Add authenticated MCP document reads #39
- MA
## Summary
Rebuilds Chopin's inbound MCP read boundary for the hosted backend. It exposes authenticated `list_documents` and `read_document` tools over `/mcp`, scoped by the caller's current GitHub repository access and durable repository channels.
## What changed
- Adds a backend-neutral Streamable HTTP MCP protocol with bounded request validation. - Authenticates each request from the caller's GitHub bearer token and rechecks repository access and node identity. - Lists documents through a stable repository scan; reads live plans authoritatively and closed plans by reconstructing their checkpoint and journal through `StorageAdapter`. - Registers GET and POST `/mcp` routes with an exact supplied-Origin policy, `no-store`, `nosniff`, and non-disclosing failures.
## Contract note
`list_documents` requires `repository: "owner/name"` because a remote MCP client cannot infer a local checkout.
## Verification
- `bun run types` - `bun run ci` - `bun test` — 682 passing, 2 expected PostgreSQL skips - Live PostgreSQL adapter contract — 10 passing - `git diff --check`
MaggieAppletonhead-ref-force-pushed a5f5c3d782d33 months ago on GitHub
MaggieAppletonreferenced this in Publish local-agent MCP setup guidance #403 months ago on GitHub
MaggieAppletonhead-ref-force-pushed 862efb25ac5d3 months ago on GitHub
MaggieAppletonreferenced this in Create validated Chopin documents through MCP #423 months ago on GitHub
MaggieAppletonhead-ref-force-pushed bf1c1648c2f52 months ago on GitHub
MaggieAppletonhead-ref-force-pushed bc476c5e58092 months ago on GitHub
MaggieAppletonhead-ref-force-pushed d7e189d2cfa22 months ago on GitHub
MaggieAppletonmerged 719d09a23ea42 months ago on GitHub
MaggieAppletonhead-ref-deleted2 months ago on GitHub