Skip to content

feat: add remote MCP transport reliability - #23

Merged
Esquetta merged 15 commits into
mainfrom
feature/v1.53-remote-transport-reliability
Jul 26, 2026
Merged

feat: add remote MCP transport reliability#23
Esquetta merged 15 commits into
mainfrom
feature/v1.53-remote-transport-reliability

Conversation

@Esquetta

Copy link
Copy Markdown
Owner

Summary

  • validate bounded remote MCP GET/SSE, session propagation, restart, and resumability behavior
  • add explicit single-session DELETE consent and strict reliability gates for CLI and GitHub Action
  • publish additive reliability scorecards with cross-output redaction and v1.53.0 release metadata

Verification

  • npm test: 878 passed, 6 environment-gated skipped
  • npm run build
  • npm audit --omit=dev --audit-level=high: 0 vulnerabilities
  • npm run release-check: package dry-run and clean consumer install passed
  • git diff --check

@qodo-code-review

Copy link
Copy Markdown

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

@Esquetta
Esquetta merged commit 0fb0657 into main Jul 26, 2026
2 checks passed

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04790e36ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

const hasFailures = fingerprintedFindings.some(
(finding) => finding.severity === "fail"
);
) || (options.requireRemoteReliability === true && !remoteReliabilityGatePassed(runtimeResult?.scorecard));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve the strict gate through config application

When reliability is warn or is unavailable, this expression makes validatePlugin fail without adding a failing finding. Every normal check path subsequently passes the result through applyDoctorConfig, which recomputes status solely from findings; with the default failOnWarnings: false, it downgrades the result to warn or pass and exits successfully. Consequently, check and the GitHub Action do not actually enforce --require-remote-reliability for the outcomes the flag is intended to block.

Useful? React with 👍 / 👎.

Comment on lines +316 to +318
if (resumed.sessionRestarted) {
scorecard.resumability = "skipped";
} else {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Validate the post-restart GET before skipping resume

If an initial event supplies an ID, the resume request returns 404, reinitialization succeeds, and the replacement-session GET then returns an invalid response such as HTTP 500, sessionRestarted causes that response to bypass all status, content-type, and framing classification. The scorecard records restart as passing and resumability as skipped, so the overall reliability result can pass despite the failed replacement GET; classify this response before deciding that only resumability should be skipped.

Useful? React with 👍 / 👎.

}
lineStart = index + 1;

if (line.length === 0) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Require an actual SSE event before reporting completion

Any empty line currently reports a complete event even when the preceding frame contains only a comment, id, retry, or no fields at all. Such frames do not dispatch an SSE event without data, so a common : keepalive\n\n stream is incorrectly marked as passing GET/disconnect reliability, and an empty resume response is marked as passing resumability. Track whether the frame contains event data and keep observing otherwise.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant