Merge pull request #48 from CodeAnt-AI/pranav/mcp-read-only-fixes

Fix MCP server concurrency, login, and oversized results (0.5.10)

Author: pranavcodeant

.claude-plugin/marketplace.json

@@ -6,19 +6,19 @@
   },
   "metadata": {
     "description": "CodeAnt AI CLI and MCP server — org-wide secret triage, cross-repo SAST/SCA findings, on-demand scans, and local PR review inside Claude.",
-    "version": "0.4.14"
+    "version": "0.5.10"
   },
   "plugins": [
     {
       "name": "codeant",
-      "source": "./.",
-      "description": "Drive CodeAnt AI from inside Claude Code via the CodeAnt MCP server. Read-only by default; write tools (trigger scan, resolve PR thread) gated behind CODEANT_READ_ONLY=0.",
-      "version": "0.4.14",
+      "source": "./",
+      "description": "Drive CodeAnt AI from inside Claude Code via the CodeAnt MCP server. Read-only by default; write tools (trigger scan, resolve PR thread, write API requests) gated behind CODEANT_READ_ONLY=0.",
+      "version": "0.5.10",
       "author": {
         "name": "CodeAnt AI",
         "email": "support@codeant.ai"
       },
-      "homepage": "https://docs.codeant.ai/cli/claude-code-integration",
+      "homepage": "https://docs.codeant.ai/cli/mcp-server",
       "license": "MIT",
       "keywords": [
         "code-review",

.claude-plugin/plugin.json

@@ -1,13 +1,13 @@
 {
   "name": "codeant",
-  "version": "0.4.14",
+  "version": "0.5.10",
   "description": "CodeAnt AI MCP server inside Claude Code — org-wide secret triage, cross-repo SAST/SCA findings, on-demand scans, and local PR review.",
   "author": {
     "name": "CodeAnt AI",
     "email": "support@codeant.ai"
   },
-  "homepage": "https://docs.codeant.ai/cli/claude-code-integration",
-  "documentation": "https://docs.codeant.ai/cli/claude-code-integration",
+  "homepage": "https://docs.codeant.ai/cli/mcp-server",
+  "documentation": "https://docs.codeant.ai/cli/mcp-server",
   "license": "MIT",
   "keywords": [
     "code-review",

changelog.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.5.10] - 03/10/2026
+- MCP: parallel `codeant_scans_results` calls no longer swallow other tool responses, leak findings onto the protocol stream, or hang the server
+- MCP: `codeant_login` returns the sign-in link right away and finishes in the background (call it again to confirm); a missing browser launcher no longer crashes the server
+- MCP: the saved token is read on every request, so `codeant login` / `codeant logout` in a terminal take effect without restarting the server
+- MCP: `codeant_review_local` reports failures (for example, no git repository) as errors instead of an empty issue list
+- MCP: smaller results — compact JSON, slim and paged `codeant_scans_repos`, `codeant_pentest_history`, and cloud scan history, paged CSPM findings without compliance mappings, smaller default page sizes, and a size limit (`CODEANT_MCP_MAX_RESULT_CHARS`, default 80000) that refuses oversized results with a hint
+- MCP: the server sends instructions that tell agents how to discover, page, and recover authentication (including `force: true` when a configured token is rejected)
+- MCP: concurrent `codeant_login` calls share one sign-in; `codeant_cloud_scan_history` pages with `offset`
+- MCP: removed pull request tool parameters that no provider applied (`defaultBranch`, `codeant_pr_comments` `addressed`, `codeant_comments_search` `includeAddressed` and `createdAfter`) and corrected the `codeant_pr_get`, `codeant_pr_comments`, `codeant_comments_search`, and `codeant_api_get` descriptions
+- MCPB: added Dashboard URL and Disable telemetry settings, and listed `codeant_scans_overrides`
+- The Azure DevOps "org URL not found" error now names `AZURE_DEVOPS_ORG_URL` instead of a command that does not exist
+
 ## [0.5.9] - 02/10/2026
 - Added `duplicate_code` to `scans results` / `findings repo`
 - Dismissed and false-positive flags are kept on IaC and dead-code findings, and shown as `metadata.dismissed` / `metadata.false_positive`

mcp.md

@@ -11,7 +11,7 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | Name | Read/Write | What it does |
 |------|------------|--------------|
 | `codeant_scans_orgs` | read | List authenticated CodeAnt orgs. |
-| `codeant_scans_repos` | read | List repos in an org. |
+| `codeant_scans_repos` | read | List repos in an org (slim records, paged: `search`, `limit`, `offset`, `full`). |
 | `codeant_scans_history` | read | Recent scan runs for a repo. |
 | `codeant_scans_get` | read | Severity/category summary for one scan. |
 | `codeant_scans_results` | read | Full findings (SAST, SCA, secrets, IaC, …) for one scan. |
@@ -20,18 +20,20 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
 | `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |
 | `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos (paged: `limit`, `offset`, `all`). |
-| `codeant_cloud_scan_history` | read | AWS/Azure/GCP CSPM, VM, or container scan history. |
-| `codeant_cloud_findings_list` | read | Findings for one CSPM, VM, or container scan (VM/container paged: `limit`, `offset`, `all`). |
+| `codeant_cloud_scan_history` | read | AWS/Azure/GCP CSPM, VM, or container scan history (newest first, 10 per provider by default and up to 200, paged with `limit`/`offset`, without per-service rollups unless `full`). |
+| `codeant_cloud_findings_list` | read | Findings for one CSPM, VM, or container scan (paged: `limit`, `offset`, `all`; compliance mappings only with `full`). |
 | `codeant_cloud_finding_get` | read | Full detail for one cloud finding UID. |
-| `codeant_pentest_history` | read | Pentest engagement history. |
+| `codeant_pentest_history` | read | Pentest engagement history (paged: `limit`, `offset`, `full`). |
 | `codeant_pentest_issues` | read | All available issues for a pentest engagement. |
 | `codeant_pentest_report` | read | Full pentest customer report. |
 | `codeant_api_get` | read | Authenticated GET request to any relative CodeAnt app API path, with exact org/provider context. |
 | `codeant_pr_list` | read | List PRs/MRs across GitHub, GitLab, Bitbucket, Azure DevOps. |
 | `codeant_pr_get` | read | Detail for a PR/MR. |
 | `codeant_pr_comments` | read | Comments on a PR, filtered. |
 | `codeant_comments_search` | read | Free-text search across CodeAnt review comments. |
-| `codeant_review_local` | read | Run a CodeAnt review on local working-copy changes. |
+| `codeant_review_local` | read | Run a CodeAnt review on local working-copy changes in the server's working directory. |
+| `codeant_login` | auth | Start browser sign-in; returns the sign-in link immediately. Call again to confirm. |
+| `codeant_logout` | auth | Revoke and clear the saved token (shared with the CLI). |
 | `codeant_scans_start` | **write** | Trigger a new scan. Gated. |
 | `codeant_pr_resolve` | **write** | Resolve a PR conversation thread. Gated. |
 | `codeant_api_request` | **write** | Authenticated POST/PUT/PATCH/DELETE request to a relative CodeAnt app API path, with exact org/provider context. Gated. |
@@ -40,17 +42,24 @@ Write tools are only registered when `CODEANT_READ_ONLY=0`. Default = read-only.
 
 For complete finding coverage, examples, tenant/provider selection, and response details, see the [CodeAnt findings documentation](https://docs.codeant.ai/cli/findings).
 
-Every tool carries MCP annotations (`title`, `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so the client can decide whether to auto-approve calls.
+Every tool carries MCP annotations (`title`, `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so the client can decide whether to auto-approve calls. The server also sends `instructions` (discovery order, paging, auth recovery) in its `initialize` result.
+
+Results are compact JSON. Any result over `CODEANT_MCP_MAX_RESULT_CHARS` characters is refused with an error and a narrowing hint; [src/mcp/shape.js](src/mcp/shape.js) holds the MCP-only projections and page defaults. CLI commands keep their full output.
+
+`codeant_login` runs sign-in in the background: the first call returns `{ status: "pending", loginUrl, browserOpened }`, and the next call returns `{ status: "success" }` once the user finishes. The token is read from `~/.codeant/config.json` on every request, so CLI logins and logouts apply to a running server.
 
 ## Configuration (env vars)
 
 | Var | Purpose | Default |
 |-----|---------|---------|
-| `CODEANT_API_TOKEN` | API token (CodeAnt account → settings → API). Required. | — |
-| `CODEANT_API_URL` | API base URL. Override for self-hosted. | `https://api.codeant.ai` |
-| `CODEANT_READ_ONLY` | `1` to hide write tools, `0` to expose them. | `1` |
+| `CODEANT_API_TOKEN` | API token. Optional: without it the server uses the token saved by `codeant login` or `codeant_login`. | — |
+| `CODEANT_API_URL` | API base URL. Override for self-hosted. | `https://service.codeant.ai` |
+| `CODEANT_DASHBOARD_URL` | Web app URL used by `codeant_login`. Needed on self-hosted base URLs. | detected |
+| `CODEANT_READ_ONLY` | `0` or `false` exposes write tools; anything else hides them. | read-only |
+| `CODEANT_TELEMETRY_DISABLED` | `1` or `true` stops usage events (PostHog, tied to the API token). | enabled |
+| `CODEANT_MCP_MAX_RESULT_CHARS` | Largest tool result, in characters, before the server refuses it with a hint. | `80000` |
 
-The CLI also reads these from `~/.codeant/config.json` when not set in env. For MCP usage prefer env — it keeps per-client config explicit.
+The token, base URL, and dashboard URL fall back to `~/.codeant/config.json` when not set in env. PR tools also need an SCM token (`GITHUB_TOKEN`, `GITLAB_TOKEN`, `BITBUCKET_TOKEN`, `AZURE_DEVOPS_TOKEN`) and, for Azure DevOps, `AZURE_DEVOPS_ORG_URL`.
 
 ---
 
@@ -109,10 +118,13 @@ npm run mcpb:build
 open -a Claude dist/codeant.mcpb
 ```
 
-Claude pops an install dialog asking for the `user_config` fields:
-- **CodeAnt API token** (sensitive, required)
-- **API base URL** (defaults to `https://api.codeant.ai`)
+Claude pops an install dialog asking for the `user_config` fields (all optional):
+- **CodeAnt API token** (sensitive; leave blank and call `codeant_login` instead)
+- **API base URL** (defaults to `https://api.codeant.ai`, which the CLI maps to `https://service.codeant.ai`)
+- **Dashboard URL** (self-hosted only; used by `codeant_login`)
 - **Read-only mode** (defaults to on)
+- **Disable telemetry** (defaults to off)
+- SCM tokens and self-hosted SCM URLs for the PR tools
 
 After install, manage it in **Settings → Connectors**.
 
@@ -162,7 +174,7 @@ cd dist/mcpb-stage
   '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 1) | node server/index.js
 ```
 
-Expect 23 tools in the `tools/list` response (or 26 if `CODEANT_READ_ONLY=0`).
+Expect 24 tools in the `tools/list` response (or 27 if `CODEANT_READ_ONLY=0`). `tests/mcp/server.test.js` checks that this list matches the manifest's `tools`.
 
 ### Bumping the version
 
@@ -191,9 +203,9 @@ CodeAnt's MCP server uses stdio + a packaged bundle, so the submission route is
 
 Reviewer notes worth preparing:
 
-- **Auth model.** CodeAnt uses a user-scoped API token entered into `user_config.api_token`. The token never leaves the user's machine — the bundle talks to `api.codeant.ai` (or the user's self-hosted URL) directly. No third-party OAuth flow needed.
+- **Auth model.** Users sign in with the `codeant_login` tool (browser sign-in, token saved to `~/.codeant/config.json`) or paste a token into `user_config.api_token`. The token is stored only on the user's machine (`~/.codeant/config.json`) and is sent only to the CodeAnt API (or the user's self-hosted URL) as a Bearer token — never to any third party. No third-party OAuth flow needed.
 - **Sandbox creds.** Email support@codeant.ai for a reviewer sandbox token; paste it into the submission form's reviewer-notes field along with an org slug that has scans + PRs to browse.
-- **Write tools.** Gated behind `user_config.read_only` (defaults to on). Reviewers can toggle off to test `codeant_scans_start` / `codeant_pr_resolve`.
+- **Write tools.** Gated behind `user_config.read_only` (defaults to on). Reviewers can toggle off to test `codeant_scans_start` / `codeant_pr_resolve` / `codeant_api_request`.
 
 ---
 
@@ -204,5 +216,8 @@ Reviewer notes worth preparing:
 | Server fails to start in Claude Desktop | `~/Library/Logs/Claude/mcp-server-codeant.log` |
 | Tool calls return errors | Same log — server stderr is captured there. |
 | Tool not listed at all | Check `CODEANT_READ_ONLY` — write tools are hidden when set to `1`. |
-| Auth errors on every tool | Confirm `CODEANT_API_TOKEN` is set in the MCP env (not just in `~/.codeant/config.json`). |
+| Auth errors on every tool | Call `codeant_login`, or run `codeant login` in a terminal; the server reads `~/.codeant/config.json` on every request. An explicit `CODEANT_API_TOKEN` in the MCP env takes precedence, so check it is current. |
+| `codeant_login` fails on a self-hosted instance | Set `CODEANT_DASHBOARD_URL` (or the MCPB **Dashboard URL** setting, or `codeant set-dashboard-url`). |
+| A tool returns "Result too large" | Follow the hint (smaller `limit`, filters, `fields`), or raise `CODEANT_MCP_MAX_RESULT_CHARS` if your client accepts larger results. |
+| `codeant_review_local` returns "Could not find a .git directory" | The client started the server outside a git repository (Claude Desktop does). Use a project-scoped client such as Claude Code. |
 | MCPB install dialog never appears | Open `.mcpb` with `open -a Claude dist/codeant.mcpb` to force the desktop app to handle it. |

mcpb/manifest.json

@@ -4,7 +4,7 @@
   "display_name": "CodeAnt AI",
   "version": "0.5.3",
   "description": "Drive CodeAnt AI security scans and code review from Claude — org-wide secret triage, cross-repo SAST/SCA findings, on-demand scans, and local PR review.",
-  "long_description": "CodeAnt AI inside Claude. Ask things like \"show my highest-priority Hotlist findings\", \"list AWS cloud findings\", \"show this pentest report\", or \"review my staged changes\" — Claude calls the CodeAnt API directly via this MCP server.\n\nIncludes 23 read-only tools, including repository, Hotlist, cloud security, anti-pattern, and pentest findings plus an authenticated GET escape hatch for new APIs, and 3 opt-in write tools gated behind a setting.\n\nRequires a CodeAnt account. Sign up at https://codeant.ai. To authenticate, call the `codeant_login` tool — it opens the CodeAnt sign-in page in your browser and saves the token automatically.\n\nCollects anonymous usage telemetry via PostHog by default; set CODEANT_TELEMETRY_DISABLED=1 to opt out.",
+  "long_description": "CodeAnt AI inside Claude. Ask things like \"show my highest-priority Hotlist findings\", \"list AWS cloud findings\", \"show this pentest report\", or \"review my staged changes\" — Claude calls the CodeAnt API directly via this MCP server.\n\nIncludes 22 read-only tools, covering repository, Hotlist, cloud security, anti-pattern, and pentest findings plus an authenticated GET escape hatch for new APIs, 2 sign-in tools, and 3 opt-in write tools gated behind a setting.\n\nRequires a CodeAnt account. Sign up at https://codeant.ai. To authenticate, call the `codeant_login` tool — it returns a sign-in link (and opens it in your browser when it can), then saves the token once you finish.\n\nCollects usage telemetry via PostHog by default (events are tied to your CodeAnt token); turn on \"Disable telemetry\" in the extension settings to opt out.",
   "author": {
     "name": "CodeAnt AI",
     "email": "support@codeant.ai",
@@ -36,7 +36,9 @@
       "env": {
         "CODEANT_API_TOKEN": "${user_config.api_token}",
         "CODEANT_API_URL": "${user_config.base_url}",
+        "CODEANT_DASHBOARD_URL": "${user_config.dashboard_url}",
         "CODEANT_READ_ONLY": "${user_config.read_only}",
+        "CODEANT_TELEMETRY_DISABLED": "${user_config.telemetry_disabled}",
         "GITHUB_TOKEN": "${user_config.github_token}",
         "GITLAB_TOKEN": "${user_config.gitlab_token}",
         "BITBUCKET_TOKEN": "${user_config.bitbucket_token}",
@@ -61,6 +63,7 @@
     { "name": "codeant_scans_get", "description": "Get summary metadata for a single scan (no findings)." },
     { "name": "codeant_scans_results", "description": "Fetch full findings (SAST, SCA, secrets, IaC, etc.) for a scan." },
     { "name": "codeant_scans_dismissed", "description": "List dismissed alerts for a repository." },
+    { "name": "codeant_scans_overrides", "description": "List user false-positive, confidence, and severity overrides for a repository." },
     { "name": "codeant_hotlist_list", "description": "List prioritized organization-wide Hotlist findings with stable IDs." },
     { "name": "codeant_hotlist_get", "description": "Fetch one complete Hotlist finding by its stable ID." },
     { "name": "codeant_findings_antipatterns", "description": "List anti-pattern findings across selected or all organization repositories." },
@@ -76,7 +79,7 @@
     { "name": "codeant_pr_comments", "description": "List comments on a PR/MR with optional filters." },
     { "name": "codeant_comments_search", "description": "Search across CodeAnt review comments by free-text query." },
     { "name": "codeant_review_local", "description": "Run a CodeAnt AI review on local working-copy changes." },
-    { "name": "codeant_login", "description": "Open app.codeant.ai in the browser and poll until the user completes sign-in; saves the resulting API token." },
+    { "name": "codeant_login", "description": "Start browser sign-in to CodeAnt AI and return the sign-in link; saves the API token once sign-in completes." },
     { "name": "codeant_logout", "description": "Clear the saved API token and sign out of CodeAnt AI." },
     { "name": "codeant_scans_start", "description": "Trigger a new scan run (write — gated behind read_only=false)." },
     { "name": "codeant_pr_resolve", "description": "Resolve a PR conversation thread (write — gated behind read_only=false)." },
@@ -98,13 +101,27 @@
       "required": false,
       "default": "https://api.codeant.ai"
     },
+    "dashboard_url": {
+      "type": "string",
+      "title": "Dashboard URL",
+      "description": "Self-hosted only: the URL of your CodeAnt web app, used by codeant_login. Leave blank to detect it from the API base URL.",
+      "required": false,
+      "default": ""
+    },
     "read_only": {
       "type": "boolean",
       "title": "Read-only mode",
-      "description": "When enabled, write tools (trigger scan, resolve PR thread) are hidden. Recommended.",
+      "description": "When enabled, write tools (trigger scan, resolve PR thread, write API requests) are hidden. Recommended.",
       "required": false,
       "default": true
     },
+    "telemetry_disabled": {
+      "type": "boolean",
+      "title": "Disable telemetry",
+      "description": "Stop sending usage events (PostHog) from this extension.",
+      "required": false,
+      "default": false
+    },
     "github_token": {
       "type": "string",
       "title": "GitHub token",
@@ -140,7 +157,7 @@
     "github_api_url": {
       "type": "string",
       "title": "GitHub API URL",
-      "description": "Override for GitHub Enterprise Server (e.g. https://github.example.com/api/v3). Leave blank for GitHub.com.",
+      "description": "GitHub Enterprise Server only: the server root, e.g. https://github.example.com (/api/v3 is added automatically). Leave blank for GitHub.com.",
       "required": false,
       "default": ""
     },

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "Code review CLI tool",
   "type": "module",
   "repository": {