Repository navigation
Add a fixed public MCP tool profile for FTW - #40
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The private MCP connection exposes API discovery and a general API reader. OpenAI's public directory requires each operation to appear as a separate reviewed tool. Add
/mcp?profile=publicwith 14 named operations for energy, planning, health and owner-approved actions. The profile rejects unlisted calls as well as hiding them, and its instructions describe only the tools it provides.The profile uses the same OAuth resource, owner grants, request limits and Noise sessions. Its initial challenge requests only live, plan, history and health reads. The base connection keeps its existing tools. New production Go code: 79 net lines, including the hooks in
mcp.go; tests and docs are separate.Validation:
go vet ./...,go test -race ./...,go test -tags ftwclouddev ./..., andbash scripts/check-imports.shpassed. After narrowing the public challenge and rejecting malformed queries,go vet ./internal/mcpandgo test -race ./internal/mcp -count=1passed. TLS/OAuth tests use a simulated box and cover both MCP protocol families, direct calls to excluded tools, missing grants, no token, invalid profile choices, annotations and the unchanged private listing.Website policy pages and the submission source are paired work. This draft does not deploy the profile or establish public approval. A dedicated reviewer home, real host OAuth connection, recording and portal scan remain required. PR #39 has right of way in
mcp.go; this change leaves its scope-upgrade logic untouched and should follow it if both are merged.Paired PR: srcfl/ftw-web#25