[codex] add Go MCP server mode

[gnanam1990]

Summary

• Add a Go MCP stdio server that handles initialize, tools/list, and tools/call with JSON-RPC framing.
• Export Zero tool schemas to MCP input schemas and run tool calls through the existing registry permission path.
• Wire zero serve --mcp into the CLI with read-only tools exposed by default and an explicit --allow-unsafe-tools opt-in for write/shell tools.
• Document the new command and cover the protocol, approval gate, CLI defaults, unsafe opt-in, and help routing with tests.

Reviewers: @Vasanthdev2004 @anandh8x

Validation

• go test -count=1 ./...
• npx --yes bun run typecheck
• npx --yes bun test ./tests --timeout 15000
• npx --yes bun run build
• npx --yes bun run smoke:build
• ./zero --help
• ./zero serve --help
• MCP protocol smoke against ./zero serve --mcp, confirming only read-only tools are listed by default
• git diff --check origin/main..HEAD

Summary by CodeRabbit

• New Features
  • Added zero serve --mcp command to expose Zero's read-only tools over MCP (Model Context Protocol) stdio, enabling integration with MCP clients.
  • Added --allow-unsafe-tools flag to enable write operations through MCP.
  • Added -C/--cwd option to specify the workspace directory.

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Typecheck: bun run typecheck
• [pass] Tests: bun run test
• [pass] Build: bun run build
• [pass] Smoke build: bun run smoke:build

Scope

Head: a6e82a9971a6
Changed files (8): README.md, internal/cli/app.go, internal/cli/app_test.go, internal/cli/serve.go, internal/cli/serve_test.go, internal/mcp/schema.go, internal/mcp/server.go, internal/mcp/server_test.go

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 07c43950-f6d3-4b2e-9947-527b0fe6d34e

📥 Commits

Reviewing files that changed from the base of the PR and between 45f6539 and a6e82a9.

📒 Files selected for processing (8)

• README.md
• internal/cli/app.go
• internal/cli/app_test.go
• internal/cli/serve.go
• internal/cli/serve_test.go
• internal/mcp/schema.go
• internal/mcp/server.go
• internal/mcp/server_test.go

---

Walkthrough

This PR introduces a new zero serve --mcp CLI subcommand that exposes Zero's tools via the Model Context Protocol over stdio, enabling LLM applications to call Zero's read-only tools (or optional unsafe tools with --allow-unsafe-tools) through standard MCP JSON-RPC messaging.

Changes

MCP Server Integration via CLI Serve Command

Layer / File(s)	Summary
MCP Server Protocol & Schema internal/mcp/server.go, internal/mcp/schema.go, internal/mcp/server_test.go	JSON-RPC message loop handling initialize, tools/list, and tools/call RPC methods. Permission gating prevents tool execution unless PermissionGranted is true. Schema serialization converts internal tool schemas to MCP format with property constraints (enum, default, min/max). Comprehensive tests cover E2E flows, permission gates, unknown methods, and schema shapes.
CLI Serve Command Implementation internal/cli/serve.go, internal/cli/serve_test.go	zero serve --mcp subcommand implementation with mandatory --mcp flag, optional -C/--cwd workspace selection, and --allow-unsafe-tools to enable broader tool access. Parses arguments, resolves workspace, builds tool registry (read-only by default), and starts MCP stdio server. Integration tests validate read-only tool exposure, unsafe-tools opt-in behavior, and required --mcp flag enforcement.
CLI Command Routing & Help internal/cli/app.go, internal/cli/app_test.go	Registers serve in the main command dispatcher and updates help text. Updated TUI and help output tests now include serve command coverage.
Documentation README.md	Adds zero serve --mcp [-C <path>] to the "Other commands" section describing MCP stdio exposure of read-only tools.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Gitlawb/zero#48: Adds unsafe write-side tools (write_file, edit_file, apply_patch) that are now selectively exposed via --allow-unsafe-tools flag in the MCP serve command.

Suggested reviewers

• Vasanthdev2004
• anandh8x

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title '[codex] add Go MCP server mode' clearly and accurately summarizes the main change: adding an MCP stdio server to the Zero CLI via the new zero serve --mcp command.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/m4-go-mcp-server

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Vasanthdev2004]

Looks Good

I reviewed the Go MCP server mode end-to-end. The new zero serve --mcp command exposes a narrow read-only tool registry by default, keeps write/shell tools behind the explicit --allow-unsafe-tools opt-in, and routes MCP tools/call execution through Registry.RunWithOptions so the existing permission metadata is enforced rather than bypassed. The MCP server implementation handles stdio framing, initialize, notifications, tool listing, tool calls, unknown-method errors, and schema conversion with focused Go coverage.

Validation I ran on head a6e82a9971a67311998aa2eb446f6876deac8129:

• bun install --frozen-lockfile
• bun run typecheck
• bun test ./tests --timeout 15000 — 291 pass / 0 fail
• bun run build
• bun run smoke:build
• bun run smoke:go
• go test ./internal/cli ./internal/mcp ./internal/tools
• go test -count=1 ./...
• git diff --check origin/main..HEAD

I also smoke-tested the built zero.exe serve --mcp path directly over MCP stdio framing:

• default mode listed only glob, grep, list_directory, and read_file
• default mode did not expose write_file and returned an error for a write_file call
• --allow-unsafe-tools exposed write_file and emitted the unsafe-tools warning on stderr
• zero serve --help documents --mcp, --cwd, and --allow-unsafe-tools

GitHub checks are green, including ubuntu/macos/windows Smoke, Performance Smoke, Zero Review, and CodeRabbit.

No blockers from me.

[Vasanthdev2004]

Looks Good

I reviewed the Go MCP server mode end-to-end. The new zero serve --mcp command exposes a narrow read-only tool registry by default, keeps write/shell tools behind the explicit --allow-unsafe-tools opt-in, and routes MCP tools/call execution through Registry.RunWithOptions so the existing permission metadata is enforced rather than bypassed. The MCP server implementation handles stdio framing, initialize, notifications, tool listing, tool calls, unknown-method errors, and schema conversion with focused Go coverage.

Validation I ran on head a6e82a9971a67311998aa2eb446f6876deac8129:

• bun install --frozen-lockfile
• bun run typecheck
• bun test ./tests --timeout 15000 — 291 pass / 0 fail
• bun run build
• bun run smoke:build
• bun run smoke:go
• go test ./internal/cli ./internal/mcp ./internal/tools
• go test -count=1 ./...
• git diff --check origin/main..HEAD

I also smoke-tested the built zero.exe serve --mcp path directly over MCP stdio framing:

• default mode listed only glob, grep, list_directory, and read_file
• default mode did not expose write_file and returned an error for a write_file call
• --allow-unsafe-tools exposed write_file and emitted the unsafe-tools warning on stderr
• zero serve --help documents --mcp, --cwd, and --allow-unsafe-tools

GitHub checks are green, including ubuntu/macos/windows Smoke, Performance Smoke, Zero Review, and CodeRabbit.

No blockers from me.