Repository navigation
feat(mcp): load secret.env for stdio MCP Inspector - #374
Merged
Merged
Conversation
Vendors upstream sandbox_proxy.html and restores it into npx Inspector installs that omit clients/web/static. Points the removal TODO at ZEL-8153.
Launch the MCP Inspector against a built example server, with the sandbox document repaired and dev views enabled so a view rebuild is picked up by re-reading the resource rather than restarting the server.
Generate the component and the ui:// resource module, and add the package-level view wiring when a package has none yet, so adding a view is two files to fill in rather than seven to remember.
The generator wrote a view that could not be reached without hand-writing a tool, and left the install that view build needs as an instruction. Skipping it surfaced as a resolver error naming a synthesized file, so the view build now checks its dependencies first and says what to run. The generated tool stays unregistered: adding it to the package's tool list is where its name becomes public API, which is a person's call.
Deleting a view leaves its directory behind, because git cannot track an empty one. Discovery then refused to run at all, which broke re-scaffolding the view it belonged to. Files present but no *View.tsx still fails: that is a renamed component, and skipping it is how a view silently stops existing.
Replaces `pnpm mcp:new-view` with `pnpm mcp:new <app|tool|elicitation> <package> <name>`. The three kinds shared nearly all their machinery — resolving the package, spelling the generated names, refusing to clobber a file, and leaving registration to a person — so they now share it, and each kind is a template module. Only `app` touches a package manifest, which is what keeps React, Vite, and Tailwind out of packages that ship no view. The `elicitation` template emits a valid form rather than a placeholder, since assertElicitFormSchema runs at construction and a stub would throw on boot.
Spawn the Inspector server via mcp-run.sh so root secret.env credentials reach authenticated tools without putting secrets on Inspector -e args. Also fail clearly when secret.env is JSON instead of dotenv KEY=VALUE.
dawson-turechek-transcend
marked this pull request as ready for review
August 6, 2026 20:31
Launch the MCP Inspector against a built example server, with the sandbox document repaired and dev views enabled so a view rebuild is picked up by re-reading the resource rather than restarting the server.
Generate the component and the ui:// resource module, and add the package-level view wiring when a package has none yet, so adding a view is two files to fill in rather than seven to remember.
The generator wrote a view that could not be reached without hand-writing a tool, and left the install that view build needs as an instruction. Skipping it surfaced as a resolver error naming a synthesized file, so the view build now checks its dependencies first and says what to run. The generated tool stays unregistered: adding it to the package's tool list is where its name becomes public API, which is a person's call.
Deleting a view leaves its directory behind, because git cannot track an empty one. Discovery then refused to run at all, which broke re-scaffolding the view it belonged to. Files present but no *View.tsx still fails: that is a renamed component, and skipping it is how a view silently stops existing.
Replaces `pnpm mcp:new-view` with `pnpm mcp:new <app|tool|elicitation> <package> <name>`. The three kinds shared nearly all their machinery — resolving the package, spelling the generated names, refusing to clobber a file, and leaving registration to a person — so they now share it, and each kind is a template module. Only `app` touches a package manifest, which is what keeps React, Vite, and Tailwind out of packages that ship no view. The `elicitation` template emits a valid form rather than a placeholder, since assertElicitFormSchema runs at construction and a stub would throw on boot.
dsklyar
force-pushed
the
danielsklyar/zel-8113-new-view-scaffolder
branch
from
August 6, 2026 22:22
16aba6b to
883f659
Compare
…mcp-inspect-secret-env
@transcend-io/airgap.js-types
@transcend-io/cli
@transcend-io/design-tokens
@transcend-io/internationalization
@transcend-io/privacy-types
@transcend-io/sdk
@transcend-io/type-utils
@transcend-io/utils
@transcend-io/mcp
@transcend-io/mcp-server-admin
@transcend-io/mcp-server-assessment
@transcend-io/mcp-server-base
@transcend-io/mcp-server-consent
@transcend-io/mcp-server-discovery
@transcend-io/mcp-server-docs
@transcend-io/mcp-server-dsr
@transcend-io/mcp-server-inventory
@transcend-io/mcp-server-preferences
@transcend-io/mcp-server-workflows
commit: |
dsklyar
force-pushed
the
danielsklyar/zel-8113-new-view-scaffolder
branch
from
August 7, 2026 22:50
4aac7cf to
d07c4a6
Compare
Base automatically changed from
danielsklyar/zel-8113-new-view-scaffolder
to
main
August 8, 2026 06:05
Member
Author
Merge Conflict ResolutionMerged Resolution details
|
dsklyar
approved these changes
Aug 10, 2026
This was referenced Sep 7, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm mcp:inspectstdio servers viascripts/mcp-run.shso rootsecret.envcredentials reach authenticated tools (same path as Cursor)-eargs (still readable viaps); only forward non-secret inspector env varsmcp-run.shfail clearly whensecret.envlooks like JSON instead of dotenvKEY=VALUETest plan
secret.envuses dotenv format withTRANSCEND_API_KEY(or OAuth vars)pnpm mcp:inspectand call an authenticated tool; confirm real API data returnssecret.envand confirmmcp-run.shexits with a clear errorpnpm mcp:inspect --httpstill works withsecret.envvialoadSecretEnvMade with Cursor