morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7438] [Bug] MCP doctor labels a skipped identity probe as a missing package and catalog #4446

New issue

Open

opened 2026-10-31 00:49:51 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:49:51 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7438

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

MCP or agent integration

Observed behavior

Running the production MCP doctor against the production stdio adapter with REA_MCP_TOOL_FAMILIES=native produced a failed server-identity check saying package=missing; catalog=missing. The same report successfully initialized rea@6.8.0 and matched all 32 expected tools. Its request-flow check correctly explained that binary_session was outside the selected scope. The identity request was deliberately skipped, so its failed check labels an unavailable observation as missing identity data.

This was reproduced through the production source functions and actual stdio transport, without mocking the adapter or SDK. The compiled CLI was not executed in this verification; its reachability to the same doctor function was checked in source.

Reproduction

Use a fresh checkout at f8f7ac96de with Node.js 24.22.1 and locked dependencies installed using npm ci. From the repository root, run this target-free source integration probe. It uses the repository's source loader and production adapter entrypoint; no build or target fixture is needed.

probe_home=$(mktemp -d)
HOME="$probe_home" node --input-type=module <<'JS'
import { pathToFileURL } from 'node:url';
const root = process.cwd();
const loader = pathToFileURL(`${root}/scripts/lib/verifier-source-loader.mjs`).href;
const { importVerifierSource } = await import(loader);
const { runProductionMcpDoctor } = await importVerifierSource(
  pathToFileURL(`${root}/src/mcpDoctor.ts`).href, import.meta.url);
const entry = `const { importVerifierSource } = await import(${JSON.stringify(loader)});
const { runEntrypoint } = await importVerifierSource(
  ${JSON.stringify(pathToFileURL(`${root}/src/main.ts`).href)}, import.meta.url);
await runEntrypoint();`;
const report = await runProductionMcpDoctor({
  command: process.execPath,
  args: ['--input-type=module', '--eval', entry],
  cwd: root,
  environment: { HOME: process.env.HOME, PATH: process.env.PATH,
    REA_MCP_TOOL_FAMILIES: 'native' },
});
console.log(JSON.stringify(report));
JS
rm -rf "$probe_home"

Both independent runs reproduced the failed identity check, including a rerun of the command block above. A separate SDK diagnostic can precede the JSON report on stdout; read the final JSON line when examining the output. That stdout diagnostic is outside this report's scope.

Expected behavior

The identity check should identify the scope limitation when binary_session cannot be requested. Expected source: docs/mcp-contracts.md:1415 explicitly covers scopes without session and says doctor explains that limitation instead of reporting a mismatch. docs/mcp-contracts.md:1392 documents family selection as supported input. A missing observation does not establish that the server has a missing or different package/catalog identity.

Impact and scope

P3: the demonstrated defect is misleading diagnostic labeling for the supported native scope. The report already includes the correct limitation in its request-flow check, which callers can consult. No target analysis failure, changed overall health decision, or changed process exit status was established: a scope without session already fails request-flow intentionally. The null observed identity fields alone do not establish a separate defect; the misleading claim is the failed identity check that calls them missing. Other scopes and failed responses from an advertised binary_session tool were not independently exercised.

REA version

rea-agents 6.8.0 from package.json; baseline f8f7ac96de.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; darwin arm64. No external analysis provider was required.

Target and artifact context

Not applicable. This is a target-free production MCP diagnostic with a native-only tool-family selection and an isolated HOME.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

The source integration probe returned the following checks together:

{"name":"initialize","ok":true,"detail":"rea@6.8.0; protocol=2025-11-25"}
{"name":"inventory:tools","ok":true,"detail":"expected=32 observed=32 missing=none unexpected=none duplicates=none"}
{"name":"inventory:prompts","ok":true,"detail":"expected=0 observed=0 missing=none unexpected=none duplicates=none"}
{"name":"server-identity","ok":false,"detail":"package=missing; catalog=missing"}
{"name":"request-flow","ok":false,"detail":"binary_session is outside the selected tool families; include the session family for request-flow and identity checks"}

The report also contained observed_package_version=null and observed_catalog_digest=null. This establishes absent observations, while initialization independently supplied version 6.8.0.

Failure source: src/mcpDoctor.ts:265 skips the identity call based on the expected tool scope; src/mcpDoctor.ts:296 parses its absent result; src/mcpDoctor.ts:314 adds the identity comparison without a scope guard; src/mcpDoctor.ts:338 projects the null observations. CLI reachability is source-derived: scripts/rea.mjs:69 dispatches doctor to runProductionMcpDoctorCli, and src/mcpDoctor.ts:380 starts the production doctor using process.env. The existing no-session test at tests/boundary/mcp/mcpDoctor.test.ts:287 asserts the request-flow explanation but does not assert the identity check's detail.

Typed outcome or recovery expected

An explicit identity-not-observed scope explanation, or omission of the inapplicable identity comparison, would let callers distinguish a skipped probe from a server identity failure. Widening the selected scope to include session is already suggested by the adjacent request-flow check; this report does not require changing that recovery instruction or marking the entire diagnostic healthy.

Additional context

Verified at the stated commit through the production doctor and stdio adapter from source; the compiled CLI was not executed. Related, distinct: #7372 (open) concerns an SDK debug line preceding mcp doctor JSON for tool-family scopes.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7438 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area MCP or agent integration ### Observed behavior Running the production MCP doctor against the production stdio adapter with REA_MCP_TOOL_FAMILIES=native produced a failed server-identity check saying package=missing; catalog=missing. The same report successfully initialized rea@6.8.0 and matched all 32 expected tools. Its request-flow check correctly explained that binary_session was outside the selected scope. The identity request was deliberately skipped, so its failed check labels an unavailable observation as missing identity data. This was reproduced through the production source functions and actual stdio transport, without mocking the adapter or SDK. The compiled CLI was not executed in this verification; its reachability to the same doctor function was checked in source. ### Reproduction Use a fresh checkout at f8f7ac96de8a66a4ab9a23d87e04779bfcd11045 with Node.js 24.22.1 and locked dependencies installed using npm ci. From the repository root, run this target-free source integration probe. It uses the repository's source loader and production adapter entrypoint; no build or target fixture is needed. ```bash probe_home=$(mktemp -d) HOME="$probe_home" node --input-type=module <<'JS' import { pathToFileURL } from 'node:url'; const root = process.cwd(); const loader = pathToFileURL(`${root}/scripts/lib/verifier-source-loader.mjs`).href; const { importVerifierSource } = await import(loader); const { runProductionMcpDoctor } = await importVerifierSource( pathToFileURL(`${root}/src/mcpDoctor.ts`).href, import.meta.url); const entry = `const { importVerifierSource } = await import(${JSON.stringify(loader)}); const { runEntrypoint } = await importVerifierSource( ${JSON.stringify(pathToFileURL(`${root}/src/main.ts`).href)}, import.meta.url); await runEntrypoint();`; const report = await runProductionMcpDoctor({ command: process.execPath, args: ['--input-type=module', '--eval', entry], cwd: root, environment: { HOME: process.env.HOME, PATH: process.env.PATH, REA_MCP_TOOL_FAMILIES: 'native' }, }); console.log(JSON.stringify(report)); JS rm -rf "$probe_home" ``` Both independent runs reproduced the failed identity check, including a rerun of the command block above. A separate SDK diagnostic can precede the JSON report on stdout; read the final JSON line when examining the output. That stdout diagnostic is outside this report's scope. ### Expected behavior The identity check should identify the scope limitation when binary_session cannot be requested. Expected source: docs/mcp-contracts.md:1415 explicitly covers scopes without session and says doctor explains that limitation instead of reporting a mismatch. docs/mcp-contracts.md:1392 documents family selection as supported input. A missing observation does not establish that the server has a missing or different package/catalog identity. ### Impact and scope P3: the demonstrated defect is misleading diagnostic labeling for the supported native scope. The report already includes the correct limitation in its request-flow check, which callers can consult. No target analysis failure, changed overall health decision, or changed process exit status was established: a scope without session already fails request-flow intentionally. The null observed identity fields alone do not establish a separate defect; the misleading claim is the failed identity check that calls them missing. Other scopes and failed responses from an advertised binary_session tool were not independently exercised. ### REA version rea-agents 6.8.0 from package.json; baseline f8f7ac96de8a66a4ab9a23d87e04779bfcd11045. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1; darwin arm64. No external analysis provider was required. ### Target and artifact context Not applicable. This is a target-free production MCP diagnostic with a native-only tool-family selection and an isolated HOME. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence The source integration probe returned the following checks together: ```json {"name":"initialize","ok":true,"detail":"rea@6.8.0; protocol=2025-11-25"} {"name":"inventory:tools","ok":true,"detail":"expected=32 observed=32 missing=none unexpected=none duplicates=none"} {"name":"inventory:prompts","ok":true,"detail":"expected=0 observed=0 missing=none unexpected=none duplicates=none"} {"name":"server-identity","ok":false,"detail":"package=missing; catalog=missing"} {"name":"request-flow","ok":false,"detail":"binary_session is outside the selected tool families; include the session family for request-flow and identity checks"} ``` The report also contained observed_package_version=null and observed_catalog_digest=null. This establishes absent observations, while initialization independently supplied version 6.8.0. Failure source: src/mcpDoctor.ts:265 skips the identity call based on the expected tool scope; src/mcpDoctor.ts:296 parses its absent result; src/mcpDoctor.ts:314 adds the identity comparison without a scope guard; src/mcpDoctor.ts:338 projects the null observations. CLI reachability is source-derived: scripts/rea.mjs:69 dispatches doctor to runProductionMcpDoctorCli, and src/mcpDoctor.ts:380 starts the production doctor using process.env. The existing no-session test at tests/boundary/mcp/mcpDoctor.test.ts:287 asserts the request-flow explanation but does not assert the identity check's detail. ### Typed outcome or recovery expected An explicit identity-not-observed scope explanation, or omission of the inapplicable identity comparison, would let callers distinguish a skipped probe from a server identity failure. Widening the selected scope to include session is already suggested by the adjacent request-flow check; this report does not require changing that recovery instruction or marking the entire diagnostic healthy. ### Additional context Verified at the stated commit through the production doctor and stdio adapter from source; the compiled CLI was not executed. Related, distinct: #7372 (open) concerns an SDK debug line preceding `mcp doctor` JSON for tool-family scopes.

bsakaguchi commented

2026-10-31 00:49:51 +00:00

Author

Owner

@BrownieCoder commented on GitHub (Oct 27, 2026):

I'd like to take this on. I'll update MCP doctor to distinguish an identity probe skipped by the selected tool families from missing identity data, while preserving the current health decision and request-flow recovery guidance. I'll add regression coverage for the restricted scope and check that normal identity validation still works.

@BrownieCoder commented on GitHub (Oct 27, 2026): I'd like to take this on. I'll update MCP doctor to distinguish an identity probe skipped by the selected tool families from missing identity data, while preserving the current health decision and request-flow recovery guidance. I'll add regression coverage for the restricted scope and check that normal identity validation still works.

bsakaguchi referenced this issue

2026-10-31 01:13:00 +00:00

[PR #4446] [MERGED] fix(managed): retain descriptor ownership through hash cancellation #6246

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4446

No description provided.

Rows
Columns