Add token auth, new tools, and bug fixes - #1
Conversation
- Add Personal Access Token authentication (--auth-token/--user-id) - Add --no-verify-ssl flag for self-signed certificates - Add send_direct_message tool - Add delete_message tool - Add get_unread tool using subscriptions.get API - Add send_file tool with @username auto-resolution via im.create - Add DM listing to list_all_rooms - Fix timestamp parsing (ISO string instead of $date object) - Fix get_channel_messages to support channels/groups/im with fallback - Include msgId in message output for delete operations - Return msgId and roomId from send functions
7e64e1c to
f464036
Compare
- Add download_attachment tool to download message attachments to local temp directory, enabling image viewing via Claude Code's Read tool - Update get_channel_messages and get_unread to display attachment info with file name, type, and usage hint
|
is this MCP required to access rocketchat as admin or can i enable MCP operations as an normal chat user? |
RocketChat puts image captions and similar inline text in attachments[].description. get_channel_messages and get_unread previously only printed file names from files[], so any caption attached to an image went silently missing. Print a 💬 line per non-empty description before the file marker.
…ity improvements - get_channel_messages: add offset parameter for paging through history; accept room name as well as room ID (resolved via rooms.info, cached) - add search_messages tool (chat.search) for keyword search within a room - reuse a persistent httpx.AsyncClient (connection pooling) instead of creating a new client per request - cache the resolved channels/groups/im messages endpoint per room to avoid repeated endpoint probing - surface real error categories: 401/network errors are no longer reported as 'room not found'; fail fast on auth/transport errors instead of probing remaining endpoints - get_unread: report per-room fetch failures instead of silently returning empty content; harden message formatting against null fields - support credentials via ROCKETCHAT_SERVER_URL / ROCKETCHAT_AUTH_TOKEN / ROCKETCHAT_USER_ID environment variables (keeps the token out of process arguments) - add an orphan watchdog: the server exits when its MCP client dies (POSIX; interval via ROCKETCHAT_WATCHDOG_INTERVAL, default 60s) - rotate the log file (1 MB cap) and gitignore rotated logs - refuse to start if username/password login fails instead of running with invalid credentials - remove list_channels: fully covered by list_all_rooms (same channels.list endpoint, same fields)
|
@millerchou looks like for 10 month nobody has even commited, not sure if this project is even alive. maybe woth an fork with active development work (pressing the fork button ;) |
|
just saw i forked an merged your PR 3 month ago... |
|
Hey @qvest-ssels 👋 Admin vs normal user: you don't need an admin account for the core operations. A regular chat user — ideally via a Personal Access Token ( Only two tools hit workspace-wide "list everything" endpoints that a normal user can't call by default:
To use those without full admin, grant your bot's role the matching permission under Admin → Permissions ( Btw — you actually merged my PR back in April 🙂 but that was an older snapshot. Since then the branch added message search, pagination, room-name resolution, image-caption display, plus reliability/security fixes. Latest is on |
- name rocketchat-mcp, fill metadata, relax requires-python to >=3.10 - add hatchling build-system + console_scripts entry (rocketchat:main) - wrap __main__ block into main() (with global rocket_client)
|
Thanks for the reply, awesome work and i will pull it into my fork. (BTW i speak/understand about 50 words Chinese, my kids are half Chinese, living in Germany). |
There was a problem hiding this comment.
Pull request overview
This PR evolves the Rocket.Chat MCP server into a more production-ready package by adding token-based authentication, expanding the available MCP tools (DMs, file upload/download, unread checks, search, delete), and improving reliability/packaging for distribution.
Changes:
- Add Personal Access Token auth (with optional
--no-verify-ssl) and improve networking/logging reliability (persistent client, log rotation, orphan watchdog). - Add new MCP tools (
send_direct_message,send_file,download_attachment,get_unread,search_messages,delete_message) and enhance message formatting/output (includemsgId/ paging viaoffset). - Package/registry/publishing updates (project rename, metadata, licensing/NOTICE, MCP registry config, publish workflow).
Reviewed changes
Copilot reviewed 8 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
uv.lock |
Lowers required Python version and updates lock entries accordingly. |
server.json |
Adds MCP server registry metadata and required env vars for token auth. |
rocketchat.py |
Core: token auth + SSL verify toggle, new tools, message formatting, caching/pooling, watchdog, and CLI changes. |
README.md |
Updates documentation for new tools, auth modes, and usage patterns (uvx + env vars). |
pyproject.toml |
Renames/metadata for PyPI distribution, adds script entrypoint, and hatch build config. |
NOTICE |
Documents fork provenance and licensing boundary. |
LICENSE |
Adds MIT license for modifications in this fork. |
glama.json |
Adds Glama MCP registry metadata. |
.gitignore |
Ignores rotated log files (rocketchat_mcp.log*). |
.github/workflows/publish.yml |
Adds release-time publishing to PyPI + MCP registry. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # RocketChat file download URL | ||
| download_url = f"{rocket_client.server_url}/file-upload/{file_id}/{file_name}" | ||
| main_logger.info(f"Downloading: {download_url}") |
| resp.raise_for_status() | ||
|
|
||
| # save to the temp dir | ||
| save_path = os.path.join(tempfile.gettempdir(), f"rc_{file_id}_{file_name}") |
| # @username -> resolve to a room ID via im.create | ||
| room_id = channel | ||
| if channel.startswith("@"): | ||
| username = channel[1:] | ||
| im_result = await rocket_client.async_request( | ||
| "POST", "im.create", json_data={"username": username} | ||
| ) | ||
| if im_result.get('success') and 'room' in im_result: | ||
| room_id = im_result['room']['_id'] | ||
| else: | ||
| return f"Failed to resolve DM room for {channel}" | ||
|
|
||
| url = f"{rocket_client.server_url}/api/v1/rooms.upload/{room_id}" |
| watchdog_interval = float(os.getenv("ROCKETCHAT_WATCHDOG_INTERVAL", "60")) | ||
| start_orphan_watchdog(watchdog_interval) |
Summary
--auth-token/--user-id) as an alternative to username/password login--no-verify-sslflag for environments with self-signed certificates (default: SSL verification enabled)send_direct_messagetool for sending DMsdelete_messagetool with roomId + msgIdget_unreadtool usingsubscriptions.getAPI for efficient unread message checkingsend_filetool with@usernameauto-resolution to room ID viaim.createlist_all_rooms$datenested object)get_channel_messagesto support channels, groups, and DMs with endpoint fallbackmsgIdin message output for subsequent delete operationsmsgIdandroomIdfrom send functionsMotivation
While using this MCP server in production, I encountered several issues and missing features that this PR addresses. The original server only supported username/password auth and lacked tools for common operations like sending DMs, deleting messages, uploading files, and checking unread messages efficiently.