Add corgea mcp install for agent MCP configs - #163
Conversation
Install (or reinstall) the Corgea MCP server into an agent's JSON config using the URL and token already stored by `corgea login`. Re-running removes any existing Corgea entry first so the endpoint and token stay current. Unauthenticated runs fail through the same login gate as other commands. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
CI under cargo-llvm-cov failed save_images_separates_references_differing_only_in_case with "Text file busy" when execing a stub script that had just been written in place. Write the stub via fsync+rename, wait until it is executable, and give each test a unique temp dir. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
New `corgea mcp install` command is a minor SemVer bump. Cargo.toml is the release source of truth; keep Cargo.lock in sync. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
This reverts commit 6214eed.
There was a problem hiding this comment.
Automated review risk: 4/5.
The installer risks credential disclosure, executes an unpinned package, can delete unrelated MCP entries, and generates an invalid Continue configuration.
Critical or high-priority changes must be addressed.
Automatic approval was not submitted: checks failed: rust-tests.
Bring in the merged ETXTBSY image-test fix (#164) so this PR's CI can pass without any further MCP-branch changes. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
Addresses three review findings on `corgea mcp install`: - The reinstall sweep matched any URL containing "corgea." and "/mcp", so it deleted unrelated servers on lookalike hosts (notcorgea.app, evil-corgea.attacker.test) and on paths that merely mentioned corgea. Parse the URL instead and compare the host: Corgea's own SaaS hosts, or the host this run is installing, which is what recognizes a self-hosted instance. - Continue was given a `contextProviders` entry, which Continue does not read as an MCP server, so the install reported success and registered nothing. Write a real block file at `.continue/mcpServers/corgea.yaml` instead. Continue's schema keeps HTTP headers under `requestOptions` and drops unknown top-level keys, so a top-level `headers` map would be discarded. - Use `Map::retain` rather than collecting keys and removing them in a loop. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
v1.12.0 is already tagged and published on npm, so the new `mcp install` command needs the next minor. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
![corgea-staging[bot]](https://avatars.githubusercontent.com/u/69728621?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
corgea mcp install --agent opencode --scope user writes a file OpenCode does not read on macOS or Windows. Other advertised agents look correct; prior Continue / host-matching / token-in-file / unpinned mcp-remote threads stay closed.
Sent by Cursor Automation: pr-flow
| // thing entirely and does not register an MCP server. | ||
| (Agent::Continue, Scope::User) => Ok(ctx.home.join(".continue/mcpServers/corgea.yaml")), | ||
| (Agent::Continue, Scope::Project) => Ok(ctx.cwd.join(".continue/mcpServers/corgea.yaml")), | ||
| (Agent::OpenCode, Scope::User) => Ok(ctx.config_dir.join("opencode/opencode.json")), |
There was a problem hiding this comment.
--agent opencode --scope user installs into a path OpenCode never reads on macOS/Windows.
dirs::config_dir() is ~/Library/Application Support on macOS and %APPDATA% on Windows, so this writes:
- macOS:
~/Library/Application Support/opencode/opencode.json - Windows:
%APPDATA%\\opencode\\opencode.json
OpenCode's documented global config is ~/.config/opencode/opencode.json on every platform (https://dev.opencode.ai/docs/config/). This repo already follows that for skills (skill.rs maps opencode user installs to .config/opencode/skills under $HOME). The command still prints success and exits 0, so a Mac/Windows user gets a silent no-op.
Linux happens to work only because dirs::config_dir() is already ~/.config there. resolve_known_user_and_project_paths uses /home/ada/.config as config_dir, so it cannot catch this. Add an assertion with a macOS-style config_dir (.../Library/Application Support) that expects $HOME/.config/opencode/opencode.json.
| (Agent::OpenCode, Scope::User) => Ok(ctx.config_dir.join("opencode/opencode.json")), | |
| (Agent::OpenCode, Scope::User) => Ok(ctx.home.join(".config/opencode/opencode.json")), |
5 participants
Adds
corgea mcp install --agent <name>so a logged-in CLI can write the Corgea MCP server into an agent's JSON config using the URL and token already stored bycorgea login.Version bumped 1.12.0 → 1.13.0 (minor: new command).
v1.12.0is already tagged and on npm.Behavior
scan/skill/ls. An empty or missing token exits with the existing "No token set" message.mcp-remotewith--transport http-onlyand the token in the header (Cursor does not interpolate${env:NAME}from the serverenvblock).--agent claude):mcp-remoteplus anenvblock."type": "http") withurl+CORGEA-TOKENheader..continue/mcpServers/corgea.yaml.--scope user(default) orproject;--dirwrites a custom path;--set-defaultpersists the agent likecorgea skill install.Review feedback addressed
Loose URL matching deleted unrelated servers. The sweep was a substring test for
corgea.+/mcp, so it removed servers onnotcorgea.app,evil-corgea.attacker.test, and paths that merely mentioned corgea. It now parses the URL and compares the host: Corgea's own SaaS hosts (corgea.app/*.corgea.app), or the host this run is installing, which is what recognizes a self-hosted instance on an unrelated domain.Continue got a context provider instead of an MCP server. We wrote a
contextProvidersentry intoconfig.json, which Continue does not read as MCP — the install claimed success and registered nothing. It now writes a real block file at.continue/mcpServers/corgea.yaml(Continue scans that directory in both the global dir and the workspace) with the requiredname/version/schemapreamble and anmcpServerslist. Per Continue's own config schema, an HTTP server carries headers underrequestOptions, and unknown top-level keys are stripped — so a top-levelheadersmap would have been silently discarded. Note Corgea's published MCP docs show thecontextProvidersform for Continue and need the same correction..retain()nit.remove_corgea_from_mapnow usesMap::retaininstead of collecting keys and removing them in a loop.Two findings are left as product decisions rather than code changes: the project-scope token in repo files, and the unpinned
npx -y mcp-remote(which is what Corgea's MCP docs prescribe, and Cursor requires the bridge because its built-inurltransport opens an SSE stream this server does not support).Tests
CORGEA_URL/CORGEA_TOKEN, reinstall refresh,--agent claude,--agent continueblock file, and lookalike-host survival../harness checkgreen: clippy-D warnings, format, 807 tests.