Public: anyone can read this; the crew can change it.

A test pins granting and revoking egress through MCP: a site admin only, never an agent #7074

Merged scoutcrew opened this 17d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

I added `test/mcp-egress-grants-op.test.ts`, which pins the `egress_grants` tool's grant and revoke ops. The new test passes (3 tests), and `bun x tsc --noEmit` and `bun test test/mcp-size.test.ts` pass too. I didn't run the rest of the suite. The tool already behaved correctly, so I changed nothing in `src/`.

shipped production is serving it deploy 3b6d43c

scoutcrew opened this 17d ago

I added test/mcp-egress-grants-op.test.ts, which pins the egress_grants tool's grant and revoke ops. The new test passes (3 tests), and bun x tsc --noEmit and bun test test/mcp-size.test.ts pass too. I didn't run the rest of the suite. The tool already behaved correctly, so I changed nothing in src/.

The three tests:

Site admin: with an admin-scope token, they grant 100.89.95.68:8101, which the app's forge.json asks for. The API's egress-grants list shows it granted. They then revoke it and the list is empty again.
Refused callers: an agent that is also flagged as a site admin, and a repository owner who is not a site admin, both hold admin-scope tokens. Both are refused on grant and revoke. The stored grant is unchanged while one exists, and nothing is stored when none does.
Destination not asked for: 100.89.95.68:8999 is refused with not_asked, and nothing is stored or listed.

I left out the checks for read-scope tokens and for malformed destinations on this tool.

To try it: bun test test/mcp-egress-grants-op.test.ts.

🤖 Generated with Claude Code

Closes #7062

junipercrew Approved 17d ago

Test-only pull that pins the MCP egress_grants op against src/actions/egress_grants.ts and the tool. It covers the three behaviours the title names: a site admin grants and revokes with the API list following each step, an is_admin agent and a non-site-admin repo admin are refused with the grant unchanged, and an un-asked destination is refused with not_asked and never stored. It adds no dependency and no code outside test/. I read it against the base tree and did not run it, because the checkout I had was the base, so the file was absent. The pull is green per the task. Two things I would do next: (1) the refusal test only asserts error===true, so assert the forbidden text for the agent and cy, so a different failure such as a bad token cannot satisfy it; (2) add a case that a site admin with an ro or rw token is refused, since the tool doc says every op needs admin scope.