Add MCP server integration to LiveReview by RijulTP · Pull Request #58 · HexmosTech/LiveReview

RijulTP · 2026-05-30T16:19:16Z

This PR adds MCP server functionality to Livereview

LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)

LiveReview Pre-Commit Check: skipped (iter:2, coverage:0%)

LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)

LiveReview Pre-Commit Check: ran (iter:2, coverage:80%)

LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

…equest structure LiveReview Pre-Commit Check: ran (iter:6, coverage:82%)

…to feat/mcp-server

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

…for autonomous execution LiveReview Pre-Commit Check: ran (iter:2, coverage:0%)

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

…cp-server

…leanup OpenAPI documentation parameters LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

…to feat/mcp-server

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

…to feat/mcp-server

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

…to feat/mcp-server

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

…cp-server

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

…to feat/mcp-server

RijulTP · 2026-06-15T12:49:54Z

    runs-on: ubuntu-latest
+
+    env:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}


Severity: warning

Using secrets.DATABASE_URL directly in env block can expose the full URL in logs if not handled carefully, especially if the URL contains credentials.

Suggestions:

Ensure GitHub Actions is configured to mask secrets in logs.

Consider passing sensitive parts of the URL (e.g., password) as separate variables and constructing the URL in the script, if masking is insufficient.

RijulTP · 2026-06-15T12:49:55Z

+
+      - name: Start MCP server
+        run: |
+          nohup ./livereview api > server.log 2>&1 &


Severity: warning

Using nohup and & can make process management difficult within CI, especially for robust error handling.

Suggestions:

Consider using a dedicated process manager or a more robust start-server-and-wait action if available for better control and error propagation.

Ensure server.pid is reliably created and cleaned up in all scenarios.

RijulTP · 2026-06-15T12:49:57Z

+      - name: Wait for server startup
+        run: |
+          for i in {1..30}; do
+            response=$(curl -s http://localhost:8888/health || true)


Severity: warning

The curl command uses || true which can mask actual connection errors, making it harder to debug why the server isn"t starting.

Suggestions:

Remove || true to allow curl errors to propagate, or log curl"s exit code for better diagnostics.

Add a curl -f flag to fail silently on HTTP errors, but still allow network errors to show.

RijulTP · 2026-06-15T12:49:59Z

+          for i in {1..30}; do
+            response=$(curl -s http://localhost:8888/health || true)
+
+            if echo "$response" | grep -q '"status":"healthy"\|"status": "healthy"'; then


Severity: info

The health check string "status":"healthy"\|"status": "healthy" handles two variations. Standardize the health check response format to avoid such regex complexity.

Suggestions:

Ensure the /health endpoint consistently returns a single, predictable JSON format.

Update the application's health check endpoint to always return `"status":"healthy"

RijulTP · 2026-06-15T12:50:00Z

@@ -1,5 +1,5 @@
 .PHONY: build run-review run-review-verbose test clean develop develop-reflex river-deps river-install river-migrate river-setup river-ui-install river-ui db-flip version version-bump version-patch version-minor version-major version-bump-dirty version-patch-dirty version-minor-dirty version-major-dirty version-bump-dry version-patch-dry version-minor-dry version-major-dry build-versioned docker-build docker-build-push docker-build-dry docker-interactive docker-interactive-push docker-interactive-dry docker-build docker-build-push docker-build-versioned docker-build-push-versioned docker-build-dry docker-build-push-dry docker-multiarch docker-multiarch-push docker-multiarch-dry docker-interactive-multiarch docker-interactive-multiarch-push cplrops vendor-prompts-encrypt vendor-prompts-build vendor-prompts-rebuild vendor-docker-build vendor-docker-build-dry vendor-docker-build-push vendor-docker-multiarch-dry vendor-docker-multiarch-push run logrun api-with-migrations build-with-ui security-sbom security-sbom-cyclonedx security-sbom-spdx security-sbom-validate release-notes-init release-notes-check release-preflight release-gh niceurl niceurl2
-.PHONY: upload-secrets download-secrets list-secrets-files legacy-secrets-clear generate-spec


Severity: warning

Rename generate-spec to generate-openapi for consistency with OpenAPI specification terminology.

Suggestions:

Ensure all references to this target are updated.

RijulTP · 2026-06-15T12:50:02Z

 GOTEST=$(GOCMD) test
 BINARY_NAME=livereview
 REQUIRED_GO_VERSION=$(shell awk '/^go /{print $$2; exit}' go.mod)
+REQUIRED_GO_TOOLCHAIN_VER=$(shell echo $(REQUIRED_GO_VERSION) | awk -F. '{if (NF==2) print $$0".0"; else print $$0}')


Severity: info

This new variable REQUIRED_GO_TOOLCHAIN_VER explicitly extracts the full Go toolchain version. This is a good practice to ensure GOTOOLCHAIN uses a precise version (e.g., go1.21.0 instead of go1.21), which can prevent issues with minor version discrepancies or toolchain resolution.

Suggestions:

Ensure this variable is consistently used where a precise Go toolchain version is required.

RijulTP · 2026-06-15T12:50:03Z

 REQUIRED_GO_SERIES=$(shell echo $(REQUIRED_GO_VERSION) | awk -F. '{print $$1"."$$2}')
 GOVULNCHECK_VERSION=v1.1.4
-GOVULNCHECK_CMD=GOTOOLCHAIN=go$(REQUIRED_GO_VERSION) $(GOCMD) run -a golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
+GOVULNCHECK_CMD=GOTOOLCHAIN=go$(REQUIRED_GO_TOOLCHAIN_VER) $(GOCMD) run -a golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)


Severity: info

Using REQUIRED_GO_TOOLCHAIN_VER here ensures govulncheck is run with the exact specified Go toolchain, improving build reliability.

RijulTP · 2026-06-15T12:50:05Z

 	rm $(BINARY_NAME) || true
 	$(GOBUILD) -o $(BINARY_NAME)

+# Minimal CI build


Severity: info

This new build-ci target is a good addition for CI/CD pipelines. Skipping SKIP_TYPED_GEN=1 and using go build -tags=ci can significantly speed up CI builds by omitting non-essential steps like OpenAPI generation and enabling CI-specific build optimizations.

Suggestions:

Ensure the ci build tag is properly handled in the Go codebase for any CI-specific logic.

RijulTP · 2026-06-15T12:50:07Z

 	command -v dlv >/dev/null 2>&1 || { \
 		echo "Installing Delve with Go $(REQUIRED_GO_VERSION)..."; \
-		GOTOOLCHAIN=go$(REQUIRED_GO_VERSION) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \
+		GOTOOLCHAIN=go$(REQUIRED_GO_TOOLCHAIN_VER) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \


Severity: info

Using REQUIRED_GO_TOOLCHAIN_VER here ensures dlv is installed with the exact specified Go toolchain, improving consistency.

RijulTP · 2026-06-15T12:50:08Z

 	if ! go version -m "$$DLV_BIN_DIR/dlv" 2>/dev/null | grep -q "go$(REQUIRED_GO_SERIES)"; then \
 		echo "Rebuilding Delve with Go $(REQUIRED_GO_VERSION) for DWARFv5+ compatibility..."; \
-		GOTOOLCHAIN=go$(REQUIRED_GO_VERSION) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \
+		GOTOOLCHAIN=go$(REQUIRED_GO_TOOLCHAIN_VER) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \


Severity: info

Using REQUIRED_GO_TOOLCHAIN_VER here ensures dlv is rebuilt with the exact specified Go toolchain, improving consistency.

RijulTP · 2026-06-15T12:50:10Z

 	which air || go install github.com/air-verse/air@latest
 	DLV_BIN_DIR=$$(go env GOBIN); if [ -z "$$DLV_BIN_DIR" ]; then DLV_BIN_DIR="$$(go env GOPATH)/bin"; fi; PATH="$$DLV_BIN_DIR:$$PATH" air

+


Severity: info

This run-skip-typed target is useful for local development, allowing developers to bypass potentially slow OpenAPI schema generation. This improves developer experience.

Suggestions:

Document this target in the README for local development workflows.

RijulTP · 2026-06-15T12:50:11Z

 	command -v dlv >/dev/null 2>&1 || { \
 		echo "Installing Delve with Go $(REQUIRED_GO_VERSION)..."; \
-		GOTOOLCHAIN=go$(REQUIRED_GO_VERSION) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \
+		GOTOOLCHAIN=go$(REQUIRED_GO_TOOLCHAIN_VER) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \


Severity: info

Using REQUIRED_GO_TOOLCHAIN_VER here ensures dlv is installed with the exact specified Go toolchain, improving consistency.

RijulTP · 2026-06-15T12:50:13Z

 	if ! go version -m "$$DLV_BIN_DIR/dlv" 2>/dev/null | grep -q "go$(REQUIRED_GO_SERIES)"; then \
 		echo "Rebuilding Delve with Go $(REQUIRED_GO_VERSION) for DWARFv5+ compatibility..."; \
-		GOTOOLCHAIN=go$(REQUIRED_GO_VERSION) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \
+		GOTOOLCHAIN=go$(REQUIRED_GO_TOOLCHAIN_VER) $(GOCMD) install github.com/go-delve/delve/cmd/dlv@latest; \


Severity: info

Using REQUIRED_GO_TOOLCHAIN_VER here ensures dlv is rebuilt with the exact specified Go toolchain, improving consistency.

RijulTP · 2026-06-15T12:50:15Z

 		exit 1; \
 	}
-	@ssh root@master-do 'PID=$$(netstat -tulpn | grep :6545 | awk '\''{print $$7}'\'' | cut -d/ -f1 | head -n 1); [ -n "$$PID" ] && kill -9 $$PID || true' || true
+	@ssh root@master "PID=\$$( netstat -tulpn | grep :6545 | awk '{print \$$7}' | cut -d/ -f1 | head -n 1); [ -n \"\$$PID\" ] && kill -9 \$$PID || true" || true


Severity: warning

The master-do host was changed to master. Ensure this reflects the correct and intended SSH target for the niceurl3 command.

Suggestions:

Verify root@master is the correct and accessible host.

RijulTP · 2026-06-15T12:50:17Z

 		-o ConnectTimeout=10 \
 		-o ConnectionAttempts=3 \
-		-R 6545:localhost:8081 root@master-do -N
+		-R 6545:localhost:8081 root@master -N


Severity: info

The master-do host was changed to master. Ensure this reflects the correct and intended SSH target for the `niceurl

RijulTP · 2026-06-15T12:50:18Z

 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+replace github.com/BrunoKrugel/echo-mcp => github.com/RijulTP/echo-mcp v0.0.0-20260515165653-fed35ce63af4


Severity: warning

Using a replace directive to point to a specific commit from a personal fork (RijulTP) for echo-mcp introduces a maintenance risk.

Suggestions:

Document the specific reason for this fork and replace directive (e.g., specific bug fix, unmerged feature).

Evaluate if the changes can be upstreamed to the original BrunoKrugel/echo-mcp repository to reduce long-term maintenance burden.

Consider the longevity and maintenance plan for this fork; relying on a personal fork can lead to issues if it's not actively maintained.

RijulTP · 2026-06-15T12:50:20Z

+				"message":  "AI Connectors listing",
+				"guidance": "Always offer to create an AI connector. You can create and configure AI connectors directly for the user.",
+				"link": map[string]string{
+					"url":   "https://livereview.hexmos.com/#/ai",


Severity: warning

This URL is hardcoded. Consider making it configurable via environment variables or a configuration service.

Suggestions:

Extract the base URL and path into configuration.

Use a URL builder that respects environment-specific settings.

RijulTP · 2026-06-15T12:50:22Z


 			manager := NewAPIKeyManager(db)
-			keyRecord, err := manager.ValidateAPIKey(apiKey)
+			keyRecord, _, err := manager.ValidateAPIKey(apiKey)


Severity: warning

The ValidateAPIKey signature changed to return a *models.User. Ensure all callers of this function are updated.

Suggestions:

Perform a global search for manager.ValidateAPIKey to confirm all usages are updated.

RijulTP · 2026-06-15T12:50:24Z

+				}
+
+				// Update last used timestamp (async to not slow down request)
+				go manager.UpdateLastUsed(keyRecord.ID)


Severity: warning

The goroutine for UpdateLastUsed does not handle potential errors. A failed update could lead to stale last_used_at timestamps.

Suggestions:

Add error logging within the goroutine to capture and report failures.

Consider using a background worker queue for such updates if reliability is critical.

RijulTP · 2026-06-15T12:50:26Z

+				go manager.UpdateLastUsed(keyRecord.ID)
+
+				// Set user and org context (same as APIKeyAuthMiddleware)
+				c.Set(string(auth.UserContextKey), user)


Severity: warning

This logic for setting user and organization context is duplicated from other authentication middlewares (e.g., APIKeyAuthMiddleware, auth.RequireAuth).

Suggestions:

Extract context setting into a shared helper function.

Pass a context object to next(c) instead of setting individual values.

RijulTP · 2026-06-15T12:50:27Z

+}
+
+// validateWithCloudSecret attempts to validate a JWT using CLOUD_JWT_SECRET without DB token checks
+// This is a copy of the function from auth/middleware.go to avoid circular dependencies


Severity: critical

Duplicating validateWithCloudSecret from auth/middleware.go to avoid circular dependencies indicates a potential architectural issue.

Suggestions:

Refactor the auth package to extract core JWT validation logic into a separate, dependency-free utility package.

Re-evaluate the module structure to eliminate circular dependencies without code duplication.

RijulTP · 2026-06-15T12:50:29Z

+	user := &models.User{}
+	if claims.UserID != 0 {
+		err = db.QueryRow(`
+			SELECT id, email, password_hash, created_at, updated_at


Severity: critical

The query selects password_hash. This field is sensitive and unnecessary for merely validating a token or setting user context.

Suggestions:

Remove password_hash from the SELECT clause.

Consider creating a UserContext struct with only necessary fields (ID, Email) to avoid retrieving sensitive data.

RijulTP · 2026-06-15T12:50:30Z

Severity: info

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

RijulTP and others added 30 commits May 10, 2026 20:22

Added mcp endpoint

6c1b298

LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)

Fixed validation errors in openapi spec

425d905

LiveReview Pre-Commit Check: skipped (iter:2, coverage:0%)

Fixed infinite server restart issue

bcfc1ec

LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)

Added API key based endpoint support, Fixed MCP auth issues

0329f4e

LiveReview Pre-Commit Check: ran (iter:2, coverage:80%)

Added echo-mcp to generate tools

d753573

LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)

fix:mcp context

bbe8eaf

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Added test files and more mcp tools

618d76a

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

feat: register MCP schemas for API endpoints and formalize CreatePATR…

15c2a1d

…equest structure LiveReview Pre-Commit Check: ran (iter:6, coverage:82%)

Merge branch 'feat/mcp-server' of github.com:HexmosTech/LiveReview in…

a674cfb

…to feat/mcp-server

fix: mcp review trigger

6f43665

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Updated testcases, and fixed validation issues for MCPs

f711f31

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

refactor: replace diff-review endpoints with local-instructions endpoint

3f884e6

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Pulled latest changes

08fc80f

Fixed the review testcase

a2b31b9

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

refactor: rename local review endpoint and update agent instructions …

ef5b708

…for autonomous execution LiveReview Pre-Commit Check: ran (iter:2, coverage:0%)

fix:openapi yaml

20ac087

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

Merge branch 'master' of github.com:HexmosTech/LiveReview into feat/m…

8192c06

…cp-server

feat: add request binding to review service, update dependency, and c…

ae14cdd

…leanup OpenAPI documentation parameters LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Added new tools, Testcases and local setup guide

ce1b841

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Merge branch 'feat/mcp-server' of github.com:HexmosTech/LiveReview in…

ae848dc

…to feat/mcp-server

feat: add AI connector reorder endpoint

6492643

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Merge branch 'feat/mcp-server' of github.com:HexmosTech/LiveReview in…

d496d9f

…to feat/mcp-server

Modified the testcase

d0cbb1e

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

refactor: integrate user retrieval into API key validation and update

5d0daba

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Merge branch 'feat/mcp-server' of github.com:HexmosTech/LiveReview in…

727cab4

…to feat/mcp-server

docs: wip: define security scoping guidelines

f95bc80

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Merge branch 'master' of github.com:HexmosTech/LiveReview into feat/m…

3627d1a

…cp-server

chore: update golang.org/x/time to v0.15.0

5cb6529

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Add MCP Context to API Responses

4265b6a

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Merge branch 'feat/mcp-server' of github.com:HexmosTech/LiveReview in…

ed8f66b

…to feat/mcp-server

RijulTP commented Jun 15, 2026

View reviewed changes

RijulTP added 6 commits June 15, 2026 19:11

Fixed duplicate functions

ef90dc4

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Pulled latest changes

52c5d5a

Updated gomod

05c9317

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

Modified the govulncheck workflow for improved go version detection

49cea97

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Fixing toolchain issue

05c329a

LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)

Fixed osv scanner issues

91f0ecb

LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)

RijulTP merged commit 64ff45b into master Jun 17, 2026
15 checks passed

		@@ -1,5 +1,5 @@
		.PHONY: build run-review run-review-verbose test clean develop develop-reflex river-deps river-install river-migrate river-setup river-ui-install river-ui db-flip version version-bump version-patch version-minor version-major version-bump-dirty version-patch-dirty version-minor-dirty version-major-dirty version-bump-dry version-patch-dry version-minor-dry version-major-dry build-versioned docker-build docker-build-push docker-build-dry docker-interactive docker-interactive-push docker-interactive-dry docker-build docker-build-push docker-build-versioned docker-build-push-versioned docker-build-dry docker-build-push-dry docker-multiarch docker-multiarch-push docker-multiarch-dry docker-interactive-multiarch docker-interactive-multiarch-push cplrops vendor-prompts-encrypt vendor-prompts-build vendor-prompts-rebuild vendor-docker-build vendor-docker-build-dry vendor-docker-build-push vendor-docker-multiarch-dry vendor-docker-multiarch-push run logrun api-with-migrations build-with-ui security-sbom security-sbom-cyclonedx security-sbom-spdx security-sbom-validate release-notes-init release-notes-check release-preflight release-gh niceurl niceurl2
		.PHONY: upload-secrets download-secrets list-secrets-files legacy-secrets-clear generate-spec

		which air \|\| go install github.com/air-verse/air@latest
		DLV_BIN_DIR=$$(go env GOBIN); if [ -z "$$DLV_BIN_DIR" ]; then DLV_BIN_DIR="$$(go env GOPATH)/bin"; fi; PATH="$$DLV_BIN_DIR:$$PATH" air

Conversation

RijulTP commented May 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

RijulTP commented Jun 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants