Skip to content

PR-2A: real MCP client initialize on :8002 - #71

Open
jwalin-shah wants to merge 4 commits into
local-actuator/pr1-mcpfrom
local-actuator/pr2a-mcp-transport
Open

jwalin-shah wants to merge 4 commits into
local-actuator/pr1-mcpfrom
local-actuator/pr2a-mcp-transport

Conversation

@jwalin-shah

@jwalin-shah jwalin-shah commented Sep 6, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • Repair FastMCP Streamable HTTP so a standards-compliant client can initialize against 127.0.0.1:8002.
  • Zero authority change: seven frozen tools, spawn=0, Inbox still executes nothing, confirm remains intent.
  • Official MCP Python client test: initialize → tools/list → resolve.

Test plan

  • INBOX_TEST_MODE=1 uv run pytest tests/test_mcp_control_plane.py -q --no-cov (21 passed @ fd33b93)
  • Official MCP client against live 127.0.0.1:8002: initialize → tools/list → resolve (spawn_flag=0)
  • ChatGPT tunnel probes: server/discover 200 without Bearer; /.well-known/oauth-protected-resource 404 (Auth=None)
  • LaunchAgent com.inbox.mcp-control-plane serving committed tree fd33b93 with TRUST_LOOPBACK=1
  • LA-04 human canary: ChatGPT DRAFT app resolve + ingest-only submit_work (see inbox#75)
  • Do not merge to main in this pass
  • Do not enable INBOX_CONTROL_PLANE_SPAWN

Follow-on (roadmap)

  • LA-04 canary (inbox#75)
  • LA-03 PR-2B Bridge ingest (inbox#74)

Made with Cursor

Serve FastMCP's native streamable_http_app with session_manager lifespan instead of nesting it under Mount("/mcp"), which 307'd POST /mcp and never started the task group. Authority semantics stay ingest-only.

Co-authored-by: Cursor <cursoragent@cursor.com>
Tunnel validators probe server/discover without our Bearer and cannot paste
connector headers into Apps. Advertise ingest-only identity on discover,
optionally trust 127.0.0.1 when INBOX_CONTROL_PLANE_TRUST_LOOPBACK=1, and keep
/.well-known oauth cards absent so Auth=None create matches LifeOps. Spawn stays 0.

Co-authored-by: Cursor <cursoragent@cursor.com>
Thin allowlisted bridge_work_client calls native `bridge ingest` only;
confirm and model credentials still cannot mint leases or spawn.

Co-authored-by: Cursor <cursoragent@cursor.com>
…gest

LA-03: PR-2B thin submit_work → bridge ingest (no Inbox execution)
@jwalin-shah

Copy link
Copy Markdown
Owner Author

Triage KEEP: umbrella PR-2A; tip includes merged #77 (b5acc06). Live LaunchAgent on that tip. Do not merge to main until captain opens main promotion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant