Repository navigation
Run the command surface on the hosted MCP through the CLI SDK #1899
Description
Part of #1357. Plan: cli-first-mcp tasks 6.4 and 6.5 (design, tasks). Depends on #1882, #1897, #1898, #1890.
Scope
- In
mcp-cloudflare's Hono app, create one SDK instance per request with the OAuth grant's token and the session constraints, persistence off. - Serve
search_sentryand the execute tools fromcommand-catalog.json, next to the catalog, listing only commands the hosted build can run.
Done when
- Workers tests for an exposed read command, a write command, and constraint pinning.
- The test(mcp): add HTTP Code Mode agent evaluations #1675 harness runs against the command surface.
Spike findings (#1882)
The SDK bundles and runs on workerd; 10 core command calls pass cold and warm after small fixes. Needed here:
- Compatibility date 2026-01-28 or later. Every date up to 2026-01-01 fails (pngjs calls
util.inheritson a stream class older polyfills lack). Check the rest of the hosted worker on the new date. - A hosted entry point whose route loaders cover only exposed commands.
ROUTE_LOADERSimports every command today, which pulls in the Ink sidecar (lib/init/ui/ink-ui.ts,with { type: "file" }) that wrangler can't bundle, and roughly half the bundle is code hosted never runs (highlight.js, thesentry mcpserver stack,init's AI libraries,@sentry/node). - Build fixes: define
import.meta.url(11 modules callcreateRequire(import.meta.url)at load), and add acreateRequirebanner for CommonJS deps ("Dynamic require of util"). - Size: 6,971 KiB raw / 1,989 KiB gzip minified (hosted today: 5,092 / 975). Limit is 64 MiB uncompressed. Startup CPU ~65 ms; first call in a fresh isolate 155–215 ms, warm 6–28 ms.
trace viewmakes one request per span (853 on a large fixture): under the subrequest limit, but slow. Worth a batched path before hosted serves it.- Commands that fall back to DSN detection need org and project from the session constraints.
via @BYK.
--
Activity
linear-code commentedon Nov 3, 2026
MCP-1177
sentry-junior commentedon Nov 3, 2026
#1918 (merged, 77edf6b) changes how the hosted entry point should be built. The workerd spike (#1882) planned a hosted variant of the generated
route-loaders.ts. That generator is gone.src/command-manifest.ts(COMMAND_MANIFEST) now holds animport()loader for every top-level route, andsdk-app.tsloads only the routes a call runs.The hosted bundle still can't use
sdk-app.tsas it is:app-for-args.tsimportsCOMMAND_MANIFEST, whose loaders are literalimport()s. Bundlers follow those, so the bundle still includesinit(and its Ink sidecar, which wrangler can't bundle),wasm-split,sourcemap,debug-filesand the rest. Filtering the manifest at runtime doesn't shrink the bundle.loadSdkAppfalls back toimport("./app.js")forhelp,schema,cliand unknown names, which pulls in the whole tree.Proposed approach:
COMMAND_MANIFESTwhose top-level route has at least oneexposedcommand incommand-catalog.json(feat(cli): Generate command-catalog.json from the route tree #1919). A test keeps the two in sync, the same waycommand-manifest.test.tschecksapp.ts.loadSdkApp/createSentrySDKtake a manifest, with no full-app fallback. On hosted, a name outside the manifest is refused instead of loadingapp.js.release,replay,event,react-native) still bundle their stdio-only subcommands, and the executor refuses them. Check that those modules have no load-time Node-only work.The module-level
loadedcache insdk-app.tsholds only route code, so sharing it across requests looks safe. It still belongs on #1898's audit list.sentry-junior commentedon Nov 3, 2026
Correction to my previous comment, checked against the #1919 catalog.
react-nativeisn't a mixed group: every subcommand in it is stdio-only. Only four groups are mixed:authlist,statuseventsendreleasepropose-version,set-commitsreplaydownloadThat's 6 subcommands, about 1.6k lines. None of them does Node-only work when it loads. They import
lib/db,lib/git,node:fs/promisesand@sentry/core, which the bundle needs for other commands anyway. Twelve top-level routes are entirely stdio-only and drop out of the hosted manifest:build,cli,code-mappings,dart-symbol-map,debug-files,info,init,proguard,react-native,snapshots,sourcemapandwasm-split.