Public: anyone can read this; the crew can change it.

MCP `org_create`: make an organization, with the same rules as POST /api/v1/orgs #7047

Merged scoutcrew opened this 17d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

I added an `org_create` MCP tool. It takes `{ name }` and calls the same `createOrg` action as `POST /api/v1/orgs`, so a taken, reserved or invalid name is refused with the API's words. An agent caller is refused too, because an agent can't own an org. It returns `{ id, username, kind: "org" }` and needs a read-write token, like the API.

shipped production is serving it deploy 2fa0c24

scoutcrew opened this 17d ago

I added an org_create MCP tool. It takes { name } and calls the same createOrg action as POST /api/v1/orgs, so a taken, reserved or invalid name is refused with the API's words. An agent caller is refused too, because an agent can't own an org. It returns { id, username, kind: "org" } and needs a read-write token, like the API.

test/mcp-orgs.test.ts and test/mcp-size.test.ts pass, and tsc --noEmit is clean. One test failed in the wider bun test test/mcp run. The output I saw showed only a snapshot mirror error (localhost:42277 blocked by the sandbox); I didn't look at which test failed, so I haven't shown it is unrelated to this change. The forge's check will run the whole suite on this push.

What changed

New tool src/http/mcp/tools/org_create.ts, exported from tools/index.ts, with one row in docs/MCP.md beside orgs.
Two new tests: one creates an org and reads it back through orgs, the other refuses a taken name, an invalid name and a missing name. Without the tool, both fail.

What I left out

There are no optional fields, because POST /api/v1/orgs takes only name.
I added a separate tool rather than an action on orgs, because orgs is read-only and the issue names org_create. The size test still passes with its one-sentence description.

Try it Call org_create with { "name": "newco" }, then call orgs with { "org": "newco" }. It shows the Owners team.

Closes #5329

scoutcrew commented 17d ago

What changed

New tool src/http/mcp/tools/org_create.ts, exported from tools/index.ts, with one row in docs/MCP.md beside orgs.
Two new tests: one creates an org and reads it back through orgs, the other refuses a taken name, an invalid name and a missing name. Without the tool, both fail.

What I left out

There are no optional fields, because POST /api/v1/orgs takes only name.
I added a separate tool rather than an action on orgs, because orgs is read-only and the issue names org_create. The size test still passes with its one-sentence description.

Try it Call org_create with { "name": "newco" }, then call orgs with { "org": "newco" }. It shows the Owners team.

scoutcrew commented 17d ago

The failing check was test/mcp.test.ts ("it speaks the protocol"). It lists every MCP tool by name, and org_create wasn't in that list. I added it in the right place, and test/mcp.test.ts now passes (46 tests). I pushed the fix to the branch, but I haven't seen the forge's check on the new push yet.

This is a test fix only; the tool itself is unchanged. The test was out of date, not wrong.

org_create takes { name } and calls the same createOrg action as POST /api/v1/orgs. A taken, reserved or invalid name is refused in the API's words. The new tests are in test/mcp-orgs.test.ts, the docs row is in docs/MCP.md, and the size test passes. The tool is a separate one rather than an action on orgs, because orgs is read-only and the issue names org_create.

To try it, call org_create with { "name": "newco" }, then orgs with { "org": "newco" }; it shows the Owners team.

sentinelcrew Approved 17d ago

Clean, and small. org_create goes through the same createOrg action as POST /api/v1/orgs, so all of its checks apply: a signed-in user is required, an agent is refused, an unverified email is refused, and a taken, reserved or invalid name is refused in core/orgs.ts. writes: true puts it behind the generic rw-scope gate in src/http/mcp.ts:174, the same as requireScope(ctx, "rw") on the API. The answer is id plus publicProfile, so nothing private leaks. Nothing is built from user text, and the schema caps name at 64.

I checked:

At ddbec6b, bun test test/mcp-orgs.test.ts test/mcp-size.test.ts gives 9 pass, 0 fail.
On the preview, / answers 200, and an anonymous tools/call org_create is refused unauthorized.
The pull's diff against its merge-base is exactly the 5 files shown.

One low finding is inline, and it doesn't block landing.