feat(setup): import credential-free remote MCP entries

[mohanagy]

Summary

• import one selected typed HTTPS remote MCP entry through the shared CLI and Console client-entry path
• preserve the no-secret boundary: reject env, headers, unknown fields, shell, URL userinfo/query/fragment, and opaque token-like path segments; require an explicit HTTP transport
• retain safe read-only defaults and never launch the entry, discover OAuth, call upstream, or edit the source client file
• clarify the Console and documented import boundary

Refs #204

Security impact

• The importer accepts only typed HTTPS endpoint entries and creates a safe read-only configuration.
• It never copies raw credentials, secret-bearing headers or environment values, URL tokens, OAuth material, or client-file contents into generated configuration, logs, audit data, or client snippets.
• The post-builder boundary rejects any env, headers, or trusted tool annotations introduced by a future preset change, while keeping the preset builder as the transport-shape source of truth.
• It never launches an imported command, discovers OAuth, contacts the upstream, or changes the source MCP client configuration.

Validation

• TDD: remote import, endpoint-token, and post-builder credential-boundary regressions failed before their production changes
• npm test: 1,580 passed, 27 expected skips
• npm run test:core: 415 passed, 22 expected skips
• npm run test:coverage
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack
• npm run test:package
• read-only Claude Code Opus review completed; all actionable findings were addressed
• CodeRabbit inline thread resolved

[coderabbitai]

📝 Walkthrough

Walkthrough

The client-entry import flow now accepts either a selected local stdio entry or a credential-free HTTPS remote entry. Remote inputs receive strict type, URL, and credential-shape validation, then produce read-only default configurations without OAuth discovery or upstream calls. CLI, Console, documentation, and tests reflect the expanded behavior.

Changes

MCP client entry import

Layer / File(s)	Summary
Import contracts and documentation README.md, docs/cli.md, docs/console-api.md, tests/readme-product-contract.test.ts	Documentation and contract tests define local stdio and credential-free HTTPS entry formats, restrictions, and no-discovery/no-call behavior.
Remote entry validation and configuration creation src/setup/client-entry-import.ts, tests/client-entry-import.test.ts	Remote entries are validated for explicit transport types, HTTPS URLs, and credential-free paths before producing validated read-only default configurations.
CLI and Console onboarding integration src/cli/setup-client-entry-import.ts, src/console/console-application-service.ts, src/console/console-assets.ts, tests/console-application-service.test.ts, tests/console-server.test.ts, tests/setup-command.test.ts	CLI and Console onboarding support remote entries and report transport-specific import results, with tests covering configuration writes and the absence of OAuth or upstream calls.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

• [Onboarding] Build a shared CLI and Console MCP setup wizard #204 — Covers the existing-client import portion of the shared CLI/Console MCP setup wizard expanded by this change.

Possibly related PRs

• mohanagy/miftah#215 — Shares the client-entry importer and no-secret local import flow extended here for HTTPS remote entries.
• mohanagy/miftah#218 — Shares the client-entry onboarding and safe local import path.
• mohanagy/miftah#219 — Shares the Windows executable policy and client-entry import validation extended here.

Sequence Diagram(s)

sequenceDiagram
  participant SetupOrConsole
  participant ClientEntryImporter
  participant MiftahConfig
  SetupOrConsole->>ClientEntryImporter: submit selected MCP entry
  ClientEntryImporter->>ClientEntryImporter: validate local or HTTPS remote shape
  ClientEntryImporter->>MiftahConfig: build read-only default configuration
  MiftahConfig-->>SetupOrConsole: write configuration and return import action

Loading

Poem

A rabbit hops through HTTPS light,
No secret copied, none in sight.
Stdio paths are checked with care,
Read-only profiles bloom there.
OAuth sleeps; the config is bright.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: importing credential-free remote MCP entries.
Description check	✅ Passed	The description matches the template with Summary, Security impact, and Validation sections and includes the key required details.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/204-remote-https-setup-v2

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/setup/client-entry-import.ts`:
- Around line 390-411: Update safeImportedConfig to derive serializedUpstream
from baseline.upstream instead of reconstructing the stdio/streamable-http
shapes independently. Use a narrow type assertion if required, then pass that
derived value through the existing validation flow so the builder remains the
single source of truth.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dabad845-a7f6-4067-a3e4-6fd98d0a238e

📥 Commits

Reviewing files that changed from the base of the PR and between 77c8ccc and 35a9356.

📒 Files selected for processing (12)

• README.md
• docs/cli.md
• docs/console-api.md
• src/cli/setup-client-entry-import.ts
• src/console/console-application-service.ts
• src/console/console-assets.ts
• src/setup/client-entry-import.ts
• tests/client-entry-import.test.ts
• tests/console-application-service.test.ts
• tests/console-server.test.ts
• tests/readme-product-contract.test.ts
• tests/setup-command.test.ts