feat(api): native MCP (Model Context Protocol) server - #41082
Merged
Conversation
Contributor
|
Looks like this PR is ready to merge! 🎉 |
🦋 Changeset detectedLatest commit: 265deb9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 16 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (13)
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (6)
📜 Recent review details⏰ Context from checks skipped due to timeout. (5)
|
| Layer / File(s) | Summary |
|---|---|
Configuration and administration apps/meteor/client/views/admin/aiCenter/*, apps/meteor/server/settings/ai.ts, apps/meteor/ee/server/startup/*, apps/meteor/server/api/v1/middlewares/cors.*, packages/i18n/src/locales/en.i18n.json, packages/rest-typings/src/v1/*, docs/features/mcp-server.md, .changeset/native-mcp-server.md |
Adds MCP settings, AI Center controls, the access-mcp permission, conditional CORS headers, REST schema descriptions, localization, documentation, and release metadata. |
REST tool catalog apps/meteor/ee/server/api/mcp/catalog.ts, apps/meteor/ee/server/api/mcp/catalog.spec.ts |
Generates cached curated and allow-listed extended tools. Normalizes schemas, expands request variants, applies descriptions, and enforces unique MCP tool names. |
MCP protocol and HTTP route apps/meteor/ee/server/api/mcp/transport.ts, apps/meteor/ee/server/api/mcp/server.ts, apps/meteor/ee/server/api/mcp/index.ts, packages/model-typings/src/models/IUsersModel.ts, packages/models/src/models/Users.ts, apps/meteor/ee/server/api/mcp/*spec.ts |
Adds origin and protocol validation, JSON-RPC request handling, tool listing and execution, route gating, batch processing, personal access token verification, and endpoint tests. |
Authenticated REST dispatch apps/meteor/ee/server/api/mcp/dispatch.ts, apps/meteor/ee/server/api/mcp/dispatch.spec.ts |
Dispatches authenticated loopback requests with method-specific arguments, forwarded client IP data, redirect rejection, timeout handling, and shared response-size limits. |
Estimated code review effort: 4 (Complex) | ~45 minutes
Sequence Diagram(s)
sequenceDiagram
participant MCPClient
participant MCPRoute
participant MCPServer
participant Catalog
participant RESTAPI
MCPClient->>MCPRoute: POST JSON-RPC request
MCPRoute->>MCPServer: Validate transport and authentication
MCPServer->>Catalog: List or resolve MCP tool
Catalog-->>MCPServer: Return tool definition
MCPServer->>RESTAPI: Dispatch authenticated REST request
RESTAPI-->>MCPServer: Return bounded response
MCPServer-->>MCPRoute: Build JSON-RPC response
MCPRoute-->>MCPClient: Return MCP response
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | ✅ Passed | The title clearly and concisely identifies the main change: adding a native MCP server to the API. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Create stacked PR
- Commit on current branch
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## develop #41082 +/- ##
===========================================
+ Coverage 68.68% 69.21% +0.52%
===========================================
Files 4166 4233 +67
Lines 159382 167281 +7899
Branches 28253 29809 +1556
===========================================
+ Hits 109479 115790 +6311
- Misses 44747 46332 +1585
- Partials 5156 5159 +3
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
rodrigok
force-pushed
the
feat/native-mcp-server
branch
from
June 25, 2026 22:39
c652468 to
1341d98
Compare
Expose the Rocket.Chat REST API to MCP-capable AI clients via a JSON-RPC 2.0 Streamable-HTTP endpoint, as enterprise (protected) code under `ee/`. - Mounted as a normal API route at `/api/v1/mcp` (`API.v1.addRoute`), so it reuses the whole REST middleware chain: PAT authentication, remote-address resolution, CORS, logging, metrics and the built-in per-route rate limiter. No new runtime dependency — the JSON-RPC layer is implemented directly. - Tool catalog is derived from the existing typed-route metadata (the same source as the OpenAPI doc): a minimal curated default set, plus an opt-in extended set (the catalog filtered by an allow-list) gated by `MCP_Expose_Extended_API`. The full API is never exposed. Routes whose schema is a oneOf/anyOf of sub-schemas are split into one tool per variant (e.g. `chat_postMessage_by_channel` / `_by_roomId`). - Auth reuses Personal Access Tokens (`X-User-Id`/`X-Auth-Token`); tool calls dispatch to the REST layer as the authenticated user (forwarding the real client IP), preserving permission checks and parameter validation. - Gated behind the `experimental-enterprise-features` license module — both the route (`license: [...]`) and the settings (`enterprise: true` + `modules`). - rest-typings: add field/endpoint descriptions to `chat.postMessage` and `users.info` request schemas, reused as MCP tool docs. Validation behaviour is unchanged (verified across the full input matrix). - Settings `MCP_Enabled` / `MCP_Expose_Extended_API` (off by default), flagged as an alpha feature. - Docs: `docs/features/mcp-server.md`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rodrigok
force-pushed
the
feat/native-mcp-server
branch
from
June 26, 2026 17:04
1341d98 to
328a8db
Compare
Add an `access-mcp` permission (granted to `admin` by default) and require it on the `/api/v1/mcp` route via `permissionsRequired`, so every MCP action is gated by it in addition to the existing `experimental-enterprise-features` license module and the `MCP_Enabled` setting. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
|
Can this be done in collaboration with https://github.com/RocketChat/MCPServerGenerator_GSoC2026 ? |
This was referenced Jun 29, 2026
Dnouv
marked this pull request as ready for review
August 10, 2026 15:07
coderabbitai
Bot
added
the
type: feature
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (4)
apps/meteor/ee/server/api/mcp/server.spec.ts (1)
106-124: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd coverage for the tool-call error paths.
handleRpcMessagereturnsisError: truein two cases: a dispatch result withok: false, and a thrown dispatch error mapped to aTool execution failed:text. Neither case is asserted. Add one test for a rejecteddispatchToolpromise and one for{ ok: false }.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/mcp/server.spec.ts` around lines 106 - 124, Extend the handleRpcMessage tests alongside the known-tool success case with two tests: mock dispatchTool to reject and assert the response contains isError: true with the “Tool execution failed:” text, then mock it to resolve with ok: false and assert the corresponding error response. Keep the authenticated-user arguments and JSON-RPC request shape consistent with the existing test.apps/meteor/ee/server/api/mcp/catalog.ts (1)
21-43: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winAlign the curated names with
toolNameFor.The curated set names a route
chat_postMessage, while the extended set names the same routepost_chat_postMessage. When an administrator toggles the extended catalog, every tool identity changes.server.tsadvertisescapabilities: { tools: { listChanged: false } }, so a connected client keeps calling the old names and receivesUnknown tool.Generate curated names with
toolNameForas well, or keep a stable alias for both catalogs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/mcp/catalog.ts` around lines 21 - 43, Update the curated catalog definitions in CURATED to use the same tool-name generation as the extended catalog, specifically toolNameFor, so shared routes retain identical identities when the catalog changes. Preserve the existing route paths, methods, and descriptions, and ensure clients can continue using the same names without relying on stale aliases.apps/meteor/ee/server/api/mcp/dispatch.ts (1)
83-91: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valueHarden the GET and DELETE query serialization.
JSON.stringify(undefined)returnsundefined, andURLSearchParams.appendthen writes the literal string"undefined". Array arguments are also encoded as a JSON string, which only matches routes that expect a JSON-encoded query value.Skip
undefinedvalues, and confirm that array-valued query parameters in the allow-listed routes accept JSON encoding.♻️ Proposed change to skip undefined values
const qs = new URLSearchParams(); for (const [key, value] of Object.entries(args ?? {})) { + if (value === undefined) { + continue; + } qs.append(key, typeof value === 'string' ? value : JSON.stringify(value)); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/mcp/dispatch.ts` around lines 83 - 91, Update the GET/DELETE query serialization in the dispatch logic to skip entries whose values are undefined before calling URLSearchParams.append, preventing the literal "undefined" from being sent. Review the allow-listed routes that consume array-valued query parameters and ensure they accept the existing JSON.stringify encoding; adjust serialization or route parsing only where necessary to preserve the expected array values.apps/meteor/ee/server/api/mcp/transport.ts (1)
17-21: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove implementation comments.
The changed MCP implementation adds comments where the coding guideline requires code without implementation comments. Keep this context in external documentation or express it through identifiers and structure.
apps/meteor/ee/server/api/mcp/transport.ts#L17-L21: Remove the transport implementation comment.apps/meteor/ee/server/api/mcp/server.ts#L9-L9: Remove the token forwarding comment.apps/meteor/ee/server/api/mcp/server.ts#L54-L54: Remove the tool-list comment.apps/meteor/ee/server/api/mcp/server.ts#L64-L67: Remove the handler behavior comment.apps/meteor/ee/server/api/mcp/server.ts#L89-L89: Remove the notification comment.apps/meteor/ee/server/api/mcp/index.ts#L52-L53: Remove the authentication forwarding comment.apps/meteor/ee/server/api/mcp/index.ts#L74-L74: Remove the notification comment.apps/meteor/ee/server/api/mcp/index.ts#L91-L91: Remove the transport comment.apps/meteor/ee/server/api/mcp/index.ts#L99-L111: Remove the route implementation comment.As per coding guidelines, “Avoid code comments in the implementation”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/mcp/transport.ts` around lines 17 - 21, Remove the implementation comments from the MCP code without changing behavior: delete the transport comment in apps/meteor/ee/server/api/mcp/transport.ts (lines 17-21); delete the token forwarding, tool-list, handler behavior, and notification comments in apps/meteor/ee/server/api/mcp/server.ts (lines 9, 54, 64-67, and 89); and delete the authentication forwarding, notification, transport, and route implementation comments in apps/meteor/ee/server/api/mcp/index.ts (lines 52-53, 74, 91, and 99-111).Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/meteor/ee/server/api/mcp/catalog.ts`:
- Around line 307-320: Update toolNameFor and toolsForRoute to generate unique
MCP tool names: reserve space for the `_by_<discriminator>` suffix before
truncating the base name, then deduplicate any remaining collisions across
routes and variants using the existing catalog-generation flow. Ensure
handleRpcMessage can resolve every generated tool by its name without changing
variant descriptions or schemas.
In `@apps/meteor/ee/server/api/mcp/dispatch.spec.ts`:
- Around line 10-15: Update the afterEach cleanup around originalPort so it
restores the environment accurately: assign process.env.PORT only when
originalPort was defined, and delete process.env.PORT when it was originally
unset. Keep jest.restoreAllMocks() unchanged.
In `@apps/meteor/ee/server/api/mcp/dispatch.ts`:
- Around line 65-94: Update dispatchTool’s loopback URL construction to prepend
__meteor_runtime_config__.ROOT_URL_PATH_PREFIX (falling back to an empty string)
between the base URL and tool.path, so requests honor deployments under a
runtime path prefix. Preserve the existing TCP port handling and query/body
construction.
In `@apps/meteor/ee/server/api/mcp/index.ts`:
- Around line 112-115: Update the mcp route registration around handleMcpPost
and handleMcpGet to enforce a route-level token type of personalAccessToken,
ensuring Meteor session tokens are rejected while valid PATs remain accepted.
Reuse the existing token-model configuration pattern used by other routes.
In `@docs/features/mcp-server.md`:
- Around line 128-134: Update the limitation bullet near the MCP server
lifecycle notes to accurately describe POST batching: state that each POST
produces one HTTP response and may contain either a single message or a batch.
Keep the surrounding SSE and lifecycle limitations unchanged.
- Around line 136-149: Update the “Key Files” table in the MCP server
documentation so every application path uses the same repository-root base as
the existing packages paths. Prefix all ee/... and server/... entries, including
the remaining application entries, with apps/meteor/; leave packages/... paths
unchanged.
In `@packages/rest-typings/src/v1/chat.ts`:
- Line 782: Update the descriptions for ChatPostMessage at
packages/rest-typings/src/v1/chat.ts lines 782-782 and 843-843 to state that
text is optional, while retaining roomId as the required field and allowing
attachment-only calls.
---
Nitpick comments:
In `@apps/meteor/ee/server/api/mcp/catalog.ts`:
- Around line 21-43: Update the curated catalog definitions in CURATED to use
the same tool-name generation as the extended catalog, specifically toolNameFor,
so shared routes retain identical identities when the catalog changes. Preserve
the existing route paths, methods, and descriptions, and ensure clients can
continue using the same names without relying on stale aliases.
In `@apps/meteor/ee/server/api/mcp/dispatch.ts`:
- Around line 83-91: Update the GET/DELETE query serialization in the dispatch
logic to skip entries whose values are undefined before calling
URLSearchParams.append, preventing the literal "undefined" from being sent.
Review the allow-listed routes that consume array-valued query parameters and
ensure they accept the existing JSON.stringify encoding; adjust serialization or
route parsing only where necessary to preserve the expected array values.
In `@apps/meteor/ee/server/api/mcp/server.spec.ts`:
- Around line 106-124: Extend the handleRpcMessage tests alongside the
known-tool success case with two tests: mock dispatchTool to reject and assert
the response contains isError: true with the “Tool execution failed:” text, then
mock it to resolve with ok: false and assert the corresponding error response.
Keep the authenticated-user arguments and JSON-RPC request shape consistent with
the existing test.
In `@apps/meteor/ee/server/api/mcp/transport.ts`:
- Around line 17-21: Remove the implementation comments from the MCP code
without changing behavior: delete the transport comment in
apps/meteor/ee/server/api/mcp/transport.ts (lines 17-21); delete the token
forwarding, tool-list, handler behavior, and notification comments in
apps/meteor/ee/server/api/mcp/server.ts (lines 9, 54, 64-67, and 89); and delete
the authentication forwarding, notification, transport, and route implementation
comments in apps/meteor/ee/server/api/mcp/index.ts (lines 52-53, 74, 91, and
99-111).
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a99b20bc-a615-4cc2-82e2-14e326fdc353
📒 Files selected for processing (22)
.changeset/native-mcp-server.mdapps/meteor/client/views/admin/aiCenter/AICenterOverview.tsxapps/meteor/client/views/admin/aiCenter/AICenterRoute.tsxapps/meteor/client/views/admin/aiCenter/AISettingsSection.tsxapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/jest.config.tsapps/meteor/server/settings/ai.tsdocs/features/mcp-server.mdpackages/i18n/src/locales/en.i18n.jsonpackages/rest-typings/src/v1/chat.tspackages/rest-typings/src/v1/users/UsersInfoParamsGet.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Hacktron Security Check
- GitHub Check: 📦 Build Packages
- GitHub Check: CodeQL-Build
- GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
apps/meteor/client/views/admin/aiCenter/AICenterRoute.tsxapps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/client/views/admin/aiCenter/AICenterOverview.tsxapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/jest.config.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/index.tspackages/rest-typings/src/v1/users/UsersInfoParamsGet.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/client/views/admin/aiCenter/AISettingsSection.tsxapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/server/settings/ai.tspackages/rest-typings/src/v1/chat.ts
apps/meteor/**
📄 CodeRabbit inference engine (CLAUDE.md)
The main Rocket.Chat Meteor application resides in
apps/meteor/; place its application code there rather than in other monorepo areas.
Files:
apps/meteor/client/views/admin/aiCenter/AICenterRoute.tsxapps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/client/views/admin/aiCenter/AICenterOverview.tsxapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/jest.config.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/client/views/admin/aiCenter/AISettingsSection.tsxapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/server/settings/ai.ts
**/*.spec.ts
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.spec.ts: Use descriptive test names that clearly communicate expected behavior in Playwright tests
Use.spec.tsextension for test files (e.g.,login.spec.ts)
Files:
apps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/server.spec.ts
packages/**
📄 CodeRabbit inference engine (CLAUDE.md)
Shared libraries belong in
packages/, while other services belong inapps/andee/.
Files:
packages/rest-typings/src/v1/users/UsersInfoParamsGet.tspackages/rest-typings/src/v1/chat.tspackages/i18n/src/locales/en.i18n.json
🧠 Learnings (12)
📚 Learning: 2026-03-27T14:52:56.865Z
Learnt from: dougfabris
Repo: RocketChat/Rocket.Chat PR: 39892
File: apps/meteor/client/views/room/contextualBar/Threads/Thread.tsx:150-155
Timestamp: 2026-03-27T14:52:56.865Z
Learning: In Rocket.Chat, there are two different `ModalBackdrop` components with different prop APIs. During review, confirm the import source: (1) `rocket.chat/fuselage` `ModalBackdrop` uses `ModalBackdropProps` based on `BoxProps` (so it supports `onClick` and other Box/DOM props) and does not have an `onDismiss` prop; (2) `rocket.chat/ui-client` `ModalBackdrop` uses a narrower props interface like `{ children?: ReactNode; onDismiss?: () => void }` and handles Escape keypress and outside mouse-up, and it does not forward arbitrary DOM props such as `onClick`. Flag mismatched props (e.g., `onDismiss` passed to the fuselage component or `onClick` passed to the ui-client component) and ensure the usage matches the correct component being imported.
Applied to files:
apps/meteor/client/views/admin/aiCenter/AICenterRoute.tsxapps/meteor/client/views/admin/aiCenter/AICenterOverview.tsxapps/meteor/client/views/admin/aiCenter/AISettingsSection.tsx
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
apps/meteor/client/views/admin/aiCenter/AICenterRoute.tsxapps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/client/views/admin/aiCenter/AICenterOverview.tsxapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/jest.config.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/index.tspackages/rest-typings/src/v1/users/UsersInfoParamsGet.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/client/views/admin/aiCenter/AISettingsSection.tsxapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/server/settings/ai.tspackages/rest-typings/src/v1/chat.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
apps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/jest.config.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/index.tspackages/rest-typings/src/v1/users/UsersInfoParamsGet.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/server/settings/ai.tspackages/rest-typings/src/v1/chat.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
apps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/jest.config.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/index.tspackages/rest-typings/src/v1/users/UsersInfoParamsGet.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/server/settings/ai.tspackages/rest-typings/src/v1/chat.ts
📚 Learning: 2026-07-31T00:32:03.839Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 41635
File: apps/meteor/ee/server/api/roles.ts:101-111
Timestamp: 2026-07-31T00:32:03.839Z
Learning: In Rocket.Chat's typed EE REST API routes that use apps/meteor/ee/server/api/v1/middlewares/license.ts, account for unavailable route-level license modules returning HTTP 400 with { success: false, error, errorType: 'error-action-not-allowed' }, not HTTP 403. Declare the existing 400 bad-request response schema for these routes.
Applied to files:
apps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/server.spec.ts
📚 Learning: 2026-07-31T02:44:35.111Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 41635
File: apps/meteor/ee/server/api/sessions.ts:114-138
Timestamp: 2026-07-31T02:44:35.111Z
Learning: In Rocket.Chat typed REST response schemas, accept the composition of a Typia-generated entity schema with an `allOf` branch requiring `success: true`: `allOf: [{ $ref: <entity schema> }, { properties: { success: { type: 'boolean', enum: [true] } }, required: ['success'] }]`. Do not flag this pattern when used for REST endpoints, provided TEST_MODE response validation passes, as demonstrated by the `IOAuthApps` and `IEmailInbox` endpoints.
Applied to files:
apps/meteor/ee/server/api/mcp/permissions.tsapps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/index.tsapps/meteor/ee/server/api/mcp/transport.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/ee/server/api/mcp/server.spec.ts
📚 Learning: 2026-02-24T19:22:48.358Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 38493
File: apps/meteor/tests/e2e/omnichannel/omnichannel-send-pdf-transcript.spec.ts:66-67
Timestamp: 2026-02-24T19:22:48.358Z
Learning: In Playwright end-to-end tests (e.g., under apps/meteor/tests/e2e/...), prefer locating elements by translated text (getByText) and ARIA roles (getByRole) over data-qa attributes. If translation values change, update the corresponding test locators accordingly. Never use data-qa locators. This guideline applies to all Playwright e2e test specs in the repository and helps keep tests robust to UI text changes and accessible semantics.
Applied to files:
apps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/server.spec.ts
📚 Learning: 2026-03-06T18:10:15.268Z
Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 39397
File: packages/gazzodown/src/code/CodeBlock.spec.tsx:47-68
Timestamp: 2026-03-06T18:10:15.268Z
Learning: In tests (especially those using testing-library/dom/jsdom) for Rocket.Chat components, the HTML <code> element has an implicit ARIA role of 'code'. Therefore, screen.getByRole('code') or screen.findByRole('code') will locate <code> elements even without a role attribute. Do not flag findByRole('code') as invalid in reviews; prefer using the implicit role instead of adding role="code" unless necessary for accessibility.
Applied to files:
apps/meteor/ee/server/api/mcp/transport.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/server.spec.ts
📚 Learning: 2026-03-16T21:50:37.589Z
Learnt from: amitb0ra
Repo: RocketChat/Rocket.Chat PR: 39676
File: .changeset/migrate-users-register-openapi.md:3-3
Timestamp: 2026-03-16T21:50:37.589Z
Learning: For changes related to OpenAPI migrations in Rocket.Chat/OpenAPI, when removing endpoint types and validators from rocket.chat/rest-typings (e.g., UserRegisterParamsPOST, /v1/users.register) document this as a minor changeset (not breaking) per RocketChat/Rocket.Chat-Open-API#150 Rule 7. Note that the endpoint type is re-exposed via a module augmentation .d.ts in the consuming package (e.g., packages/web-ui-registration/src/users-register.d.ts). In reviews, ensure the changeset clearly states: this is a non-breaking change, the major version should not be bumped, and the changeset reflects a minor version bump. Do not treat this as a breaking change during OpenAPI migrations.
Applied to files:
.changeset/native-mcp-server.md
📚 Learning: 2026-05-11T23:14:59.316Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40469
File: packages/rest-typings/src/v1/users.ts:337-337
Timestamp: 2026-05-11T23:14:59.316Z
Learning: In Rocket.Chat REST endpoint typings (e.g., packages/rest-typings/src/v1/users.ts and other rest-typings files), keep the established convention of deriving field types from the domain model (e.g., use IUser indexed access like IUser['statusExpiresAt']) rather than swapping individual fields to serialized primitives (like string) in an ad-hoc way. If a truly different “serialized” representation is needed, perform the refactor consistently across the codebase (not just a single endpoint/field) and ensure all related REST typings stay aligned with the shared serialization types.
Applied to files:
packages/rest-typings/src/v1/users/UsersInfoParamsGet.tspackages/rest-typings/src/v1/chat.ts
📚 Learning: 2026-08-05T22:02:59.828Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 41707
File: apps/meteor/server/hooks/messages/processThreads.ts:66-68
Timestamp: 2026-08-05T22:02:59.828Z
Learning: In Rocket.Chat Meteor server code, `callbacks.runAsync` returns its input item rather than the asynchronous callback promise. Callers of `afterReadMessages` must invoke `callbacks.runAsync` without awaiting it, keeping read-receipt I/O off the message-send path; this includes `apps/meteor/server/hooks/messages/processThreads.ts`.
Applied to files:
apps/meteor/server/settings/ai.ts
📚 Learning: 2026-08-10T13:36:55.243Z
Learnt from: abhinavkrin
Repo: RocketChat/Rocket.Chat PR: 41736
File: packages/i18n/src/locales/th-TH.i18n.json:398-398
Timestamp: 2026-08-10T13:36:55.243Z
Learning: During the coordinated i18n interpolation migration for `Channel_already_exist`, do not flag locale files that still use `%s` until the English base translation and all affected locales are converted together to `{{channelName}}`. Partial locale-only conversions fail the i18n `extra-placeholders` check; the coordinated conversion is owned by the related migration change.
Applied to files:
packages/i18n/src/locales/en.i18n.json
🔇 Additional comments (25)
apps/meteor/ee/server/api/mcp/catalog.ts (3)
188-224: LGTM!Also applies to: 237-304, 328-374
54-172: 🎯 Functional CorrectnessNo action needed.
The direct-message allow-list entries match real route names.
227-233: 🗄️ Data Integrity & IntegrationNo change needed for schema completeness or
$refexposure.Typed GET/DELETE routes advertise a single query parameter object, and the only
$reffound is inpackages/rest-typings/src/v1/me/meSuccessResponse.ts, which is a response schema, not an MCP input schema.> Likely an incorrect or invalid review comment.packages/rest-typings/src/v1/users/UsersInfoParamsGet.ts (1)
18-115: LGTM!apps/meteor/ee/server/api/mcp/catalog.spec.ts (1)
3-136: LGTM!apps/meteor/ee/server/api/mcp/dispatch.ts (1)
13-44: LGTM!Also applies to: 96-108
apps/meteor/ee/server/api/mcp/dispatch.spec.ts (1)
17-111: LGTM!apps/meteor/ee/server/api/mcp/server.spec.ts (1)
6-47: LGTM!Also applies to: 49-104, 126-137
packages/rest-typings/src/v1/chat.ts (1)
88-93: LGTM!Also applies to: 794-840, 855-892
apps/meteor/ee/server/api/mcp/transport.ts (1)
3-15: LGTM!Also applies to: 22-49
apps/meteor/ee/server/api/mcp/server.ts (1)
1-8: LGTM!Also applies to: 13-52, 55-63, 68-88, 90-134
apps/meteor/ee/server/api/mcp/transport.spec.ts (1)
1-56: LGTM!apps/meteor/ee/server/api/mcp/index.spec.ts (1)
1-126: LGTM!apps/meteor/jest.config.ts (1)
41-41: LGTM!apps/meteor/server/settings/ai.ts (1)
169-194: LGTM!apps/meteor/ee/server/api/mcp/permissions.ts (1)
1-8: LGTM!apps/meteor/client/views/admin/aiCenter/AICenterOverview.tsx (2)
18-20: LGTM!Also applies to: 29-37, 73-80
17-17: 🎯 Functional CorrectnessNo change needed.
AICenterOverviewruns inside the privileged admin settings context, souseSetting('MCP_Enabled', false)can read the non-public setting.apps/meteor/client/views/admin/aiCenter/AICenterRoute.tsx (1)
24-27: LGTM!apps/meteor/client/views/admin/aiCenter/AISettingsSection.tsx (1)
7-21: LGTM!packages/i18n/src/locales/en.i18n.json (1)
153-153: LGTM!Also applies to: 3548-3554, 6291-6292
apps/meteor/ee/server/api/index.ts (1)
11-11: LGTM!.changeset/native-mcp-server.md (1)
1-7: LGTM!docs/features/mcp-server.md (2)
1-115: LGTM!Also applies to: 124-127
117-123: 🎯 Functional CorrectnessNo change needed.
tools/listandtools/callwork without a precedinginitialize; pre-initialization discovery is supported by the implementation.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 22 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
apps/meteor/ee/server/api/mcp/catalog.ts (1)
350-350: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove implementation comments.
The function names and code already describe these operations.
apps/meteor/ee/server/api/mcp/catalog.ts#L350-L350: Remove thetoolsForRoutecomment.apps/meteor/ee/server/api/mcp/catalog.ts#L397-L397: Remove thegetCuratedToolscomment.As per coding guidelines: “Avoid code comments in the implementation.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/mcp/catalog.ts` at line 350, Remove the implementation comments above toolsForRoute and getCuratedTools in apps/meteor/ee/server/api/mcp/catalog.ts at lines 350-350 and 397-397; no code changes are needed for either function.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@apps/meteor/ee/server/api/mcp/catalog.ts`:
- Line 350: Remove the implementation comments above toolsForRoute and
getCuratedTools in apps/meteor/ee/server/api/mcp/catalog.ts at lines 350-350 and
397-397; no code changes are needed for either function.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 73530fb5-95e9-41d9-ad3f-06eb61793a56
📒 Files selected for processing (12)
apps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/ee/server/api/mcp/dispatch.spec.tsapps/meteor/ee/server/api/mcp/dispatch.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/server.tsapps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/server/api/v1/middlewares/cors.tsdocs/features/mcp-server.mdpackages/rest-typings/src/v1/chat.ts
🚧 Files skipped from review as they are similar to previous changes (5)
- docs/features/mcp-server.md
- packages/rest-typings/src/v1/chat.ts
- apps/meteor/ee/server/api/mcp/dispatch.ts
- apps/meteor/ee/server/api/mcp/dispatch.spec.ts
- apps/meteor/ee/server/api/mcp/server.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: 📦 Build Packages
- GitHub Check: cubic · AI code reviewer
- GitHub Check: CodeQL-Build
- GitHub Check: Hacktron Security Check
- GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/server/api/v1/middlewares/cors.ts
**/*.spec.ts
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.spec.ts: Use descriptive test names that clearly communicate expected behavior in Playwright tests
Use.spec.tsextension for test files (e.g.,login.spec.ts)
Files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.ts
apps/meteor/**
📄 CodeRabbit inference engine (CLAUDE.md)
The main Rocket.Chat Meteor application resides in
apps/meteor/; place its application code there rather than in other monorepo areas.
Files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/server/api/v1/middlewares/cors.ts
🧠 Learnings (8)
📚 Learning: 2026-02-24T19:22:48.358Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 38493
File: apps/meteor/tests/e2e/omnichannel/omnichannel-send-pdf-transcript.spec.ts:66-67
Timestamp: 2026-02-24T19:22:48.358Z
Learning: In Playwright end-to-end tests (e.g., under apps/meteor/tests/e2e/...), prefer locating elements by translated text (getByText) and ARIA roles (getByRole) over data-qa attributes. If translation values change, update the corresponding test locators accordingly. Never use data-qa locators. This guideline applies to all Playwright e2e test specs in the repository and helps keep tests robust to UI text changes and accessible semantics.
Applied to files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/server/api/v1/middlewares/cors.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/server/api/v1/middlewares/cors.ts
📚 Learning: 2026-03-06T18:10:15.268Z
Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 39397
File: packages/gazzodown/src/code/CodeBlock.spec.tsx:47-68
Timestamp: 2026-03-06T18:10:15.268Z
Learning: In tests (especially those using testing-library/dom/jsdom) for Rocket.Chat components, the HTML <code> element has an implicit ARIA role of 'code'. Therefore, screen.getByRole('code') or screen.findByRole('code') will locate <code> elements even without a role attribute. Do not flag findByRole('code') as invalid in reviews; prefer using the implicit role instead of adding role="code" unless necessary for accessibility.
Applied to files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/server/api/v1/middlewares/cors.ts
📚 Learning: 2026-07-31T02:44:35.111Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 41635
File: apps/meteor/ee/server/api/sessions.ts:114-138
Timestamp: 2026-07-31T02:44:35.111Z
Learning: In Rocket.Chat typed REST response schemas, accept the composition of a Typia-generated entity schema with an `allOf` branch requiring `success: true`: `allOf: [{ $ref: <entity schema> }, { properties: { success: { type: 'boolean', enum: [true] } }, required: ['success'] }]`. Do not flag this pattern when used for REST endpoints, provided TEST_MODE response validation passes, as demonstrated by the `IOAuthApps` and `IEmailInbox` endpoints.
Applied to files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/catalog.tsapps/meteor/server/api/v1/middlewares/cors.ts
📚 Learning: 2026-08-05T22:02:59.828Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 41707
File: apps/meteor/server/hooks/messages/processThreads.ts:66-68
Timestamp: 2026-08-05T22:02:59.828Z
Learning: In Rocket.Chat Meteor server code, `callbacks.runAsync` returns its input item rather than the asynchronous callback promise. Callers of `afterReadMessages` must invoke `callbacks.runAsync` without awaiting it, keeping read-receipt I/O off the message-send path; this includes `apps/meteor/server/hooks/messages/processThreads.ts`.
Applied to files:
apps/meteor/server/api/v1/middlewares/cors.spec.tsapps/meteor/server/api/v1/middlewares/cors.ts
📚 Learning: 2026-07-31T00:32:03.839Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 41635
File: apps/meteor/ee/server/api/roles.ts:101-111
Timestamp: 2026-07-31T00:32:03.839Z
Learning: In Rocket.Chat's typed EE REST API routes that use apps/meteor/ee/server/api/v1/middlewares/license.ts, account for unavailable route-level license modules returning HTTP 400 with { success: false, error, errorType: 'error-action-not-allowed' }, not HTTP 403. Declare the existing 400 bad-request response schema for these routes.
Applied to files:
apps/meteor/ee/server/api/mcp/server.spec.tsapps/meteor/ee/server/api/mcp/index.tsapps/meteor/ee/server/api/mcp/catalog.spec.tsapps/meteor/ee/server/api/mcp/index.spec.tsapps/meteor/ee/server/api/mcp/catalog.ts
🔇 Additional comments (7)
apps/meteor/server/api/v1/middlewares/cors.ts (1)
7-8: LGTM!apps/meteor/server/api/v1/middlewares/cors.spec.ts (1)
141-153: LGTM!Also applies to: 196-208
apps/meteor/ee/server/api/mcp/catalog.ts (1)
1-1: LGTM!Also applies to: 238-238, 309-347, 351-358, 363-363, 372-395, 398-407
apps/meteor/ee/server/api/mcp/catalog.spec.ts (1)
70-92: LGTM!Also applies to: 133-154
apps/meteor/ee/server/api/mcp/index.ts (1)
2-2: LGTM!Also applies to: 18-50, 78-80, 102-102, 111-125
apps/meteor/ee/server/api/mcp/server.spec.ts (1)
41-45: LGTM!Also applies to: 67-67, 80-96, 144-158
apps/meteor/ee/server/api/mcp/index.spec.ts (1)
2-2: LGTM!Also applies to: 11-14, 30-30, 39-39, 54-54, 92-112, 134-140
ricardogarim
approved these changes
Aug 17, 2026
tassoevan
approved these changes
Aug 17, 2026
scuciatto
added
the
stat: QA assured
dionisio-bot
Bot
added
the
stat: ready to merge
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 18, 2026
dionisio-bot
Bot
added
stat: ready to merge
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 18, 2026
dionisio-bot
Bot
added
stat: ready to merge
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 18, 2026
dionisio-bot
Bot
added
stat: ready to merge
rodrigok
added a commit
that referenced
this pull request
Aug 18, 2026
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Dnouv <evan.shu.dev@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Adds a native Model Context Protocol server that lets MCP-capable clients use a bounded set of Rocket.Chat REST operations over JSON-RPC 2.0 and Streamable HTTP.
The implementation is enterprise code under
apps/meteor/ee/server/api/mcpand intentionally reuses Rocket.Chat's existing REST route metadata, authentication, permission checks, validation, rate limiting, and audit behavior. It adds no runtime dependency and does not expose the full REST API.How it works
POST /api/v1/mcpas an authenticated API route.GETreturns405 Allow: POSTbecause this stateless implementation does not expose an SSE stream.initialize,ping,tools/list,tools/call, and JSON-RPC notifications and batches.Originvalues against the workspace origin or explicitly configured CORS origins to protect the local HTTP transport from DNS rebinding. Native clients without anOriginheader remain supported.MCP-Protocol-Versionvalues while retaining compatibility with clients that omit the header.Access control
The endpoint requires all of the following:
X-User-IdandX-Auth-Token; regular session tokens are rejected.chat.rocket.rc-ai).access-mcppermission, granted toadminby default.MCP_Enabledsetting, which is off by default.Administration
MCP is configured from Administration → AI Center → MCP.
/api/v1/mcp.The feature is labeled alpha and remains disabled by default. Its capabilities and configuration may evolve as feedback is collected.
Testing
Documentation
See
docs/features/mcp-server.mdfor client configuration, security behavior, tool catalogs, protocol details, and troubleshooting.Manual smoke test
Summary by CodeRabbit