. Since `await ctx.onProgress?.()` is used elsewhere, consider returning the original callback's result to maintain async behavior.</comment>
<file context>
@@ -999,35 +1310,48 @@ export async function executeWorkflow(
+ `[pilot] Progress persisted: ${stepName} → ${message.slice(0, 50)}... (saved: ${!!saved})`,
+ );
+ // Call the original callback for event publishing
+ options.config.onProgress!(taskId, stepName, message);
+ }
+ : undefined;
</file context>
✅ Addressed in b01da0a
| `[pilot] [start_task] Publishing completion event for ${newTask.taskId}`, | ||
| ); | ||
|
|
||
| await ctx.publishEvent("agent.task.completed", { |
There was a problem hiding this comment.
P1: The publishEvent call in the catch block can throw an unhandled promise rejection. Consider wrapping it in a try-catch to prevent silent failures when notifying about task failures.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pilot/server/core/workflow-executor.ts, line 977:
<comment>The `publishEvent` call in the catch block can throw an unhandled promise rejection. Consider wrapping it in a try-catch to prevent silent failures when notifying about task failures.</comment>
<file context>
@@ -761,12 +884,198 @@ async function executeToolCall(
+ `[pilot] [start_task] Publishing completion event for ${newTask.taskId}`,
+ );
+
+ await ctx.publishEvent("agent.task.completed", {
+ taskId: newTask.taskId,
+ workflowId,
</file context>
✅ Addressed in b01da0a
| "tools": "@plan.toolsForSmartAgent" | ||
| }, | ||
| "config": { | ||
| "skipIf": "empty:@plan.toolsForSmartAgent" |
There was a problem hiding this comment.
P2: The description says this step skips if no task is provided, but skipIf actually checks for empty tools (toolsForSmartAgent), not the task. This mismatch could cause the step to run with an empty prompt if tools are provided but no task is set. Consider checking the task instead, or updating the description to match the actual behavior.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pilot/workflows/execute-multi-step.json, line 37:
<comment>The description says this step skips if no task is provided, but `skipIf` actually checks for empty tools (`toolsForSmartAgent`), not the task. This mismatch could cause the step to run with an empty prompt if tools are provided but no task is set. Consider checking the task instead, or updating the description to match the actual behavior.</comment>
<file context>
@@ -0,0 +1,41 @@
+ "tools": "@plan.toolsForSmartAgent"
+ },
+ "config": {
+ "skipIf": "empty:@plan.toolsForSmartAgent"
+ }
+ }
</file context>
- Add calendar management tools (list, get, create, delete) - Add event management tools (list, get, create, update, delete, quick_add) - Add availability tool (get_freebusy) - Add advanced tools (move_event, find_available_slots, duplicate_event) - Implement OAuth 2.0 with PKCE for Google authentication - Add Google Calendar API client with full TypeScript types - Add google-calendar to monorepo workspaces Total: 14 tools for complete calendar management
Google OAuth doesn't allow 'state' inside redirect_uri. Extract state from callbackUrl and pass it as separate OAuth param.
- Add CalendarAccessRole type for better type safety - Fix redirect_uri handling in exchangeCode - Fix getAccessToken type compatibility with Env
Tools need to receive the env parameter to access the authenticated user's access token.
- Add shared/deco.gen.ts with typed Env and MeshRequestContext - Add server/lib/env.ts with getGoogleAccessToken helper - Update main.ts to use typed Env from shared/deco.gen.ts - Update google-client.ts to use env.ts helper - Fix all numeric schema fields to use z.coerce.number() for string-to-number conversion
When only newStart is provided without newEnd, calculate the new end time by preserving the original event's duration instead of using the original end time directly, which could create invalid events.
feat: add Google Calendar MCP with OAuth 2.0 support
Signed-off-by: Marcos Candeia <marrcooos@gmail.com>
fix openrouter binding
- Bump @decocms/bindings to version 1.0.5. - Update zod to version 4.0.0 across multiple packages. - Refactor LLM binding to utilize existing input and output schemas for better structure. - Initialize prompts array in runtime configuration.
- Update `getExecution` to return an object that includes `workflow_id`. - Introduce `getExecutionWorkflow` to fetch workflow details by ID. - Modify `createGetTool` to include workflow data in the execution response. - Refactor `transformDbRowToWorkflow` to `transformDbRowToWorkflowCollectionItem` for clarity and consistency. - Ensure proper error handling for missing workflow and collection IDs.
…nsformation - Bump @decocms/bindings in both bun.lock and package.json. - Introduce new functions to transform AI SDK content and generate results into binding schema format in llm-binding.ts. - Improve handling of various content types and legacy properties in the transformation process.
There was a problem hiding this comment.
4 issues found across 11 files (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="pilot/cli/mesh-client.ts">
<violation number="1" location="pilot/cli/mesh-client.ts:248">
P1: Memory leak: `setInterval` is created without storing its ID, so it cannot be cleared when `close()` is called. Store the interval ID and clear it in `close()`.</violation>
</file>
<file name="pilot/README.md">
<violation number="1" location="pilot/README.md:99">
P3: Duplicate section number: After inserting section 2, this becomes section 3, but the existing "Configure Bindings" section below also has "### 3." The subsequent sections (Configure Bindings → 4, Test → 5) need to be renumbered as well.</violation>
</file>
<file name="openrouter/server/stdio.ts">
<violation number="1" location="openrouter/server/stdio.ts:156">
P2: The `where` and `orderBy` parameters are defined in the schema but never used in the handler. This is misleading - consumers may expect filtering to work when it doesn't. Either implement filtering or remove these unused parameters.</violation>
</file>
<file name="pilot/cli/index.ts">
<violation number="1" location="pilot/cli/index.ts:223">
P2: The `/new` command prints "Starting new conversation thread..." but doesn't actually do anything (per the TODO comment). This misleads users into thinking their thread was reset. Either implement the functionality or show a "not implemented" message.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
pilot/cli/mesh-client.ts
Outdated
| }; | ||
|
|
||
| // Poll every 500ms | ||
| setInterval(poll, 500); |
There was a problem hiding this comment.
P1: Memory leak: setInterval is created without storing its ID, so it cannot be cleared when close() is called. Store the interval ID and clear it in close().
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pilot/cli/mesh-client.ts, line 248:
<comment>Memory leak: `setInterval` is created without storing its ID, so it cannot be cleared when `close()` is called. Store the interval ID and clear it in `close()`.</comment>
<file context>
@@ -0,0 +1,369 @@
+ };
+
+ // Poll every 500ms
+ setInterval(poll, 500);
+ }
+
</file context>
✅ Addressed in 74fd2a7
| "COLLECTION_LLM_LIST", | ||
| "List all available models from OpenRouter with filtering and pagination", | ||
| { | ||
| where: z.any().optional().describe("Filter expression"), |
There was a problem hiding this comment.
P2: The where and orderBy parameters are defined in the schema but never used in the handler. This is misleading - consumers may expect filtering to work when it doesn't. Either implement filtering or remove these unused parameters.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At openrouter/server/stdio.ts, line 156:
<comment>The `where` and `orderBy` parameters are defined in the schema but never used in the handler. This is misleading - consumers may expect filtering to work when it doesn't. Either implement filtering or remove these unused parameters.</comment>
<file context>
@@ -0,0 +1,302 @@
+ "COLLECTION_LLM_LIST",
+ "List all available models from OpenRouter with filtering and pagination",
+ {
+ where: z.any().optional().describe("Filter expression"),
+ orderBy: z.any().optional().describe("Sort order"),
+ limit: z.number().optional().default(50).describe("Max results"),
</file context>
pilot/cli/index.ts
Outdated
| break; | ||
| case "new": | ||
| case "n": | ||
| console.log( |
There was a problem hiding this comment.
P2: The /new command prints "Starting new conversation thread..." but doesn't actually do anything (per the TODO comment). This misleads users into thinking their thread was reset. Either implement the functionality or show a "not implemented" message.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pilot/cli/index.ts, line 223:
<comment>The `/new` command prints "Starting new conversation thread..." but doesn't actually do anything (per the TODO comment). This misleads users into thinking their thread was reset. Either implement the functionality or show a "not implemented" message.</comment>
<file context>
@@ -0,0 +1,309 @@
+ break;
+ case "new":
+ case "n":
+ console.log(
+ `${c.system}Starting new conversation thread...${c.reset}`,
+ );
</file context>
✅ Addressed in 74fd2a7
pilot/README.md
Outdated
| /quit - Exit | ||
| ``` | ||
|
|
||
| ### 3. Add to Mesh |
There was a problem hiding this comment.
P3: Duplicate section number: After inserting section 2, this becomes section 3, but the existing "Configure Bindings" section below also has "### 3." The subsequent sections (Configure Bindings → 4, Test → 5) need to be renumbered as well.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pilot/README.md, line 99:
<comment>Duplicate section number: After inserting section 2, this becomes section 3, but the existing "Configure Bindings" section below also has "### 3." The subsequent sections (Configure Bindings → 4, Test → 5) need to be renumbered as well.</comment>
<file context>
@@ -69,7 +69,34 @@ cp env.example .env
+ /quit - Exit
+```
+
+### 3. Add to Mesh
In MCP Mesh, add Pilot as a **Custom Command** connection:
</file context>
✅ Addressed in 74fd2a7
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="openrouter/server/stdio.ts">
<violation number="1" location="openrouter/server/stdio.ts:301">
P2: Code duplication: `LLM_DO_STREAM` implementation is identical to `LLM_DO_GENERATE`. Consider extracting the shared logic into a helper function to avoid maintenance burden and potential bugs from inconsistent updates.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| .optional() | ||
| .describe("Language model call options (prompt, messages, etc.)"), | ||
| }, | ||
| async ({ modelId, callOptions: rawCallOptions }) => { |
There was a problem hiding this comment.
P2: Code duplication: LLM_DO_STREAM implementation is identical to LLM_DO_GENERATE. Consider extracting the shared logic into a helper function to avoid maintenance burden and potential bugs from inconsistent updates.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At openrouter/server/stdio.ts, line 301:
<comment>Code duplication: `LLM_DO_STREAM` implementation is identical to `LLM_DO_GENERATE`. Consider extracting the shared logic into a helper function to avoid maintenance burden and potential bugs from inconsistent updates.</comment>
<file context>
@@ -284,6 +285,127 @@ async function main() {
+ .optional()
+ .describe("Language model call options (prompt, messages, etc.)"),
+ },
+ async ({ modelId, callOptions: rawCallOptions }) => {
+ // In stdio mode, we can't truly stream, so we use doGenerate instead
+ const { abortSignal: _abortSignal, ...callOptions } =
</file context>
* Add Reddit MCP module with tools for subreddit interaction - Introduced a new `reddit` module, including package.json, README, and TypeScript configuration. - Implemented tools for fetching posts from subreddits and searching Reddit content. - Updated bun.lock and package.json to include new dependencies for the Reddit module. - Created server structure and types for handling API requests and responses. - Added comprehensive documentation in README for usage and development instructions. * Update input schemas to use z.coerce for limit validation in subreddit and search requests
fix llm streaming
* Add Supabase MCP Binding with database operations - Introduced a new Supabase MCP binding for generic database operations. - Added `app.json` to define the binding's configuration and tools including `db_select`, `db_insert`, `db_update`, `db_delete`, `db_upsert`, and `db_rpc`. - Created `package.json` for managing dependencies and scripts for development and deployment. - Included a comprehensive `README.md` detailing usage examples, configuration, and security considerations. - Configured TypeScript settings in `tsconfig.json` for the project. * Implement Supabase MCP with enhanced database operations - Added a new Supabase MCP for generic database operations, including tools for `db_select`, `db_insert`, `db_update`, `db_delete`, `db_upsert`, and `db_rpc`. - Updated `app.json` to reflect the new HTTP connection type and removed the previous state schema. - Enhanced `README.md` to clarify usage and configuration details. - Introduced TypeScript files for client creation, types, and database tools, ensuring robust type safety and functionality. - Updated dependencies in `package.json` and `bun.lock` to align with the new implementation. * Refactor Supabase MCP to export runtime directly - Removed the serve function import and replaced it with a default export of the runtime configuration. - This change streamlines the main server file for better clarity and usage. * Add wrangler configuration for Supabase MCP - Introduced a new `wrangler.toml` file to define the configuration for the Supabase MCP. - Set the main entry point, compatibility date, and integration details for database operations. - Configured workspace settings and disabled local workflows for streamlined deployment. * Refactor Supabase MCP with updated configuration and tools - Updated `app.json` to reflect the new official Supabase MCP name and enhanced description. - Added multiple database operation tools including `apply_migration`, `create_branch`, `delete_branch`, and others for comprehensive database management. - Removed obsolete `package.json`, `tsconfig.json`, and other related files to streamline the project structure. - Revised `README.md` to provide clearer information about the MCP's capabilities and usage. - Enhanced overall project organization for better maintainability and clarity. * Update Supabase MCP connection type in app.json - Changed connection type from HTTP to BINDING in `app.json` to align with the new configuration for the Supabase MCP. - This update reflects the transition towards a more integrated binding approach for database operations.
…ion handling - Bump @decocms/bindings in bun.lock and package.json. - Add completed steps tracking in the execution response. - Introduce new `getExecutionFull` function to retrieve execution details along with completed step IDs. - Refactor execution update logic to support conditional updates based on execution status. - Improve validation and error handling in workflow execution processes.
- Updated the execution response structure to destructure and exclude the workflow_id field, ensuring compliance with the output schema. - This change enhances the clarity of the execution data returned.
Pilot is an event-driven workflow executor that serves as the central AI brain for the MCP ecosystem. Key features: - Event-driven: Subscribes to user.message.received, publishes agent.response.* - Workflow-based: Declarative JSON workflows define execution patterns - Full mesh access: Uses all connected MCPs as tools - MCP Tasks protocol: Persistent task tracking and status - Conversation support: Long-running threads with memory Built-in workflows: - fast-router: Routes to direct response, tool call, or async workflow - conversation: Long-running conversation with history - direct-execution: Execute with all tools, no routing - execute-multi-step: Complex multi-step tasks MCP Tools: - WORKFLOW_START, MESSAGE, CONVERSATION_START/END - TASK_GET, TASK_RESULT, TASK_LIST, TASK_CANCEL - WORKFLOW_LIST, WORKFLOW_GET, WORKFLOW_CREATE - ON_EVENTS for mesh event subscription Works with mesh-bridge for WhatsApp, CLI, and other interfaces.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by cubic
Adds Pilot MCP, a workflow-based agent with a fast router that handles simple requests directly and spawns async workflows for complex tasks. Implements MCP Tasks for persistent state, Mesh event routing, shared thread history, and adds OpenRouter stdio support with safer LLM call options.
New Features
Migration
Written for commit b01da0a. Summary will update on new commits.