Skip to content

chore(deps): bump github.com/mcpchecker/mcpchecker from 0.0.12 to 0.0.14 in /e2e-tests/tools#102

Open
dependabot[bot] wants to merge 4 commits intomainfrom
dependabot/go_modules/e2e-tests/tools/github.com/mcpchecker/mcpchecker-0.0.14
Open

chore(deps): bump github.com/mcpchecker/mcpchecker from 0.0.12 to 0.0.14 in /e2e-tests/tools#102
dependabot[bot] wants to merge 4 commits intomainfrom
dependabot/go_modules/e2e-tests/tools/github.com/mcpchecker/mcpchecker-0.0.14

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 2, 2026

Bumps github.com/mcpchecker/mcpchecker from 0.0.12 to 0.0.14.

Release notes

Sourced from github.com/mcpchecker/mcpchecker's releases.

v0.0.14

What's Changed

Full Changelog: mcpchecker/mcpchecker@v0.0.13...v0.0.14

v0.0.13

What's Changed

New Contributors

Full Changelog: mcpchecker/mcpchecker@v0.0.12...v0.0.13

Commits
  • 66c7902 fix(acp): correctly extract agent output (#268)
  • a99d8de docs(cli): add --mcp-config-file flag to check command reference (#266)
  • 435a100 feat(llmagent): support using google as provider as well as gemini (#262)
  • 1671e85 build(deps): bump charm.land/fantasy from 0.16.0 to 0.17.1 in the go-dependen...
  • afa31cc build(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 in the github...
  • 2a5d41f fix(llmagent): mcp client does not panic on initialization race (#261)
  • bf75d5f docs: pull docs out of README into structured docs folder (#252)
  • e915dbd feat: add flag to override mcp config file in eval yaml (#260)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/mcpchecker/mcpchecker](https://github.com/mcpchecker/mcpchecker) from 0.0.12 to 0.0.14.
- [Release notes](https://github.com/mcpchecker/mcpchecker/releases)
- [Changelog](https://github.com/mcpchecker/mcpchecker/blob/main/CHANGELOG.md)
- [Commits](mcpchecker/mcpchecker@v0.0.12...v0.0.14)

---
updated-dependencies:
- dependency-name: github.com/mcpchecker/mcpchecker
  dependency-version: 0.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Apr 2, 2026
@dependabot dependabot bot requested a review from janisz as a code owner April 2, 2026 08:18
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 2, 2026

E2E Test Results

Commit: 0ade07f
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ list-clusters (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-nonexistent (assertions: 3/3)
  ✗ cve-cluster-does-exist (assertions: 3/3)
      verification failed: verify[0] failed: cannot run llmJudge step before agent (must be in verification)
  ~ cve-cluster-does-not-exist (assertions: 2/3)
      - ToolsUsed: Required tool not called: server=stackrox-mcp, tool=, pattern=list_clusters
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)

Tasks:      10/11 passed (90.91%)
Assertions: 31/32 passed (96.88%)
Tokens:     ~49610 (estimate - excludes system prompt & cache)
MCP schemas: ~12738 (included in token total)
Agent used tokens:
  Input:  12133 tokens
  Output: 19045 tokens
Judge used tokens:
  Input:  53782 tokens
  Output: 57934 tokens

mcpchecker v0.0.14 requires tasks to use the v1alpha2 format for proper
llmJudge step execution. The v1alpha1 format's verify step with contains
was causing "cannot run llmJudge step before agent" errors due to the
new validation in the agent output extraction.

Changes:
- Add apiVersion: mcpchecker/v1alpha2 to all task files
- Migrate steps to spec with structured verify phase
- Wrap contains verification in llmJudge step declaration

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 2, 2026

❌ 2 Tests Failed:

Tests completed Failed Passed Skipped
361 2 359 12
View the full list of 2 ❄️ flaky test(s)
::policy 1

Flake rate in main: 100.00% (Passed 0 times, Failed 8 times)

Stack Traces | 0s run time
- test violation 1
- test violation 2
- test violation 3
::policy 4

Flake rate in main: 100.00% (Passed 0 times, Failed 8 times)

Stack Traces | 0s run time
- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

janisz and others added 2 commits April 2, 2026 14:38
The node fixtures were using plural "nodes" field which doesn't match
the ExportNodeResponse protobuf definition that expects singular "node".
This was causing wiremock errors:
  "Cannot find field: nodes in message v1.ExportNodeResponse"

For streaming gRPC responses, the fixture should be an array of response
messages, each matching the proto message structure.

Changes:
- affected_nodes.json: wrap nodes in array of {node: {...}} objects
- empty.json: return empty object instead of {nodes: []}

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Investigated E2E test failures after upgrading to mcpchecker v0.0.14.
Found that some tests fail because the OpenAI mock agent makes tool
calls but doesn't send a final AgentMessageChunk update, causing
llmJudge to fail with "cannot run llmJudge step before agent".

Created reproduction test that demonstrates the issue:
- Agent makes tool call and gets result (ToolCall + ToolCallUpdate)
- But no AgentMessageChunk is sent afterward
- ExtractOutputSteps produces only "tool_call" type steps
- FinalMessageFromSteps returns empty string
- llmJudge validation fails on empty Agent.Output

The root cause appears to be in llmagent/acp_agent.go where the
OnStepFinish callback may not be called in all scenarios, or
step.Response.Content.Text() returns empty after tool calls.

This may be related to the fantasy library update (v0.16.0 → v0.17.1)
in mcpchecker v0.0.13.

Test added to mcpchecker's pkg/agent/extract_test.go at:
  /tmp/mcpchecker/pkg/agent/extract_test.go

Run with:
  cd /tmp/mcpchecker && go test -v -run TestAgentWithOnlyToolCallsNoFinalMessage ./pkg/agent/

See docs/mcpchecker-v0.0.14-bug-analysis.md for full analysis.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@janisz
Copy link
Copy Markdown
Contributor

janisz commented Apr 2, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants