Skip to content

feat(mcp): Phase 1 — Onboarding + Read-Only Tools#61

Merged
artugrande merged 31 commits into
mainfrom
feat/mcp-phase-1-onboarding
May 8, 2026
Merged

feat(mcp): Phase 1 — Onboarding + Read-Only Tools#61
artugrande merged 31 commits into
mainfrom
feat/mcp-phase-1-onboarding

Conversation

@artugrande
Copy link
Copy Markdown
Collaborator

Summary

Phase 1 of the MCP server (per docs/superpowers/specs/2026-05-05-ghbounty-mcp-server-design.md section 12).

Ships apps/mcp/ workspace, 7 MCP tools (3 public onboarding + 4 read-only authenticated), GitHub Device Flow proxy, Bearer-token auth with bcrypt-hashed API keys, Upstash rate limiting (provisioned via Vercel Marketplace — no separate Upstash account), and a Vercel project config ready for deploy at mcp.ghbounty.com.

🔗 Linear: GHB-181
🔗 Spec: merged in #57
🔗 Phase 0: merged in #60
🔗 Plan: `docs/superpowers/plans/2026-05-06-mcp-phase-1-onboarding.md`

Tools shipped (7)

Tool Auth Purpose
`create_account.init` none Start GitHub Device Flow + reserve agent_account row
`create_account.poll` none Poll GitHub for access_token; on success, build init_stake_deposit tx
`create_account.complete` none Submit signed tx via gas-station; mint API key; activate account
`whoami` Bearer Profile + balances
`bounties.list` Bearer Paginated browse
`bounties.get` Bearer Full detail + my_submission if dev
`submissions.get` Bearer Gated: solver OR bounty company

Stats

  • 23 commits in branch
  • 36 tests passing in apps/mcp (1 skipped — Upstash live test, runs only with creds)
  • All 7 workspaces typecheck clean repo-wide

Frontend follow-up REQUIRED

The MCP's `gas-station-client.ts` POSTs to the frontend's `/api/gas-station/sponsor` with a new `x-mcp-service-token` header. The frontend's `gas-station-route-core.ts` needs to accept this auth path. Separate PR will follow to add it. Until that lands, the MCP's `create_account.complete` will fail to submit txs in production. Phase 1 unit tests pass against mocks.

Open Questions resolved

Adaptations from the plan

  • `@vercel/mcp-adapter` 0.3.2 was an empty stub — Vercel migrated to `mcp-handler` 1.1.0 package. Swapped during Task 5.
  • `GHBOUNTY_ESCROW_PROGRAM_ADDRESS` is empty in the IDL because the program isn't deployed yet — added `GHBOUNTY_PROGRAM_ADDRESS` env var fallback (see Vercel deploy doc).

Test plan

  • `pnpm typecheck` repo-wide passes (7 workspaces)
  • `pnpm --filter @ghbounty/mcp test` — 36 passing, 1 skipped
  • `apps/mcp` builds via `next build`
  • Manual: register Vercel project + provision Upstash via Marketplace + set env vars (steps in `docs/superpowers/decisions/2026-05-06-mcp-vercel-deploy.md`)
  • Manual: end-to-end test on devnet — register a test agent (init → poll with real GitHub → complete with real Solana tx)
  • Manual: enable Device Flow toggle on the GitHub App settings UI

🤖 Generated with Claude Code

@vercel
Copy link
Copy Markdown

vercel Bot commented May 6, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
gh-bounty-frontend Ready Ready Preview, Comment May 8, 2026 1:12am
ghbounty-mcp Ready Ready Preview, Comment May 8, 2026 1:12am

@artugrande
Copy link
Copy Markdown
Collaborator Author

Status update — coordinaciones del team detectadas

1. Cross-link con GHB-184 (Gaston, In Progress):

Gaston está agregando un cap de PRs por bounty desde el form de Create Bounty (la company define el max). Esto se complementa con la Sybil layer 5 del MCP design (cap por agente según edad). Cuando arranquemos Phase 2 del MCP (`submissions.prepare_submit`), el tool va a leer ese cap y rechazar la tx antes de buildear si el bounty está full.

Coordinación pedida en el comment de Linear: confirmar el nombre de la columna (probable `bounty_meta.max_submissions`) para que el MCP la consulte.

2. PRs viejos sin tocar

#23, #24, #27, #28 de Tomi (May 1-2) siguen abiertos. Originalmente eran test PRs. Cuando podamos, cerrar como obsoletos.

3. Sin reviews todavía en este PR. Tomi aún no agarró el review.

4. Manual provisioning pendiente (Arturo) — instrucciones completas en `docs/superpowers/decisions/2026-05-06-mcp-vercel-deploy.md`.

artugrande and others added 21 commits May 7, 2026 22:09
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace stub @vercel/mcp-adapter@0.3.2 (empty redirect package) with
mcp-handler@1.1.0 (the real implementation). Add app/api/mcp/[transport]/
route and lib/tools/register.ts empty stub so the app builds cleanly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…helper

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
artugrande and others added 10 commits May 7, 2026 22:09
Read-only authenticated tool returning agent identity and SOL balance.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Paginated read-only listing of bounties with optional status filter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fetch single bounty by UUID with role-aware my_submission field for devs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Returns submission data only to the solver or the bounty creator.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Full-mock smoke test for create_account.init exercising Supabase,
GitHub device-flow, gas-station, RPC, and rate-limit wiring end-to-end.
Brings total to 36 passing tests (+ 1 skipped) across 9 test files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@artugrande artugrande force-pushed the feat/mcp-phase-1-onboarding branch from f484efa to 356f1d3 Compare May 8, 2026 01:09
@artugrande artugrande marked this pull request as ready for review May 8, 2026 01:12
@artugrande artugrande requested a review from tomazzi14 as a code owner May 8, 2026 01:12
@artugrande artugrande merged commit 6149783 into main May 8, 2026
5 checks passed
@artugrande artugrande deleted the feat/mcp-phase-1-onboarding branch May 8, 2026 01:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant