[remote-controlled-man]

mcporter list could ignore an extra target or a misspelled option such as --no-oauht. When a misspelled option was the only positional token, name correction could treat it as a server and connect anyway.

Reject unexpected arguments before preparing a server target. Exact configured server names and tool selectors still work when they begin with a hyphen.

Loopback CLI checks reproduced successful tool discovery on the base and confirmed exit status 1 with zero HTTP requests after the fix. Compiled CLI regressions cover both argument positions, an extra target, and a valid configured name beginning with hyphens.

Validation

• pnpm check
• FIRECRAWL_API_KEY=test LINEAR_API_KEY=test pnpm test (2,309 passed, 27 skipped)
• pnpm test:package
• pnpm docs:site

AI-assisted implementation and testing.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T08:13:11.794952Z	4df07a7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

Reject unexpected list arguments before preparing or contacting a server while preserving configured hyphen-prefixed names and selectors.

Example: Run mcporter list xhs --no-oauht with xhs configured.

• Before: The misspelled option is ignored and server discovery proceeds.
• After: The command exits with status 1 and reports the unexpected argument before contacting the server.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The implementation is focused and its compiled CLI tests exercise useful outcomes, but supplied runtime proof is absent and the diagnostic lacks a next action.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: A malformed list invocation can silently proceed with server discovery instead of reporting the invalid argument.
Reason: The patch enforces the documented single-target command boundary with little complexity and retains legitimate configured names and selectors.

Merge readiness

⛔ Blocked before merge - 2 items remain

This PR addresses a current argument-validation bug with a focused change; the new diagnostic needs a recovery instruction.

Priority: P2
Reviewed head: 4df07a7dc9087700b85d7d3aa286bcfefd18e705

Before merge

• Add real behavior proof - The body reports loopback CLI checks, but provides no captured commands and output or artifact connecting handleList validation to exit 1 and zero HTTP requests; provide terminal screenshots, logs, or live output for those cases and a successful hyphen-prefixed target, with sensitive values redacted. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Tell users how to correct the rejected invocation (P3) - For mcporter list xhs --no-oauht, the new error prints only Unexpected list argument '--no-oauht'.; the top-level CliUsageError handler adds no usage or recovery instruction. Append a concrete next action, such as removing or correcting the argument and running mcporter list --help, so the diagnostic meets the review's user-message requirement.

Findings

• [P3] Tell users how to correct the rejected invocation — src/cli/list-command.ts:40

Tests

• Missing end-to-end proof: Supply recorded compiled-CLI output showing rejected arguments exit 1 with zero server requests and valid hyphen-prefixed names or selectors still succeed; a recorded base-fail/head-pass regression run is not supplied.

Agent review details

How this fits together

The list command consumes CLI flags and a server selector, resolves configured or ad-hoc targets, and returns server status or tool descriptions.

flowchart TD
A[CLI arguments] --> B[Global parsing and routing]
B --> C[List flag extraction]
C --> D[Argument validation]
D --> E[Target preparation and resolution]
E --> F[MCP discovery]
F --> G[CLI output]

Loading

Technical review

Best possible solution:

Keep validation in handleList using the existing selector resolver and usage-error class, and add an actionable help hint to the rejection message.

Do we have a high-confidence way to reproduce the issue?

Source establishes both paths: leftover arguments are ignored on main, and normalization removes the hyphens from --xhs before matching xhs; no reproduction was executed during this read-only review.

Is this the best way to solve the issue?

Validating residual arguments before target preparation is the smallest complete fix and preserves ordinary server correction and configured tool selectors.

Full review comments:

• [P3] Tell users how to correct the rejected invocation — src/cli/list-command.ts:40
  For mcporter list xhs --no-oauht, the new error prints only Unexpected list argument '--no-oauht'.; the top-level CliUsageError handler adds no usage or recovery instruction. Append a concrete next action, such as removing or correcting the argument and running mcporter list --help, so the diagnostic meets the review's user-message requirement.
  Confidence: 0.99

Overall correctness: patch is correct
Overall confidence: 0.91

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8babbc8458bf.

Provenance checked

• List target consumption and server-name correction changes intended behavior with a stated reason (986912f: The commit introduced identifier suggestions and automatic correction for list targets; earlier extraction code already consumed only one target.)
• Configured tool selectors keeps the original intent (a64bdda: Support per-tool list schemas using configured server prefixes; the patch reuses this resolver to preserve hyphen-prefixed selectors.)
• HTTP selector integration coverage keeps the original intent (550108c: Fix configured HTTP call selectors #219 added real HTTP CLI coverage for configured and ad-hoc selectors; existing cases remain exercised.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

Acceptance criteria:

• pnpm check
• pnpm test

What I checked:

• Current-main bug: Main extracts recognized flags and shifts one target without checking remaining arguments; identifier normalization also allows --xhs to resolve to xhs. (src/cli/list-command.ts:31, 8babbc8458bf)
• Verified introduced change: The pinned diff adds validation before target preparation and extends the existing compiled CLI integration suite with rejection and zero-request assertions. (src/cli/list-command.ts:34, 4df07a7dc908)
• Documented command boundary: The reference documents one optional server target and server.tool selectors, supporting rejection of extra positional arguments. (docs/cli-reference.md:12, 4df07a7dc908)
• Historical intent: The history introduces server-name correction in 986912f and per-tool selection in a64bdda; the patch retains those capabilities for valid targets. (src/cli/list-command.ts, 986912ff5ca8)
• Discussion and proof inspection: The complete REST body and comments contain a narrative loopback verification claim but no terminal trace, media, or linked behavior artifact. (4df07a7dc908)
• Existing integration owner: Fix configured HTTP call selectors #219 introduced the real HTTP selector CLI fixture reused by this PR. (tests/cli-http-selector.integration.test.ts:18, 550108cd681e)

Likely related people:

• Andy Ye: Raw commit 550108c adds tests/cli-http-selector.integration.test.ts:24 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 550108cd681e; files: tests/cli-http-selector.integration.test.ts)

Review metrics

Metric	Value	Why it matters
Change size	Production +9/-0; tests +32/-5	The change reuses existing parsing and integration owners without adding production modules or dependencies.

Labels

Label changes:

• add P2: Silently ignored arguments can cause unintended discovery, but the demonstrated impact is limited to malformed CLI invocations.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: Silently ignored arguments can cause unintended discovery, but the demonstrated impact is limited to malformed CLI invocations.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted compiled-CLI output demonstrating rejection before HTTP requests and successful valid hyphen-prefixed targeting.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 4, 2026, 3:23 AM ET / 08:23 UTC.

[steipete]

Thanks for the contribution. The list argument validation before server discovery fix and its regression coverage are included in the merged CLI correctness integration, #484. That integration validates the overlapping parser and generator changes together. Your co-author credit and changelog acknowledgment are preserved. Closing this PR as superseded by #484.