Files
dc605b911e feat(mcp): expand CRUD server to near-complete CLI parity (#1440)
* feat(mcp): expand CRUD MCP server to near-complete CLI parity

Closes the CLI-vs-MCP tool coverage gap identified by auditing every
`goclaw` CLI command against the existing goclaw_* MCP tool set. Adds
skill grant/revoke, agent skill pin/unpin, and full CRUD/inspection
surfaces for memory, knowledge graph (including dedup/merge/prune),
tenants, providers, LLM traces, channel contacts, pending messages,
audit activity, system config, tenant storage (list/size/delete/move),
scoped agent config export/import, secure-CLI binary registry, and a
DB-backed health check.

Deliberately out of scope, documented inline where relevant:
- `goclaw credentials`: confirmed CLI-local (~/.goclaw/config.yaml +
  keychain), no server resource to wrap. goclaw_secure_cli_binaries_*
  covers the closest real, previously-uncovered server resource instead.
- Full tar-archive agent export/import (KG + workspace files): the CLI's
  version streams a multi-section archive with progress events, a shape
  that doesn't map to a single MCP tool call. Config + context files
  (the portable "brain") is covered.
- `kg extract` (LLM-driven text extraction): goclaw_kg_ingest accepts
  the same Entity/Relation shapes the extractor produces, so a caller
  can run extraction itself and hand off the result.

Wires 8 new store dependencies (Memory, KnowledgeGraph, Tracing,
Contacts, PendingMessages, Activity, SystemConfigs, SecureCLI) through
gateway.Server setters -> cmd/gateway.go -> CRUDDeps, following the
existing Providers/Tenants pattern. Storage and secure-CLI-binary
handlers duplicate internal/http's path-escape/symlink-hiding
validation logic (documented inline) since internal/http already
imports internal/mcp and the reverse would cycle.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(mcp): return sessionKey in goclaw_chat_send response for persistent conversations

The goclaw_chat_send tool creates a new session internally when sessionKey is
empty, but never returned the key to the caller. This prevented using
goclaw_chat_history to fetch previous messages in the session.

Add SessionKey field to ChatSendResult so callers can:
1. Start a new agent chat without providing sessionKey
2. Receive the sessionKey back in the response
3. Use that sessionKey for follow-up messages and history queries

Fixes the training loop pattern: start chat → get sessionKey → call
goclaw_chat_history with that key → iterate skill based on actual failures.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(mcp): add timing diagnostics to goclaw_chat_send for timeout troubleshooting

Log request arrival, processing duration, and errors with millisecond precision.
Helps identify whether timeouts occur at MCP client→goclaw, goclaw→ollama, or
during agent execution. Critical for production debugging.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

* fix(gateway): add http.Server timeouts for defensive timeout handling

Set explicit timeouts in http.Server:
- ReadTimeout: 1h (allow large uploads, long-running agent operations)
- WriteTimeout: 1h (allow streaming responses to slow clients)
- IdleTimeout: 30s (close idle keep-alive connections quickly)

Provides defense-in-depth when Nginx/Traefik timeouts are misconfigured.
Matches Nginx timeout (3600s) to prevent race conditions.

Timeout chain: traefik 3600s = nginx 3600s = goclaw 3600s

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Bruno Clermont <bruno.clermont@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-16 01:56:03 +07:00

180 lines
6.2 KiB
Go

package mcp
import (
"context"
"fmt"
"github.com/google/uuid"
mcpgo "github.com/mark3labs/mcp-go/mcp"
mcpserver "github.com/mark3labs/mcp-go/server"
"github.com/nextlevelbuilder/goclaw/internal/store"
)
// registerTenantsCRUDTools registers the goclaw_tenants_* MCP tools backed
// by store.TenantStore — closes a CLI-vs-MCP coverage gap (the `goclaw
// tenants create/list/users` commands had no MCP equivalent). deps.Tenants
// was already threaded through CRUDDeps for the "X-GoClaw-Tenant-Id" header
// resolution (see crud_server.go); this reuses the same store reference.
func registerTenantsCRUDTools(srv *mcpserver.MCPServer, tenants store.TenantStore) {
srv.AddTool(mcpgo.NewTool("goclaw_tenants_list",
mcpgo.WithDescription("List all tenants."),
mcpgo.WithReadOnlyHintAnnotation(true),
), handleTenantsList(tenants))
srv.AddTool(mcpgo.NewTool("goclaw_tenants_get",
mcpgo.WithDescription("Get a single tenant by UUID or slug."),
mcpgo.WithString("id", mcpgo.Description("Tenant UUID.")),
mcpgo.WithString("slug", mcpgo.Description("Tenant slug, used when id is not known.")),
mcpgo.WithReadOnlyHintAnnotation(true),
), handleTenantsGet(tenants))
srv.AddTool(mcpgo.NewTool("goclaw_tenants_create",
mcpgo.WithDescription("Create a new tenant."),
mcpgo.WithString("name", mcpgo.Required(), mcpgo.Description("Tenant display name.")),
mcpgo.WithString("slug", mcpgo.Required(), mcpgo.Description("Tenant slug (URL/path-safe identifier).")),
), handleTenantsCreate(tenants))
srv.AddTool(mcpgo.NewTool("goclaw_tenants_users_list",
mcpgo.WithDescription("List a tenant's member users."),
mcpgo.WithString("id", mcpgo.Required(), mcpgo.Description("Tenant UUID.")),
mcpgo.WithReadOnlyHintAnnotation(true),
), handleTenantsUsersList(tenants))
srv.AddTool(mcpgo.NewTool("goclaw_tenants_users_add",
mcpgo.WithDescription("Add a user to a tenant with a given role."),
mcpgo.WithString("id", mcpgo.Required(), mcpgo.Description("Tenant UUID.")),
mcpgo.WithString("user_id", mcpgo.Required(), mcpgo.Description("User ID to add.")),
mcpgo.WithString("role", mcpgo.Description("Tenant role; defaults to \"member\".")),
), handleTenantsUsersAdd(tenants))
srv.AddTool(mcpgo.NewTool("goclaw_tenants_users_remove",
mcpgo.WithDescription("Remove a user from a tenant."),
mcpgo.WithString("id", mcpgo.Required(), mcpgo.Description("Tenant UUID.")),
mcpgo.WithString("user_id", mcpgo.Required(), mcpgo.Description("User ID to remove.")),
mcpgo.WithDestructiveHintAnnotation(true),
), handleTenantsUsersRemove(tenants))
}
func handleTenantsList(tenants store.TenantStore) mcpserver.ToolHandlerFunc {
return func(ctx context.Context, _ mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
list, err := tenants.ListTenants(ctx)
if err != nil {
return toolError("tenants.list", err)
}
return jsonToolResult(list)
}
}
func handleTenantsGet(tenants store.TenantStore) mcpserver.ToolHandlerFunc {
return func(ctx context.Context, req mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
idStr := req.GetString("id", "")
slug := req.GetString("slug", "")
switch {
case idStr != "":
id, err := uuid.Parse(idStr)
if err != nil {
return toolError("tenants.get", fmt.Errorf("invalid id: %w", err))
}
t, err := tenants.GetTenant(ctx, id)
if err != nil {
return toolError("tenants.get", err)
}
return jsonToolResult(t)
case slug != "":
t, err := tenants.GetTenantBySlug(ctx, slug)
if err != nil {
return toolError("tenants.get", err)
}
return jsonToolResult(t)
default:
return mcpgo.NewToolResultError("tenants.get: one of id or slug is required"), nil
}
}
}
func handleTenantsCreate(tenants store.TenantStore) mcpserver.ToolHandlerFunc {
return func(ctx context.Context, req mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
name, err := req.RequireString("name")
if err != nil {
return toolError("tenants.create", err)
}
slug, err := req.RequireString("slug")
if err != nil {
return toolError("tenants.create", err)
}
t := &store.TenantData{
ID: store.GenNewID(),
Name: name,
Slug: slug,
Status: "active",
}
if err := tenants.CreateTenant(ctx, t); err != nil {
return toolError("tenants.create", err)
}
return jsonToolResult(t)
}
}
func handleTenantsUsersList(tenants store.TenantStore) mcpserver.ToolHandlerFunc {
return func(ctx context.Context, req mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
idStr, err := req.RequireString("id")
if err != nil {
return toolError("tenants.users_list", err)
}
id, err := uuid.Parse(idStr)
if err != nil {
return toolError("tenants.users_list", fmt.Errorf("invalid id: %w", err))
}
users, err := tenants.ListUsers(ctx, id)
if err != nil {
return toolError("tenants.users_list", err)
}
return jsonToolResult(users)
}
}
func handleTenantsUsersAdd(tenants store.TenantStore) mcpserver.ToolHandlerFunc {
return func(ctx context.Context, req mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
idStr, err := req.RequireString("id")
if err != nil {
return toolError("tenants.users_add", err)
}
id, err := uuid.Parse(idStr)
if err != nil {
return toolError("tenants.users_add", fmt.Errorf("invalid id: %w", err))
}
userID, err := req.RequireString("user_id")
if err != nil {
return toolError("tenants.users_add", err)
}
role := req.GetString("role", "member")
if err := tenants.AddUser(ctx, id, userID, role); err != nil {
return toolError("tenants.users_add", err)
}
return jsonToolResult(map[string]string{"ok": "true"})
}
}
func handleTenantsUsersRemove(tenants store.TenantStore) mcpserver.ToolHandlerFunc {
return func(ctx context.Context, req mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
idStr, err := req.RequireString("id")
if err != nil {
return toolError("tenants.users_remove", err)
}
id, err := uuid.Parse(idStr)
if err != nil {
return toolError("tenants.users_remove", fmt.Errorf("invalid id: %w", err))
}
userID, err := req.RequireString("user_id")
if err != nil {
return toolError("tenants.users_remove", err)
}
if err := tenants.RemoveUser(ctx, id, userID); err != nil {
return toolError("tenants.users_remove", err)
}
return jsonToolResult(map[string]string{"ok": "true"})
}
}