feat: add safe application env upsert tool#56
Open
agentHits wants to merge 2 commits into
Open
Conversation
Что: - Добавлен generated MCP tool `application-env-upsert` для `POST /application.env.upsert`. - Добавлена поддержка OpenAPI pattern-record схем в генераторе, чтобы MCP валидировал имена env-переменных и непустой `variables`. - Добавлено редактирование submitted env values в логах handler для нового tool и regression tests на безопасный routing. Зачем: - MCP-клиенты смогут безопасно отправлять только нужные application env variables без client-side read/replace полного env блока. - Это снижает риск удаления или раскрытия существующих секретов при автоматизации через MCP. Риски: - Endpoint пока зависит от Dokploy core PR #4581 и отсутствует в published OpenAPI. - Live Dokploy backend не вызывался. Проверки: - Команды и результаты: `corepack pnpm exec vitest run src/server.test.ts --reporter=verbose` passed, 1 file / 6 tests; `corepack pnpm run lint` passed with existing `src/utils/responseFormatter.ts` warning; `corepack pnpm run type-check` passed; `corepack pnpm run test` passed, 3 files / 27 tests; `corepack pnpm run build` passed; `git diff --check` passed. - Ограничения: live Dokploy backend and final core OpenAPI sync were not verified because core PR #4581 is still open. What: - Added the generated MCP `application-env-upsert` tool for `POST /application.env.upsert`. - Added OpenAPI pattern-record support to the generator so MCP validates env variable names and non-empty `variables`. - Added handler log redaction for submitted env values on the new tool and regression tests for safe routing. Why: - MCP clients can send only the requested application env variables without client-side full env read/replace. - This reduces the risk of deleting or exposing existing secrets during MCP automation. Risks: - The endpoint still depends on Dokploy core PR #4581 and is not present in the published OpenAPI yet. - Live Dokploy backend was not exercised. Checks: - Commands and results: `corepack pnpm exec vitest run src/server.test.ts --reporter=verbose` passed, 1 file / 6 tests; `corepack pnpm run lint` passed with existing `src/utils/responseFormatter.ts` warning; `corepack pnpm run type-check` passed; `corepack pnpm run test` passed, 3 files / 27 tests; `corepack pnpm run build` passed; `git diff --check` passed. - Limitations: live Dokploy backend and final core OpenAPI sync were not verified because core PR #4581 is still open.
This was referenced Jul 2, 2026
Author
|
Update (2026-07-06): the MCP PR has now been aligned with the route shape implemented in Dokploy/dokploy#4581. Current confirmed MCP behavior:
Checks passed: The PR remains ready for review and blocked for merge until Dokploy/dokploy#4581 lands or maintainers confirm the final API/OpenAPI contract. |
This was referenced Jul 6, 2026
Что: - Перевел generated MCP tool `application-env-upsert` на `/application/env/upsert`, синхронизировал OpenAPI snapshot и обновил regression test. Зачем: - Core API support теперь публикует и обслуживает slash route, поэтому MCP PR должен отправлять запрос в тот route, который обслуживается рабочей core-реализацией. Риски: - Изменение касается только одного generated tool path; input schema, redaction guard и full-env replacement запрет не менялись. Проверки: - Команды и результаты: `corepack pnpm run generate` прошел и regenerated 525 tools; `corepack pnpm test` прошел, 3 файла и 27 тестов; `corepack pnpm run type-check` прошел; `corepack pnpm run lint` прошел с существующим warning в `src/utils/responseFormatter.ts`; `corepack pnpm run build` прошел; `git diff --check origin/feat/application-env-upsert...HEAD` прошел после amend. - Ограничения: live call against merged upstream Dokploy core не запускался, потому что core PR еще открыт. What: - Switched the generated MCP `application-env-upsert` tool to `/application/env/upsert`, synchronized the OpenAPI snapshot, and updated the regression test. Why: - Core API support now publishes and serves the slash route, so the MCP PR should call the route served by the working core implementation. Risks: - The change only affects one generated tool path; input schema, the redaction guard, and the no-full-env-replacement guarantee are unchanged. Checks: - Commands and results: `corepack pnpm run generate` passed and regenerated 525 tools; `corepack pnpm test` passed, 3 files and 27 tests; `corepack pnpm run type-check` passed; `corepack pnpm run lint` passed with the existing warning in `src/utils/responseFormatter.ts`; `corepack pnpm run build` passed; `git diff --check origin/feat/application-env-upsert...HEAD` passed after amend. - Limitations: live call against merged upstream Dokploy core was not run because the core PR is still open.
Author
|
Code update pushed for the final route shape currently implemented in Dokploy/dokploy#4581. What changed in this MCP PR now:
Latest local checks passed: This is still ready for review but merge-gated until Dokploy/dokploy#4581 lands or maintainers confirm the final API/OpenAPI contract. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Status: ready for review, blocked for merge.
Please review the MCP implementation now, but do not merge until Dokploy/dokploy#4581 lands or maintainers confirm the final
/application/env/upsertAPI/OpenAPI shape.Adds dependent MCP support for the safe application environment variable upsert API from Dokploy core.
This PR exposes
application-env-upsertforPOST /application/env/upsertso MCP clients can send only the variables they need to add or update, without reading or reconstructing the full current application env block.Closes #55.
Refs Dokploy/dokploy#4525.
Depends on Dokploy/dokploy#4581.
Current Support Status
The core workflow has also been validated in a self-hosted Dokploy + MCP setup with
dryRun. The verified behavior is the same contract this MCP tool is meant to provide: send only selected env variables, let Dokploy merge server-side, and return metadata without exposing raw secret values.This PR still intentionally remains merge-gated because the final upstream core API/OpenAPI shape must be confirmed by maintainers first.
Dependency / Merge Gate
/application/env/upsertis not present in the published Dokploy OpenAPI yet. This PR is ready for review, but should not merge until Dokploy/dokploy#4581 lands or maintainers confirm the final API/OpenAPI shape.The core issue and implementation were opened by @agentHits. Review from Dokploy maintainers, including @Siumauricio if this API surface is in scope, would help confirm when the MCP side can be safely promoted.
What Changed
/application/env/upserttosrc/generated/openapi.json.src/generated/tools.tsandTOOLS.md, increasing the tool count from 524 to 525.application-env-upserttool description/path to call/application/env/upsert.propertyNames.pattern+minPropertiesfor string record schemas.Safety Notes
application.saveEnvironmentis used.Checks
corepack pnpm run generatecorepack pnpm testcorepack pnpm run type-checkcorepack pnpm run lint(passes with existingsrc/utils/responseFormatter.tswarning)corepack pnpm run buildgit diff --check origin/feat/application-env-upsert...HEADNot Verified