Skip to content

feat: expand MCP command surface#89

Merged
dubscode merged 2 commits into
mainfrom
feature/dub-50-mcp-server-expansion-tier-3-commands-and-ai-cooperative
May 25, 2026
Merged

feat: expand MCP command surface#89
dubscode merged 2 commits into
mainfrom
feature/dub-50-mcp-server-expansion-tier-3-commands-and-ai-cooperative

Conversation

@dubscode

@dubscode dubscode commented May 25, 2026

Copy link
Copy Markdown
Contributor

TL;DR

Expands the MCP surface with branch/diff/ready/merge_check read tools, propose_branch_name/propose_commit_message/propose_pr_description helpers, and the landed Tier 3 mutating command surface, including freeze/unfreeze and reorder after merging current main. Mutating MCP history now includes redacted args plus a deterministic args_sha256 hash, including no-arg calls.

Why

External coding agents need a broader, inspectable Dubstack MCP surface to manage stacks without shelling out for every command.

AI suggestions should stay read-only so agents can propose branch names, commit messages, and PR descriptions before making an explicit mutating call.

Mutating agent calls need auditability: reviewers should see redacted arguments plus a stable hash for the complete payload.

Before

  • MCP exposed only the initial read tools plus core mutating commands from the security-model work.
  • Agents could not ask MCP for diff, readiness, mergeability, or AI metadata proposals.
  • Mutating history did not consistently preserve a hashed record for the argument payload.

After

  • MCP exposes the new read tools, three AI proposal tools, and landed Tier 3 mutating commands.
  • Security modes still gate mutating tools through the existing interactive/trusted/read-only path.
  • History entries for mutating MCP calls include redacted args and args_sha256, including empty-object calls.

File-by-file

packages/cli/src/commands/mcp.ts

mod +697 / -22

Registers branch/diff/ready/merge_check, AI proposal tools, and landed Tier 3 mutating tools, including freeze/unfreeze and reorder from current main. Adds AI provider plumbing for proposal-only tools, safer split MCP handling, merge-check structured errors, reorder payload validation, and hashed audit-history logging for all mutating tools.

packages/cli/src/commands/mcp.test.ts

mod +141 / -2

Extends tools/list coverage, validates new read tools, exercises AI proposal behavior in read-only mode, and adds a regression for mutating no-arg history entries retaining {} plus args_sha256.

apps/docs/content/docs/guides/mcp.mdx

mod +67 / -1

Updates the MCP guide with expanded tool tables, AI proposal tools, return-shape examples, hashed audit-history notes, and an explicit pending note for dubstack.back, whose CLI implementation has not landed in this checkout.

Where to focus review

  1. Landed-command boundary - packages/cli/src/commands/mcp.ts: The merge from current main brought freeze/unfreeze and reorder into the MCP surface. dubstack.back remains intentionally pending because its underlying CLI command is not present.
  2. Mutating audit payloads - packages/cli/src/commands/mcp.ts: Mutating calls should always record redacted args and args_sha256, including {} payloads, without leaking secrets.
  3. AI proposal tools remain read-only - packages/cli/src/commands/mcp.ts: propose_* tools use AI metadata generators but do not route through mutating confirmation and should work in read-only MCP mode.
  4. Split MCP constraints - packages/cli/src/commands/mcp.ts: by-hunk is defensively rejected because it requires an interactive patch TTY; AI split requires explicit yes unless dry-run is true.

Test plan

  • unit: MCP command tests - packages/cli/src/commands/mcp.test.ts covers tools/list, branch/diff tools, AI proposal tools, read-only refusal, and hashed no-arg mutating history.
  • manual: Self-QA fallback - .reports/dub-50-qa.md records the non-browser QA evidence and why video is not required.

Quality gates

  • biome lint + format: pnpm checks - passed (Passed before PR creation and again after merging origin/main; final pre-commit Biome hook also passed.)
  • typecheck: pnpm typecheck - passed (Passed before PR creation and again after merging origin/main; turbo reported 3 successful tasks.)
  • unit tests: pnpm test - passed (Passed before PR creation and again after merging origin/main; latest run: 118 test files and 1176 tests passed.)
  • diff whitespace: git diff --check - passed (No whitespace errors reported before commit.)

Self-QA

See QA fallback evidence.

Deterministic CLI/test QA for MCP server expansion.

  • tools/list includes new read, AI proposal, and landed Tier 3 mutating tools
  • read-only MCP mode permits AI proposal tools but refuses mutating calls
  • mutating refusal history includes redacted args plus args_sha256 for empty-object calls
  • full repo checks, typecheck, and unit test suite pass

Acceptance criteria

  • All 13 Tier 3 commands exposed as MCP tools, gated by their parent issues - Registered the landed Tier 3 MCP surface in this checkout: split, absorb, squash, fold, pop, rename, move, freeze, unfreeze, reorder, unlink, revert, stash, and stash-pop. dubstack.back remains documented as pending because its CLI command is not present.
  • 4 additional read tools registered - Registered dubstack.diff, dubstack.branch, dubstack.ready, and dubstack.merge_check.
  • 3 propose_* AI-cooperative tools registered - Registered dubstack.propose_branch_name, dubstack.propose_commit_message, and dubstack.propose_pr_description as read-only tools.
  • Each mutating invocation produces dub history entry with redacted args + arg hash - runMutating now records redacted sorted args plus args_sha256 for mutating tools; regression test covers a no-arg mutating refusal.
  • Security modes respected - New mutating tools use the existing runMutating gate; read-only refusal tests include new mutating coverage, and AI proposal tools stay read-only.
  • Tests for each new tool category - mcp.test.ts covers new read tools, AI proposal tools, mutating tools/list exposure, and mutating history logging.
  • Docs list all tools - apps/docs/content/docs/guides/mcp.mdx documents read tools, AI proposal tools, landed mutating tools, return shapes, and the remaining pending dubstack.back command.

Adversarial review

Iterations: 2

Remaining critical/major: 0/0

Remaining minor/nitpick: 0/0

  • External claude reviewer attempt failed with API Error: 401 Invalid authentication credentials, so I completed a local two-pass adversarial review and recorded it in .context/dub-50-adversarial-review.md.
  • Major resolved: no-arg mutating MCP calls now log {} plus args_sha256 instead of omitting the payload hash.
  • Minor resolved: by-hunk removed from split MCP schema because the implementation rejects it as interactive-only.
  • Minor resolved: MCP docs now include concrete return-shape examples.

Dependencies

  • DUB-17 MCP security model: Already landed; reused existing mcp-mode gating instead of introducing a second permission model.
  • Unlanded Tier 3 CLI commands: dubstack.back is intentionally left pending in docs until its CLI implementation lands; freeze/unfreeze and reorder are now wired after merging current main.

Rollout

Additive MCP surface expansion. No state migration. Existing MCP clients continue to work; new tools appear in tools/list and mutating tools remain governed by mcp-mode.

  • merge - Ship MCP expansion: Standard PR merge after CI and review. New tools are discoverable through MCP tools/list.
  • post-merge - Docs publish: MCP guide updates ship with the docs app and identify the remaining unlanded tools as pending.
  • future Tier 3 landings - Future back landing: When the back CLI command lands, register its MCP tool in the same pattern.

Commit

chore: merge origin/main into DUB-50

Adds read-only stack inspection tools and AI proposal helpers.

Wires landed Tier 3 mutating commands into MCP.

Documents return shapes and hashed audit history.

Completes DUB-50
Copilot AI review requested due to automatic review settings May 25, 2026 00:33
@vercel

vercel Bot commented May 25, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
dubstack Ready Ready Preview, Comment May 25, 2026 12:38am

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@dubscode dubscode merged commit 7df5046 into main May 25, 2026
12 of 13 checks passed
@dubscode dubscode deleted the feature/dub-50-mcp-server-expansion-tier-3-commands-and-ai-cooperative branch May 25, 2026 00:43
@github-actions

Copy link
Copy Markdown

🎉 This PR is included in version 1.10.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants