Update MCP coverage after Node SDK releases

[rgarcia]

Summary

• Run the MCP updater after each successful stable Node SDK npm publish; it can also be triggered manually.
• Use Pi to audit SDK methods and parameters against MCP tools and implement any missing user-facing coverage.
• Give Pi the API spec (openapi.yaml) as of the SDK release, plus a spec diff since the previous release. Pi updates tool, action, and input descriptions for changed spec text, adapting API-native wording rather than copying it.
• Split the workflow into two jobs:
  • Generate: gets no write credentials; the read-only spec token is revoked before Pi runs. After Pi runs, a runner-controlled step captures every change relative to the pre-agent commit, committed or not, and keeps only allowlisted paths (package.json, bun.lock, .ts/.tsx under src/, excluding generated bundles). It then cleans the checkout and validates that patch: SDK pin with no overrides, frozen install, bundle check, type check, tests, and the Redis recording check.
  • Publish: rebuilds the branch from SHAs recorded before Pi ran, applies the validated patch, re-checks the allowlist, rejects non-regular files, and only then mints a repository-scoped write token. It never runs repository code, bun, or Pi.
• Maintain one evergreen MCP PR without force-pushing. Stale releases are skipped. A merge conflict on the evergreen branch stops the job with recovery instructions.
• Pin every action to a commit SHA, and add credential-boundary regression tests to CI.

Validation

• actionlint passed. The 8 committed CI security tests pass, and CI is green on the latest commit.

• 25 local fixture tests passed across both updaters. They cover:

  • allowlist filtering and agent commits;
  • validation gates, including SDK overrides;
  • publish-side rebuilds, disallowed paths, symlinks, and base mismatches;
  • spec fetching and token revocation order;
  • PR create, update, and no-op runs.

  External commands were mocked; Git ran against local repositories. Mutation checks confirmed the tests fail when the allowlist or the pre-agent snapshot base is removed.

• Not yet run: a live Pi run, a generated MCP update, or a full end-to-end GitHub Actions run. Secret and variable availability couldn't be verified with the available GitHub permissions.

[github-actions]

Semgrep triage: 5 inline comments below, 1 omitted (same mutable-tag issue on actions/checkout@v4 at line 28, in the sdk-version job, which has no secrets). The workflow_run checkout finding is a false positive: Publish NPM runs only on release or dispatch, and the job requires head_repository == github.repository. The Redis port finding is also a false positive, since it only affects an ephemeral CI service container.

[cursor]

Stale Bugbot comment from a previous run.

[meliaj]

lgtm.

non-blocking follow-up: consider separating generation from publishing, with a clean publishing job receiving only the validated source snapshot. not a blocker under the stated trust model.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 374931c. Configure here.}

[meliaj]

the unversioned-spec finding looks valid: the diff is release-bounded, but Pi reads the full spec from current main. could we retain the historical target spec and point Pi at that instead?

i couldn’t reproduce the UTC lookup issue—equivalent raw and URL-encoded +00:00 queries returned the same expected commit. i’d treat that one as unconfirmed unless we have a failing example.

[rgarcia]

@meliaj your non-blocking follow-up is done in 05c1d96. Generation and publishing are now separate jobs.

• Generate job: after Pi runs, it restricts changes to an allowlist (package.json, bun.lock, .ts/.tsx under src/, excluding the generated managed-auth bundle). It cleans the checkout, validates only that patch, and uploads it with the report.
• Publish job: checks out the MCP server without credentials and rebuilds the branch from SHAs recorded before Pi ran. It applies the patch, re-checks the allowlist with its own copy of the script, and rejects symlinks and other non-regular files. Only then does it mint the write token. It never runs repository code, bun, or Pi.

Verification also now rejects @onkernel/sdk overrides, resolutions, or patches, and requires the lockfile entry to resolve to the published version.

Separately, Pi now reads the spec as of the SDK release commit instead of current main. Both Bugbot findings from the last push are fixed.