Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

🎃 Add "Copy as cURL" to an audit log entry to replay the MCP tool call

Abierto
  • ¿Algo no está bien?
#850 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
72/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
playwright, typescript
Área
api, documentation, frontend

Línea de trabajo

Start with the expanded row in packages/frontend/src/app/logs/page.tsx:382-419, then read the server.info() usage in packages/frontend/src/lib/api.ts:964-977 and the clipboard helper in mcp-server/[id]/page.tsx:210-245. Build the command in packages/frontend/src/lib/curl.ts and test it, including auth modes and disabled cases; add the requested Playwright coverage and the note in docs/api-reference.md. Done means the copied command replays a local tool call without exposing credentials and the requested tests pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement good first issue hacktoberfest help wanted

Part of the October Challenge #846.

Why

When a tool call fails, the first step in debugging is to run it again outside the AI client. The log row already has the tool name, the arguments and the MCP server it came through, but rebuilding a valid MCP JSON-RPC request by hand (headers, protocol version, envelope) is slow and easy to get wrong. Browser DevTools, Postman and Insomnia all have "Copy as cURL". This issue adds that button to each entry on the Audit Log page.

What the log actually stores: tool_invocations.input holds the MCP tool arguments, saved before env vars are injected (dynamic-mcp-tools.ts:412-421). It does not hold the upstream HTTP request (URL, headers, body sent to the vendor API). So this feature replays the MCP tools/call against AnythingMCP. It does not replay the upstream API call. That is deliberate: upstream requests carry the connector's credentials.

Self-hosted vs Cloud

  • Self-hosted: enabled in Community and Business. No ee/ code.
  • Cloud (DEPLOYMENT_MODE=cloud): enabled. The command targets https://cloud.anythingmcp.com/mcp/<serverId>, which the user can already reach with their own credentials. Nothing instance-wide is exposed, and the button is client-side only with no new endpoint.
  • Who can use it: any role that can see /logs today. The command only contains data already shown in the expanded row, plus a placeholder for the credential.

What to build

  1. A "Copy as cURL" button in the expanded row (logs/page.tsx:382-419), next to the User/Server meta line.
  2. Put a pure builder in packages/frontend/src/lib/curl.ts: buildToolCallCurl({ origin, serverId, toolName, args, authMode }). Output: 
    curl -sS -X POST "https://host/mcp/<serverId>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-06-18" \
  -H "X-API-Key: $AMCP_MCP_API_KEY" \
  --data-binary @- <<'JSON'
{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"<tool>","arguments":{...}}}
JSON
    The quoted heredoc means no shell escaping is needed for the JSON. Before you finalize the headers, check that a bare tools/call (no initialize) is accepted by the stateless per-server endpoint on a local instance. If it is not, emit an initialize call first and say so in a comment.
  3. The credential is always a placeholder env var. Never put a real secret in the command. The auth header follows MCP_AUTH_MODE from server.info(): legacy/both gives X-API-Key: $AMCP_MCP_API_KEY (per-user mcp_… keys work in every mode on /mcp/<id>, see mcp-combined-auth.guard.ts:64), and oauth2 gives Authorization: Bearer $AMCP_ACCESS_TOKEN. Never insert the dashboard session token (amcp_token in localStorage). The MCP guard accepts app JWTs (mcp-combined-auth.guard.ts:89-100), so pasting one would leak a full-account credential into shell history and tickets.
  4. Origin: reuse the logic in mcp-server/[id]/page.tsx:98-102 (localhost → :4000, otherwise window.location.origin). Move it into lib/ rather than copying it.
  5. Disable the button, with a tooltip explaining why, when:
    • log.mcpServer is null. The call came through the shared /mcp endpoint, which on Cloud only exposes the eight anythingmcp_* tools (shared-toolset.ts:26-55), so a direct call by tool name would not work there.
    • log.input._amcp_truncated is present. The stored arguments are an excerpt (bound-payload.ts:16), so a replay would not be faithful.
  6. Reuse the clipboard fallback from mcp-server/[id]/page.tsx:210-245 (it handles plain-HTTP LAN installs). Moving it into lib/clipboard.ts is welcome.

Where to look

  • packages/frontend/src/app/logs/page.tsx:382-419: expanded row (log.input, log.mcpServer, log.tool.name).
  • packages/backend/src/audit/audit.service.ts:204-224: fields returned per row (mcpServer.id/slug, tool.name).
  • packages/backend/src/mcp-server/dynamic-mcp-tools.ts:412-421: input: params (pre-env-injection args).
  • packages/backend/src/mcp-server/mcp-endpoint.controller.ts:1042-1048: stateless handler, legacy: 'stateless'.
  • packages/frontend/src/lib/api.ts:964-977: server.info() → mcpAuthMode.

Acceptance criteria

  • The copied command runs against a local instance with a real key exported as AMCP_MCP_API_KEY and returns the tool result (describe the manual check in the PR).
  • Args containing ', ", $, backticks and newlines survive unchanged (heredoc).
  • No token, key or cookie value ever appears in the output. The test asserts the placeholder is present.
  • The button is disabled for shared-endpoint rows and truncated inputs.
  • Playwright test in packages/frontend/tests/e2e/ (stub /api/audit/invocations and /health/server-info like redesign.spec.ts, grant clipboard permission, assert the copied text). Run with cd packages/frontend && npm run test:e2e.
  • Short "Replay a tool call" note added to docs/api-reference.md near the Audit section (line 219).

Out of scope

  • Replaying the upstream vendor HTTP request (it is not stored, and it carries credentials).
  • PowerShell/HTTPie variants, HAR export.
  • A "Run again" button that executes from the browser.

Size

S (a few hours)

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #846.

Lenguaje dominante
TypeScript
Estrellas
856
Forks
82
Merge medio
6 h 49 min
PR fusionados (30 d)
152

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de HelpCode-ai/anythingmcp

Todos los issues de HelpCode-ai/anythingmcp

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.