feat: add MCP server for AI agent interactions by vycdev2 · Pull Request #49 · vycdev/Morpheus

vycdev2 · 2026-07-30T11:42:57Z

Summary

Rebase the MCP work onto current develop after the dashboard removal and eliminate dashboard namespaces, listeners, configuration, and documentation.
Host the standard Streamable HTTP MCP endpoint on its own MCP_API_URLS listener, defaulting to loopback at http://127.0.0.1:5268, with only the minimal ASP.NET host required by MCP.
Require bearer authentication, exact origin validation, and per-client rate limiting; expose only read-only aggregate activity/guild data, guild-scoped leaderboards, and approved non-removed quotes.
Update the dashboard-free README and default environment template, and add endpoint-level security/protocol coverage.

Verification

dotnet build — passed: 0 errors (2 dependency vulnerability warnings).
dotnet test --no-restore --filter "FullyQualifiedName~Mcp" — passed: 15/15.
dotnet test --no-restore — 312 passed, 2 failed: the existing MiscModuleTests.NormalizeTimeUntilEventName_NormalizesCase cases require tr-TR, which is unavailable in this runner globalization mode.
git diff --check — passed.

Risk

Medium — this adds a network-facing protocol endpoint and SDK dependency, but it is loopback-only and disabled by default, authenticated when enabled, origin-restricted, rate-limited, read-only, and transport-tested.

Closes #3

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

vycdev

Thanks for putting this together. The database-query layer builds and its tests pass, but this HTTP surface is not safe or MCP-compatible yet. Before merging, it needs enforced authentication and authorization, rate limiting, restricted/validated origins, standard MCP protocol support (or explicit REST API naming), endpoint-level security/protocol tests, and careful review of which data may be exposed. In particular, unapproved quotes and recent logs should not be broadly accessible. The current MCP_API_KEY and MCP_API_URLS settings give a false sense of protection/configurability because neither is actually applied.

vycdev · 2026-08-03T09:40:40Z

+
+        RouteGroupBuilder api = app
+            .MapGroup("/api/mcp")
+            .RequireCors(CorsPolicyName);


Blocking: this group only applies CORS; McpApiOptions.ApiKey is never validated. The health endpoint can report authEnabled: true while every tool remains callable without a key, including tools returning users, balances, unapproved quotes, and logs. Add authentication/authorization middleware or an endpoint filter, plus integration tests for missing, incorrect, and correct credentials.

vycdev · 2026-08-03T09:40:40Z

+            corsOptions.AddPolicy(CorsPolicyName, policy =>
+            {
+                policy
+                    .AllowAnyOrigin()


Blocking for a network-facing data API: AllowAnyOrigin() permits any browser origin, while MCP's HTTP transport requires validating the Origin header to prevent DNS-rebinding attacks. Use an explicit configured allowlist and test rejected origins.

vycdev · 2026-08-03T09:40:40Z

+        }));
+
+        // Call a specific tool
+        api.MapPost("/call/{toolName}", async (


This is a custom REST call endpoint, not the MCP protocol expected by standard clients. MCP uses JSON-RPC with initialization and tools/list / tools/call over its transport endpoint. Please implement the standard protocol (preferably with an MCP SDK), or present this explicitly as an agent-friendly REST API rather than an MCP server.

vycdev · 2026-08-03T09:40:40Z

 Env.Load(".env");

 DashboardApiOptions dashboardOptions = DashboardApiOptions.FromEnvironment();
+McpApiOptions mcpOptions = McpApiOptions.FromEnvironment();


MCP_API_URLS has no effect: mcpOptions.Urls is loaded here, but the host is bound only with dashboardOptions.Urls. This silently exposes the new routes on the dashboard listener instead of the configured MCP URL. Either intentionally share and document one listener or wire the configuration correctly.

vycdev2 · 2026-08-04T02:26:32Z

Addressed the requested changes in 2235556:

replaced the custom REST surface with the official MCP SDK and standard Streamable HTTP protocol;
enforced bearer-key authentication, exact Origin validation, and rate limiting (including failed-authentication attempts);
removed the unused MCP_API_URLS setting and documented the intentionally shared listener;
narrowed the tools so logs, balances, user-directory exports, pending quotes, and removed quotes are not exposed;
added endpoint tests for missing/incorrect/correct credentials, rejected/allowed origins, browser preflight, rate limiting, MCP protocol revisions, discovery, calls, and pending-quote exclusion.

The MCP-focused tests pass 14/14. The full suite reports 314 passing and the same two invariant-globalization failures in MiscModuleTests because this runner cannot load tr-TR.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

vycdev

The MCP implementation is worth keeping, and the latest commit addresses the earlier protocol and security findings. It is not mergeable against current develop after the dashboard removal.

Blocking before merge:

Rebase onto current develop and resolve the Program.cs and project-file conflicts.
Remove the deleted dashboard namespace, listener, documentation, and environment dependencies.
Give MCP a standalone listener configuration that defaults to loopback, rather than DASHBOARD_API_URLS.
Reintroduce only the minimal ASP.NET hosting required by the MCP endpoint.
Update the dashboard-free README and default environment template.
Rerun the build, MCP security/protocol tests, and full applicable suite against the resulting merge state.

The current PR head builds and its 14 MCP tests pass on its original base, but GitHub reports the branch as conflicting and no merged-state verification is possible yet.

Implements an HTTP-based MCP (Model Context Protocol) server that exposes Morpheus bot data and functionality to AI agents through a clean tool-based API. Endpoints: - GET /api/mcp - Server info and available tools - GET /api/mcp/health - Health check - GET /api/mcp/tools - List all available tools with parameter schemas - POST /api/mcp/call/{toolName} - Execute a tool with parameters Tools: - get_user_stats - User statistics (balance, XP, level, messages, quotes) - get_guild_info - Guild/server information with settings - get_economy_summary - Economy overview (balances, UBI pool, vault, stocks) - get_activity_overview - Global activity metrics - get_guilds - List all servers with activity stats - get_users - Paginated user list - get_quotes - Paginated quotes with filtering - get_quote_by_id - Single quote details - get_recent_logs - Recent bot logs with severity filtering - get_stock_summary - Stock market gainers/losers - get_leaderboard - Activity leaderboard by XP or messages Closes vycdev#3

vycdev2 · 2026-08-08T02:13:08Z

Addressed the latest review in a942f84: rebased onto current develop, removed all dashboard dependencies, added standalone loopback-defaulted MCP_API_URLS configuration, retained only the minimal ASP.NET host, and refreshed the dashboard-free README/default environment template. GitHub now reports the branch as cleanly mergeable.

Verification: dotnet build passed; the MCP security/protocol subset passed 15/15; the full suite passed 312/314 with the same two globalization-invariant tr-TR failures in MiscModuleTests.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

vycdev2 · 2026-08-09T05:06:41Z

Verified the updated MCP implementation at a942f8414b477566b6989a1cf612891f929f71c5, which is currently based directly on upstream/develop (8fc1669289e35474340a246e930da77ebb6cf55f) and is reported cleanly mergeable by GitHub.

dotnet build — passed with 0 errors (119 existing dependency/SDK warnings).
dotnet test --no-build --filter 'FullyQualifiedName~Mcp' --logger 'console;verbosity=minimal' — passed: 15/15.
dotnet test --no-build --logger 'console;verbosity=minimal' — 312 passed, 2 failed. Both failures are the existing tr-TR culture cases in MiscModuleTests.NormalizeTimeUntilEventName_NormalizesCase, caused by this runner using globalization-invariant mode; the MCP tests all pass.
git diff --check upstream/develop...HEAD — passed.

The requested dashboard removal/rebase, standalone loopback-default MCP listener, minimal ASP.NET hosting, dashboard-free docs/environment template, authentication/origin/rate-limit protections, protocol coverage, and restricted quote exposure are present in the current head. Please re-review when convenient.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

vycdev requested changes Aug 3, 2026

View reviewed changes

vycdev requested changes Aug 6, 2026

View reviewed changes

vycdev2 added 2 commits August 8, 2026 02:04

fix: secure MCP protocol endpoint

a942f84

vycdev2 force-pushed the feature/mcp-server branch from 2235556 to a942f84 Compare August 8, 2026 02:12

Navigation Menu

feat: add MCP server for AI agent interactions - #49

feat: add MCP server for AI agent interactions#49
vycdev2 wants to merge 2 commits into
vycdev:developfrom
vycdev2:feature/mcp-server

vycdev2 commented Jul 30, 2026 •

edited

Loading

Uh oh!

vycdev left a comment

Uh oh!

vycdev Aug 3, 2026

Uh oh!

vycdev Aug 3, 2026

Uh oh!

vycdev Aug 3, 2026

Uh oh!

vycdev Aug 3, 2026

Uh oh!

vycdev2 commented Aug 4, 2026

Uh oh!

vycdev left a comment

Uh oh!

vycdev2 commented Aug 8, 2026

Uh oh!

vycdev2 commented Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

vycdev2 commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Risk

Uh oh!

vycdev left a comment

Choose a reason for hiding this comment

Uh oh!

vycdev Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

vycdev Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

vycdev Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

vycdev Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

vycdev2 commented Aug 4, 2026

Uh oh!

vycdev left a comment

Choose a reason for hiding this comment

Uh oh!

vycdev2 commented Aug 8, 2026

Uh oh!

vycdev2 commented Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vycdev2 commented Jul 30, 2026 •

edited

Loading