feat: add opt-in call_endpoint HTTP execution - #3
Merged
Conversation
- Added `call.ts` with functions for merging headers, materializing call results, serializing request bodies, and flattening headers. - Introduced `CallEndpointResult` type for structured API call responses.
- Added support for enabling `call_endpoint` with a new `enableCalls` flag. - Introduced timeout and maximum response body size settings for HTTP requests via `callTimeoutMs` and `callMaxBodyBytes`. - Updated `loadConfig` function to read new environment variables for these settings.
…LE_CALLS flag. Updated main function to include call tools if enabled.
- Introduced `registerCallTools` function to wire the `call_endpoint` tool to the MCP server. - Added `registerCallToolsIfEnabled` function to conditionally register call tools based on the `enableCalls` flag. - Enhanced input schema for `call_endpoint` to support various HTTP request parameters and headers.
…tion - Added `callEndpoint` method to `OpenApiContractService` for executing HTTP requests against registered backends. - Introduced `buildCallUrl` utility for constructing absolute URLs from OpenAPI specifications. - Enhanced documentation for service orchestration and input types for better clarity on usage.
…d URL building - Introduced tests for `OpenApiContractService.callEndpoint` covering various scenarios including successful calls, error handling, and response body truncation. - Added tests for `registerCallToolsIfEnabled` to verify conditional registration of call tools based on the `enableCalls` flag. - Implemented tests for `buildCallUrl` to ensure correct URL assembly from base URL and path templates, including handling of path parameters and query string encoding. - Enhanced configuration tests to validate new environment variables for call execution limits and enabling calls.
- Modified the test job in `pr-checks.yml` to run tests with coverage instead of standard tests. - Updated comments to reflect the inclusion of coverage floors from `vitest.config.ts`.
- Clarified that the server is read-only by default, with optional HTTP execution available when `OPENAPI_MCP_ENABLE_CALLS` is set. - Updated the architecture document to include new responsibilities related to HTTP call helpers. - Enhanced README to provide examples for enabling HTTP calls and detailed environment variable descriptions. - Adjusted sections on tool registration and call limits to align with recent changes in functionality.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds optional HTTP execution to the OpenAPI Contract MCP via a new
call_endpointtool, gated behindOPENAPI_MCP_ENABLE_CALLS. By default the server stays read-only (contract inspection only); when enabled, agents can execute operations against registered backends with timeout and response-body limits, header/headerEnv auth, and URL building from OpenAPI path templates and servers.Key Changes & Features Implemented
HTTP execution core
94c34a4)buildCallUrlfor absolute URL assembly from base URL, servers, path params, and query (eb8ab30)OpenApiContractService.callEndpointfor operation resolution and HTTP execution with abort timeout (eb8ab30)Opt-in config and MCP tool surface
enableCalls,callTimeoutMs, andcallMaxBodyBytesfrom env (57f1fbe)call_endpointonly whenOPENAPI_MCP_ENABLE_CALLSis truthy (3ee7a3c,3b52fde)Tests and CI
callEndpoint, call tool registration, URL building, and call-related config (8a23f35)cb0b59e)Documentation and release
c7a5e5d)4f62744)How to Test
pnpm test(orpnpm test:coverage) and confirm call endpoint, call tools, call-url, config, and service suites pass.OPENAPI_MCP_ENABLE_CALLSand confirmcall_endpointis not listed among tools.OPENAPI_MCP_ENABLE_CALLS=1, register a backend viause_backend, then callcall_endpointfor a known operation (method+path or operationId).headerEnv(preferred) and that timeouts / body truncation respectOPENAPI_MCP_CALL_TIMEOUT_MSandOPENAPI_MCP_CALL_MAX_BODY_BYTES.