feat(kilo-mcp): remote MCP worker with hybrid catalog search, tRPC calls, and OAuth 2.1 sign-in (part 1/1) - #6030
Open
iscekic wants to merge 13 commits into
Open
feat(kilo-mcp): remote MCP worker with hybrid catalog search, tRPC calls, and OAuth 2.1 sign-in (part 1/1)#6030iscekic wants to merge 13 commits into
iscekic wants to merge 13 commits into
Conversation
iscekic
marked this pull request as draft
September 9, 2026 23:16
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryThe incremental commit only applies oxfmt formatting to Files Reviewed (11 files)
Previous Review Summaries (7 snapshots, latest commit 867f373)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 867f373)Status: No Issues Found | Recommendation: Merge Files Reviewed (11 files)
Previous review (commit 556ff14)Status: No Issues Found | Recommendation: Merge Files Reviewed (6 files)
Previous review (commit efedce1)Status: No Issues Found | Recommendation: Merge Files Reviewed (1 file)
Previous review (commit d606033)Status: No Issues Found | Recommendation: Merge Files Reviewed (2 files)
Previous review (commit 352b9f9)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (12 files)
Fix these issues in Kilo Cloud Previous review (commit 5df3ac4)Status: No Issues Found | Recommendation: Merge Files Reviewed (12 files)
Previous review (commit 513bd2f)Status: 2 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (32 files)
Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0 Review guidance: REVIEW.md from base branch |
…lls, and OAuth 2.1 sign-in (part 1/1) #6030
iscekic
force-pushed
the
kwf/kilo-remote-mcp-c204-l1
branch
from
September 10, 2026 00:58
cda4506 to
5df3ac4
Compare
iscekic
marked this pull request as ready for review
September 10, 2026 01:10
The dump now shells out to `kilo run` for missing summaries instead of calling OpenRouter or Anthropic directly. One pinned model generates every summary: kilo/deepseek/deepseek-v4.1-flash at variant max. - Feed the prompt on stdin, so a batch is never bounded by ARGV_MAX. - Run the CLI in the OS temp dir, so it does not load this repo's config. - Reduce the CLI JSON event stream to the assistant text parts. - Classify a missing CLI or a signed-out CLI as non-retryable, and keep the hand-write path in the error text. - Install @kilocode/cli in both CI jobs and pass the credential as KILO_AUTH_CONTENT from MCP_CATALOG_KILO_AUTH.
Add the Cloudflare custom domain and disable the workers.dev URL in production. The issuer is derived from the request URL, so the OAuth metadata advertises https://kilo-mcp.kilosessions.ai without extra config. The dev env keeps its own workers.dev URL and index.
Use the apps/web palette on the consent page, the org picker, and error pages: near-black canvas, raised charcoal card, brand-primary CTA with dark foreground, Inter, and a compact brand row. Drop the old blue CTA. Open the sign-in link in a new tab so the pairing-status poll in the consent tab survives the trip to apps/web. Name the page "Connect to Kilo MCP" and make the restart link a secondary action.
Pass KILO_API_KEY and KILO_ORG_ID from repo secrets alongside the optional KILO_AUTH_CONTENT auth store, so the catalog jobs can run on an API key instead of a personal CLI login.
Sync with main and regenerate pnpm-lock.yaml. Main downgraded the wrangler catalog to 4.112.0 (#6005); the stale branch lockfile made --frozen-lockfile fail on the PR merge ref with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY.
Review found runKiloCompletion concatenated every part.type === 'text' event, while the in-repo contract (auto-routing-benchmark/src/kilo-events.ts) takes only completed text events (part.time.end set) and also accepts the flattened evt.text shape. - A streaming delta plus the final text produced garbled JSON. - A flattened event produced no text, so the dump failed. parseKiloCompletion now mirrors that contract. Add unit tests for the delta, flattened, and malformed-line cases.
Use the shared kiloapps.io zone instead of kilosessions.ai. The issuer is derived from the request URL, so the OAuth metadata advertises https://mcp.kiloapps.io with no extra config.
The MCP catalog dump shells out to `kilo run`, which needs a Kilo API token. Add POST /api/internal/mcp-catalog/token to exchange a dedicated shared secret for a 1-hour token that belongs to the benchmarking service account, instead of a maintainer's personal CLI credential.
Two changes to the catalog workflow: - Run it on every PR and gate the work on a change-detection step, so `catalog (PR)` can be a required check without leaving unrelated PRs blocked on an expected-but-skipped workflow. Removes catalog drift. - Mint a short-lived service-account token instead of reading a maintainer's personal CLI credential. Fork PRs still fail with the hand-written-summary recovery.
iscekic
added this pull request to stack #6067
September 10, 2026 23:18
pandemicsyn
requested changes
Sep 11, 2026
- getKiloToken now filters by the token's org and resource indicator, not just user + client, so a token for one grant can never forward another grant's Kilo credential. Null-org identities match only null-org rows. - VerifiedMcpToken carries its bound resource so the lookup can use it. - callCatalogEndpoint rejects any input for a no-input catalog procedure before any upstream request. - the merge catalog job fails when the dump changes catalog.json, so the Vectorize index cannot diverge from the deployed Worker bundle.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changelog for users
searchandcall.searchturns a plain-language task into matching Kilo endpoints: exact path and keyword matches rank first.searchstill answers from keyword matching instead of failing.callexecutes a Kilo API query as the signed-in user. It accepts only catalog paths and validates arguments against the published schema before sending anything.[truncated]marker.admin.*,debug.*, andtest.*, each with a search-friendly summary authors can hand-edit.Changelog for maintainers
apps/web/src/scripts/mcp-catalogwalks the liverootRouter(queries only, denylistadmin/debug/test) and keeps committed summaries byte-for-byte. Missing summaries are generated per router file via OpenRouter or Anthropic; a corrupt committed catalog fails loudly, and an incomplete catalog is never written.catalog (PR)can be a required status check without leaving unrelated PRs blocked. Same-repo PRs get the refreshedservices/kilo-mcp/catalog.jsoncommitted to the branch, which removes catalog drift. Fork PRs fail with acatalog.patchartifact and a comment, including when GitHub withholds the secret. The main-push job re-dumps and upserts Vectorize; PR jobs never touch it.scripts/kilo-mcp-catalog.test.mjsasserts this wiring.@cf/baai/bge-base-en-v1.5(768 dimensions, cosine) with vector id = procedure path; only the search query is embedded per request. Production deploys from main keep the bundled catalog and the index in lockstep.callrejects unknown paths and schema-invalid input before any upstream request. It forwards over apps/web's tRPC GET transport with the verified identity's Kilo credential and the org header from the token claims.x-kilocode-organizationidmirrors the apps/web constant — keep them in sync./authorizepairing with consent page, a single-use status relay, and a membership-validated org picker./tokenenforces single-use codes, S256 PKCE, and rotating hashed refresh tokens. State lives in one Durable Object (KiloMcpOAuthStore, DO SQLite, migration tag v1, 6-hour purge alarm)./mcpaccepts only this worker's HS256 tokens (issuer, audience, expiry, and jti registry checked). A deployment missingMCP_TOKEN_SECRETor the Durable Object binding refuses POSTs with 503 instead of forwarding unverified bearers.97df6a80copens the authorize page's Continue with Kilo sign-in link in a new tab (target="_blank" rel="noopener noreferrer"), so the pairing-status poll survives sign-in. The authorize screenshot above predates the fix.kilo runnever uses a maintainer's personal credential. Both jobs exchangeMCP_CATALOG_TOKEN_SECRETatPOST /api/internal/mcp-catalog/tokenfor a 1-hour token that belongs to the benchmarking service account.Human steps before merge and deploy
Needs a repo admin.
catalog (PR)to themain-testsruleset required status checks. The automation token lacks repo admin and gets HTTP 404 from the rulesets API. GitHub UI: Settings → Rules →main-tests→ Require status checks → addcatalog (PR).Needs the deployer.
pnpm web:env set MCP_CATALOG_TOKEN_SECRET --only production --production-file <(op read "op://Kilo Web ENV Production/MCP_CATALOG_TOKEN_SECRET/password")so Vercel serves the mint route. Agents must not run this command.Already done, no action:
MCP_CATALOG_TOKEN_SECRETis in 1Password (Kilo Web ENV Production) and in GitHub repo secrets; the personalMCP_CATALOG_KILO_AUTHsecret is deleted from GitHub and 1Password;MCP_TOKEN_SECRETis set on bothkilo-mcpandkilo-mcp-dev; thekilo-mcp-catalogVectorize index exists.E2E proof (stack-wide)
Owner request for the stack
Owner manual verification
Owner verification is pending; CI did not prove these paths automatically.
catalog.jsoncommit; fork PR fails withcatalog.patch. Not run here.apps/web/src/**without a summary and assert the job fails with the guidance comment. Needs a real fork PR.PR stack (merge bottom to top)
kwf/kilo-remote-mcp-c204-l1) ← this PR