SANDBOX-1814: Implement MCP server setup and entry point - #21
Conversation
- Add pkg/server with MCP server construction, HTTP mux, session delete, health/live endpoints, loopback validation, and transport flag validation - Replace cmd/server stub with Cobra CLI, runServer bootstrap, signal handling (SIGTERM/SIGINT for both HTTP and stdio), and graceful shutdown - Add mcp-common, cobra, prometheus/client_golang dependencies - Validate session ID format on DELETE for defense-in-depth - Generic 500 on cleanup failure (no internal error leakage) - Add /server and /agent to .gitignore Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Feny Mehta <fbm3307@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
🚧 Files skipped from review as they are similar to previous changes (1)
📜 Recent review details🧰 Additional context used📓 Path-based instructions (1)**⚙️ CodeRabbit configuration file
Files:
🧬 Code graph analysis (1)pkg/session/manager.go (1)
🔀 Multi-repo context codeready-toolchain/mcp-server-devsandbox, codeready-toolchain/mcp-commonLinked repositories findingscodeready-toolchain/mcp-server-devsandbox
codeready-toolchain/mcp-common
🔇 Additional comments (3)
WalkthroughAdds a Cobra-based MCP server CLI with HTTP and stdio transports, Kubernetes-backed session management, health and lifecycle handling, server routes, validation helpers, tests, and dependency updates. ChangesMCP server runtime
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CLI
participant runServer
participant Kubernetes
participant SessionManager
participant MCPServer
participant HTTPServer
CLI->>runServer: Parse runtime configuration
runServer->>Kubernetes: Build clientset
runServer->>SessionManager: Create and configure manager
runServer->>MCPServer: Register Bash tool
runServer->>HTTPServer: Start MCP routes
HTTPServer->>Kubernetes: Check namespace health
Kubernetes-->>HTTPServer: Health result
HTTPServer-->>CLI: Serve until shutdown
runServer->>SessionManager: CleanupStale periodically
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/server/main.go`:
- Around line 88-115: Validate cfg.idleTimeout in runServer before constructing
or starting the session cleanup configuration, rejecting zero and negative
durations with a clear error. Preserve the existing configuration flow for
positive idle timeouts so CleanupStale cannot run with a non-positive interval.
- Around line 148-155: Set a narrow read-header timeout on the http.Server
constructed in the srv initialization, using the server’s ReadHeaderTimeout
field while leaving ReadTimeout unset to preserve MCP streamable HTTP behavior.
In `@pkg/server/server_test.go`:
- Line 50: Replace all seven httptest.NewRequest calls in the server tests with
httptest.NewRequestWithContext, passing context.Background() for each request
while preserving their existing methods, URLs, and bodies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 88ca783a-dbb8-41e6-999e-953ac40e3bc0
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
.gitignorecmd/server/main.gogo.modpkg/server/server.gopkg/server/server_test.go
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
codeready-toolchain/mcp-common(manual)codeready-toolchain/mcp-server-devsandbox(manual)codeready-toolchain/api(manual)codeready-toolchain/toolchain-common(manual)codeready-toolchain/host-operator(manual)codeready-toolchain/toolchain-e2e(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: build-test-coverage
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
pkg/server/server_test.gopkg/server/server.gocmd/server/main.gogo.mod
🧬 Code graph analysis (1)
cmd/server/main.go (4)
pkg/session/manager.go (3)
NewSessionManager(60-81)CleanupStale(521-564)StartPool(85-89)pkg/session/config.go (1)
DefaultConfig(25-39)pkg/version/version.go (2)
Commit(11-11)BuildTime(14-14)pkg/tools/bash.go (2)
NewBashTool(44-52)RegisterWith(55-57)
🪛 ast-grep (0.44.1)
cmd/server/main.go
[warning] 147-147: This http.Server is constructed without a ReadTimeout. Without a read timeout, a slow or malicious client can hold connections open indefinitely (e.g. a Slowloris attack), exhausting server resources and causing a denial of service. Set ReadTimeout (and ideally ReadHeaderTimeout, WriteTimeout, and IdleTimeout) on the http.Server to bound how long the server waits while reading a request.
Context: http.Server{Addr: address, Handler: mux}
Note: [CWE-400] Uncontrolled Resource Consumption.
(http-server-missing-read-timeout-go)
🪛 golangci-lint (2.12.2)
pkg/server/server_test.go
[error] 50-50: net/http/httptest.NewRequest must not be called. use net/http/httptest.NewRequestWithContext
(noctx)
[error] 68-68: net/http/httptest.NewRequest must not be called. use net/http/httptest.NewRequestWithContext
(noctx)
[error] 86-86: net/http/httptest.NewRequest must not be called. use net/http/httptest.NewRequestWithContext
(noctx)
pkg/server/server.go
[error] 18-18: const serverName is unused
(unused)
🔇 Additional comments (4)
go.mod (1)
6-19: LGTM!Also applies to: 31-44
.gitignore (1)
44-45: LGTM!cmd/server/main.go (1)
237-239: 🔒 Security & PrivacyKeep the namespace GET for
/health. This check is meant to verify K8s API reachability; probing pods would change the endpoint’s contract.> Likely an incorrect or invalid review comment.pkg/server/server.go (1)
51-56: 🔒 Security & PrivacyKeep
DisableLocalhostProtectionas-is
pkg/server/server.go:51-56is required by the HTTP transport spec, andValidateTransportFlagsalready rejects non-loopback addresses for this mode.> Likely an incorrect or invalid review comment.
- Bump golang.org/x/net to v0.55.0 for GO-2026-5026/4918 (called via session HTTP) - Reject non-positive --idle-timeout and negative --warm-pool-size - Set ReadHeaderTimeout on HTTP server; leave ReadTimeout unset for MCP streams - Use httptest.NewRequestWithContext in server tests for noctx lint Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Feny Mehta <fbm3307@gmail.com>
Export ValidateSessionID for the DELETE handler instead of duplicating the regex, and report version.Commit on the MCP server implementation. Co-authored-by: Cursor <cursoragent@cursor.com>
1 participant
Assisted by: Cursor
Summary by CodeRabbit