Repository navigation
feat(relay): MCP server for AI coding agents and an AI agents dashboard page - #7
Merged
Merged
Conversation
…rd page A coding agent can now run the whole webhook loop against the user's real local server with nothing installed: get a permanent URL for a port, fire a realistic signed provider webhook, read exactly what the handler answered, fix the code, replay. Relay - /mcp: MCP Streamable HTTP, stateless with JSON responses (official SDK 1.32 web-standard transport), running inside the Worker. Auth: agent token (Bearer dvc_...), any device token, or the session; 401 with WWW-Authenticate otherwise. Server instructions describe the loop. - Tools: list_webhook_urls, create_webhook_url (same port, same URL; the relay keeps only a public key until the extension adopts the channel), set_response_mode, send_test_event (Stripe, GitHub, OpenAI Standard Webhooks, ElevenLabs, Vapi, generic; signed like the provider when given the endpoint secret; delivered through full intake, returns the sync reply or waits for the answer), wait_for_webhook, get_event, list_events, replay_event (waits for the new answer). All owner-scoped. - Agent tokens: device kind "agent", excluded from the device cap, at most 10 per account. - rotate-key accepts device tokens, so the extension adopts channels created by an agent (also needed by the CLI). - Replay and owned-event reads move to event-store.ts, shared by the dashboard API and MCP. Provider samples and signers in test-events.ts, checked against Node's HMAC and the ElevenLabs SDK's verification. - "mcp" is a reserved path segment. Web: Dashboard > AI agents mints a token, shows it once with setup for Claude Code, Cursor, VS Code and Codex, lists and revokes tokens; agent tokens no longer appear under Devices. Docs: AI agents (MCP) page. Copy no longer mentions a CLI that has not shipped.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 56 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (24)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThis PR turns BridgeHook into an authenticated remote MCP server backed by the existing relay, extension delivery, sync, event-store, and replay flows, adds separately quota-managed agent tokens with a dashboard onboarding experience, and documents setup for major AI coding clients. Sequence diagram for an AI agent webhook debugging loopsequenceDiagram
participant Agent as AI coding agent
participant MCP as Relay MCP /mcp
participant DB as D1 event store
participant Extension as Chrome extension
participant Local as Local webhook server
Agent->>MCP: create_webhook_url(port)
MCP->>DB: Create or find owned channel
MCP-->>Agent: Permanent webhook URL
Extension->>MCP: Adopt channel with same port
Agent->>MCP: send_test_event(channel_id, provider, signing_secret)
MCP->>MCP: buildTestEvent(provider)
MCP->>DB: Store webhook event
MCP->>Extension: Queue delivery
Extension->>Local: Forward signed webhook
Local-->>Extension: Handler response
Extension->>DB: Store response status and body
MCP->>DB: waitForAnswer(event_id)
MCP-->>Agent: Event and real handler response
Agent->>MCP: replay_event(event_id)
MCP->>DB: queueReplay()
MCP->>Extension: Notify replay
Extension->>Local: Forward replay
Local-->>Extension: Fixed handler response
Extension->>DB: Store replay response
MCP-->>Agent: Replay result
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
… secret errors Review of PR #7: - Agent tokens only authenticate on /mcp. Elsewhere they are rejected, so they cannot run as uncapped devices (POST /api/channels) or rotate a channel's key out from under the user's extension and answer its sync requests. Real executors still count against the device cap. - send_test_event passes the forward path to intake explicitly, so a self-hosted relay without TUNNEL_DOMAIN no longer forwards to /<channelId>/path. - In sync mode send_test_event returns after wait_seconds instead of blocking for the channel's whole sync timeout. - A malformed OpenAI signing secret is a clear tool error, not a crash. - Dashboard and docs say agent tokens only work with the MCP server.
Review follow-ups on the MCP server: - replay_event runs checkReplay like the dashboard route, so a read-only account (ended trial, canceled plan) cannot queue replays through /mcp. - create_webhook_url applies `label` to an existing port's channel instead of dropping it. - send_test_event on a sync channel no longer leaves the delivery promise unobserved: it is settled, kept alive with waitUntil, and a relay refusal (allow-list 403, daily cap 429) is reported as an error rather than "still waiting". The race gives at least 2s so those refusals surface even at wait_seconds 0. - 504/502 sync replies carry X-BridgeHook-Event-Id like a delivered reply, so senders and the agent can look the event up. - The resolveReader docblock now says rotate-key accepts device tokens.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
BridgeHook becomes a remote MCP server so coding agents (Claude Code, Cursor, VS Code, Codex) can build and debug webhook handlers against the user's real local server, with nothing installed.
Relay
/mcp: Streamable HTTP, stateless, JSON responses (official MCP SDK 1.32 web-standard transport) inside the Worker. Auth via agent token (Bearer dvc_…), any device token, or session; otherwise 401 +WWW-Authenticate.list_webhook_urls,create_webhook_url(same port → same URL; relay keeps only a public key until the extension adopts the channel),set_response_mode,send_test_event(Stripe, GitHub, OpenAI Standard Webhooks, ElevenLabs, Vapi, generic; provider-exact signatures when given the endpoint secret; full intake; returns the sync reply or waits for the answer),wait_for_webhook,get_event,list_events,replay_event. All owner-scoped.agent, excluded from the device cap, max 10/account.rotate-keyaccepts device tokens (extension adopts agent-created channels; also needed by the CLI).event-store.ts(shared replay + owned-event reads),test-events.ts(samples + signers),mcpreserved path.Web: Dashboard › AI agents: create token (shown once) with setup for Claude Code, Cursor, VS Code, Codex; list/revoke; agent tokens hidden from Devices. Docs: AI agents (MCP) page. Copy no longer mentions an unreleased CLI.
Verification
constructEventalgorithm (verified from SDK source).stripe-signature; after the "fix" replay_event returns 200 verified; wait_for_webhook catches a real webhook with its answer; list tools work; sync Vapi tool call returns the handler's reply; another account's agent cannot read or send.pnpm -r typecheck,pnpm lint, web + docs builds; Worker bundle 700 KiB gzip (GitHub Actions cannot start: billing lock).No migration (agent kind is a value in the existing
devices.kindcolumn).Closes HAL-2417
Summary by Sourcery
Enable AI coding agents to build and debug local webhook handlers through an authenticated remote MCP server, with dashboard token management and provider-aware testing tools.
New Features:
Bug Fixes:
Enhancements:
Build:
Documentation:
Tests: