feat(copilot): expose server-managed tools over MCP by BruzWJ · Pull Request #156 · TradingGoose/TradingGoose-Studio

BruzWJ · 2026-06-24T16:33:20Z

Summary

Add a TradingGoose Copilot MCP JSON-RPC endpoint backed by personal API-key authentication.
Add browser-approved MCP device login plus local setup scripts for Codex, Cursor, Claude, and OpenCode.
Move Copilot entity, workflow, monitor, knowledge, credential, and MCP operations onto the server-managed tool router with review-token acceptance for mutations.
Make workflow and saved-entity writes flow through Yjs first, then materialize persisted database state from the applied snapshot.
Add/update MCP auth, server tool routing, review acceptance, Yjs persistence, workflow, editor, and API-key test coverage.

Why

Copilot and external MCP clients need one authoritative server-side tool surface. This centralizes auth, workspace scoping, review staging, result validation, and persistence so Studio Copilot and MCP clients execute the same contracts instead of relying on browser-managed tools or direct state writes that can diverge from Yjs/editor state.

Affected Areas

Issue Links( if any )

N/A

Validation

# Not run locally in this PR-draft pass.
# Branch diff was reviewed against staging; CI should run the full test/type-check suite.

Risk / Rollout Notes

This is a high-surface-area Copilot/MCP and persistence change. Validate in staging before promotion:

MCP setup/login for Codex, Cursor, Claude, and OpenCode.
/api/copilot/mcp initialize, tools/list, ping, and tools/call flows.
Studio Copilot server-managed tool execution and review acceptance.
Workflow save, import, duplicate, revert, deploy, and variable preservation flows.
Saved entity editor flows for skills, custom tools, indicators, MCP servers, and knowledge bases.
Socket-server internal Yjs snapshot/apply endpoints.

Backout plan: revert this PR. If test MCP personal API keys were created during rollout, revoke those keys after rollback.

Config / Data Changes

Env vars added or changed: None.
Database schema or migration impact: None; uses existing verification, apiKey, workflow, and Yjs persistence tables.
External services or provider behavior changed: Adds TradingGoose MCP endpoints and local client setup for Codex/Cursor/Claude/OpenCode. MCP clients authenticate with personal API bearer tokens. Workspace-scoped Copilot/MCP tools now require explicit workspace context where applicable.

Screenshots / Video

Not captured. The new MCP authorization flow uses existing auth-page components and localized copy.

Checklist

I kept the change focused and reviewed my own diff
I validated the change locally and documented the results above
I updated docs, examples, or copy if behavior/user-facing flows changed
I called out any env, schema, provider, or rollout impact
I did not include secrets, tokens, or private credentials in this PR

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

Return a consistent error when API-key storage is unavailable, short-circuit matching helpers, cover the behavior in tests, and rename the MCP setup key label to match the personal API key flow. Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

Delete the database record first, then run realtime cleanup as a best-effort follow-up so cleanup failures do not block a successful delete. Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

BruzWJ · 2026-06-29T05:04:39Z

@greptileai

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

…tion Update shared entity list contracts to carry enabled state and make rename payloads strict. Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

BruzWJ and others added 30 commits June 23, 2026 11:20

refactor(yjs): remove saved entity field overlays

5366e93

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): persist server tool review tokens

8fea596

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(mcp): reject reused device login approvals

fb8ff93

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workflows): avoid loading deployed workflow variables

a3c4ea1

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(mcp): authenticate device login API keys

4ca9b51

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): apply reviewed tool changes atomically

0835d96

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): prevent stale server tool review acceptance

2b94ebe

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): handle malformed MCP batch entries

164ee90

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(copilot): stage mutation tools for review

4bb55c8

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): prevent sensitive tool payload exposure

f34626b

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

docs: update project agent testing guidance

82adab9

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): reject empty JSON-RPC batches

3dcf4be

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): redact managed review secrets

6cbb24d

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(mcp): use personal API keys for device login

12d81b4

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(mcp): issue device login keys during approval polling

adb0dd4

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workflows): preserve deployment metadata from saved state

bdf6e56

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(mcp): use shared personal api key auth

5a4b50b

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workflows): preserve variables during direct yjs persistence

b87fc13

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workflows): persist workflow names through Yjs state

4d0241d

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): read saved entities from bootstrapped Yjs state

fc436b4

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(editors): back entity editors with Yjs sessions

d7f4850

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(workflows): export referenced skills from Yjs state

c39cd33

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(mcp): consume device login approvals when issuing keys

e78ab77

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(yjs): fall back to direct state persistence on apply errors

d984f06

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(custom-tools): reject duplicate titles on update

ee6fd42

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): omit generated workflow ids from review staging

20ac127

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): require workflow variable ids in documents

8dfcd65

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

style(copilot): wrap copilot registry assertions

560b549

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(copilot): refresh state after server tool mutations

cce91db

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(copilot): serialize server tool review acceptance

420d525

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

BruzWJ and others added 21 commits June 28, 2026 02:16

fix(workspaces): prevent deleting the last workspace

277bedb

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workspaces): move bootstrap to signup and refresh MCP tools

301d1d5

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workspaces): create default workspace when user has none

a953ba7

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(stores): clear react query cache during user data reset

820c0c1

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workspaces): stop auto-creating workspaces on read

4070299

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workflows): remap duplicate block references in sub-blocks

f490698

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(api-key): validate encryption key availability

ec06136

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(query-provider): use browser-scoped query client

9ab9b5b

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(workspace): create default workspace for root entry

ad90f23

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(workspaces): bootstrap default workspace for MCP users

4cd0370

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(mcp): use configured app URL for auth and install flows

3423264

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(mcp): support MCP 2025-06-18 negotiation

d311c85

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(mcp): normalize protocol negotiation and JSON-RPC handling

ebc6208

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workflows): return conflict when editable workflow state is missing

7f38fb7

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

feat(mcp): allow disabled server drafts without a url

5556d4b

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(mcp): align server mutations with realtime review sessions

933199d

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

docs(changelog): add June 28 2026 staging changelog

7c61fdf

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(api-key): reject legacy stored api-key rows

908cde9

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

docs(readme): add Copilot-MCP setup instructions

9aef90e

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

greptile-apps Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread apps/tradinggoose/lib/copilot/tools/server/router.ts

BruzWJ closed this Jun 29, 2026

BruzWJ reopened this Jun 29, 2026

BruzWJ and others added 4 commits June 29, 2026 00:11

feat(workflows): persist workflow state through Yjs materialization

036be1d

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

fix(workflows): persist auto-layout durably

711f208

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

test: stabilize workflow and heatmap assertions

f33664e

Co-authored-by: Codex <codex@openai.com> Co-authored-by: BWJ2310 <brucewj2310@gmail.com> Co-authored-by: BWJ2310-backup <jun.1216.wei@gmail.com>

BruzWJ closed this Jun 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(copilot): expose server-managed tools over MCP#156

feat(copilot): expose server-managed tools over MCP#156
BruzWJ wants to merge 284 commits into
stagingfrom
feat/copilot-mcp

BruzWJ commented Jun 24, 2026

Uh oh!

Uh oh!

BruzWJ commented Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

BruzWJ commented Jun 24, 2026

Summary

Why

Affected Areas

Issue Links( if any )

Validation

Risk / Rollout Notes

Config / Data Changes

Screenshots / Video

Checklist

Uh oh!

Uh oh!

BruzWJ commented Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant