llm_meta_client 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee640298ecdea5af5852a316bf54188f52b3a924380b7dcb28d0fde6a786f679
-  data.tar.gz: 1a35dd306cbb14c0144ea5b5b581ee136caf1b33513ce0ad53559d1015c453c1
+  metadata.gz: 620e720960f5e05d563885fa2e00900311d6a7b4543fa13f9d3c476515edd40c
+  data.tar.gz: 33981d0657e520260b569873c5547e3279eba4325f88a812d8bf28d18941ac88
 SHA512:
-  metadata.gz: 6c61cbaed89ffc56e1e5112cd81895da2434715fb88ff00ab1c6abc8859cd9265d29b3526e84402636adec11b7a99e78318608c1c1ef9c395f3c2a7ecb8df6ec
-  data.tar.gz: f71f3cedabba96f0ba6f336b409cac79b1f30f84c27bd3538857975f3db40d9f7eb2c73300aabbce35b922893c84a6cd351f469893fad01805631ddccf95bcac
+  metadata.gz: a557328075624b4ff7d17eda2ed181e178f5dfda39a23a9f87029141e04b22b78e6f648f81d751f6c92add2f0b54462b28c443bce2d4cf6fcc90f0dee5e1f175
+  data.tar.gz: f5b8ecaeec9af8153d8bbbed4d6056ba5213d267fba01381088d1f53bee80d6f1525d04992b79325476da5ce664976da9ab831844b02828e6b2db9279eb02ef0

data/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] - 2026-03-11
+
+### Added
+
+- MCP (Model Context Protocol) tool selection support:
+  - `ServerResource.fetch_mcp_servers` and `ServerResource.fetch_mcp_tools` for retrieving MCP server/tool data from the LLM service
+  - `Api::McpServersController` with `index` and `tools` endpoints
+  - API routes for MCP servers (`/api/mcp_servers` and `/api/mcp_servers/:uuid/tools`)
+  - `tool_ids` parameter support through `ServerQuery`, `Chat` model, and `ChatsController`
+  - Tool selector UI component (Stimulus controller + view partial) for selecting MCP tools in chat forms
+
+### Changed
+
+- Extracted `authenticated_get` helper in `ServerResource` to reduce duplication in authenticated API calls
+
+### Security
+
+- Escape HTML attribute values (`server.uuid`, `tool.id`) in tool selector to prevent XSS
+- Use `CSS.escape()` for `querySelector` and `encodeURIComponent()` for fetch URLs to prevent selector/URL injection
+
+## [0.3.0] - 2026-03-05
+
+### Changed
+
+- Update Ruby version requirement from 3.4.8 to 4.0.1
+- Update gem dependencies to latest versions
+
+## [0.2.0] - 2026-03-04
+
+### Changed
+
+- Switch configuration to use Rails credentials instead of environment variables
+
+### Documentation
+
+- Update README with architectural details, setup instructions, and Rails credentials usage
+
 ## [0.1.0] - 2026-02-27
 
 ### Added

data/lib/generators/llm_meta_client/scaffold/scaffold_generator.rb

@@ -20,6 +20,7 @@ module LlmMetaClient
       def create_controllers
         template "app/controllers/chats_controller.rb"
         template "app/controllers/prompts_controller.rb"
+        template "app/controllers/api/mcp_servers_controller.rb"
       end
 
       def create_views
@@ -32,6 +33,7 @@ module LlmMetaClient
         template "app/views/shared/_family_field.html.erb"
         template "app/views/shared/_api_key_field.html.erb"
         template "app/views/shared/_model_field.html.erb"
+        template "app/views/shared/_tool_selector_field.html.erb"
         template "app/views/layouts/application.html.erb"
         template "app/views/layouts/_header.html.erb"
         template "app/views/layouts/_sidebar.html.erb"
@@ -41,6 +43,7 @@ module LlmMetaClient
         template "app/javascript/controllers/llm_selector_controller.js"
         template "app/javascript/controllers/chats_form_controller.js"
         template "app/javascript/controllers/chat_title_edit_controller.js"
+        template "app/javascript/controllers/tool_selector_controller.js"
         copy_file "app/javascript/popover.js"
       end
 
@@ -69,6 +72,12 @@ module LlmMetaClient
             end
           end
           resources :prompts, only: [ :show ]
+
+          namespace :api do
+            resources :mcp_servers, only: [ :index ], param: :uuid do
+              get :tools, on: :member
+            end
+          end
         RUBY
       end
 

data/lib/generators/llm_meta_client/scaffold/templates/app/controllers/api/mcp_servers_controller.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class Api::McpServersController < ApplicationController
+  skip_before_action :authenticate_user!, raise: false
+  before_action :authenticate_user!
+
+  def index
+    jwt_token = current_user.id_token
+    mcp_servers = LlmMetaClient::ServerResource.fetch_mcp_servers(jwt_token)
+    render json: { mcp_servers: mcp_servers }
+  end
+
+  def tools
+    jwt_token = current_user.id_token
+    tools = LlmMetaClient::ServerResource.fetch_mcp_tools(jwt_token, params[:uuid])
+    render json: { tools: tools }
+  end
+end

data/lib/generators/llm_meta_client/scaffold/templates/app/controllers/chats_controller.rb

@@ -82,7 +82,7 @@ class ChatsController < ApplicationController
 
       # Send to LLM and get assistant response
       begin
-        @assistant_message = @chat.add_assistant_response(@prompt_execution, jwt_token)
+        @assistant_message = @chat.add_assistant_response(@prompt_execution, jwt_token, tool_ids: tool_ids_param)
         # Generate chat title from the user's prompt (only if title is not yet set)
         @chat.generate_title(params[:message], jwt_token)
       rescue StandardError => e
@@ -172,7 +172,7 @@ class ChatsController < ApplicationController
 
       # Send to LLM and get assistant response
       begin
-        @assistant_message = @chat.add_assistant_response(@prompt_execution, jwt_token)
+        @assistant_message = @chat.add_assistant_response(@prompt_execution, jwt_token, tool_ids: tool_ids_param)
       rescue StandardError => e
         Rails.logger.error "Error in chat response: #{e.class} - #{e.message}\n#{e.backtrace&.join("\n")}"
         @error_message = "An error occurred while getting the response. Please try again."
@@ -185,4 +185,10 @@ class ChatsController < ApplicationController
       format.html { redirect_to new_chat_path }
     end
   end
+
+  private
+
+  def tool_ids_param
+    params[:tool_ids].presence || []
+  end
 end

data/lib/generators/llm_meta_client/scaffold/templates/app/javascript/controllers/tool_selector_controller.js

@@ -0,0 +1,229 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Connects to data-controller="tool-selector"
+export default class extends Controller {
+  static targets = [
+    "toggleButton",
+    "toggleIcon",
+    "countBadge",
+    "panel",
+    "loading",
+    "serverList",
+  ]
+
+  connect() {
+    this.mcpServers = []
+    this.expanded = false
+    this.selectedToolIds = new Set()
+    this.#ensureHiddenFields()
+  }
+
+  toggle() {
+    if (!this.hasPanelTarget) return
+
+    this.expanded = !this.expanded
+    this.panelTarget.style.display = this.expanded ? "block" : "none"
+
+    if (this.hasToggleIconTarget) {
+      this.toggleIconTarget.classList.toggle("bi-chevron-down", !this.expanded)
+      this.toggleIconTarget.classList.toggle("bi-chevron-up", this.expanded)
+    }
+
+    if (this.expanded && this.mcpServers.length === 0) {
+      this.#fetchMcpServers()
+    }
+  }
+
+  toggleServer(event) {
+    const serverUuid = event.currentTarget.dataset.serverUuid
+    const toolsContainer = this.serverListTarget.querySelector(
+      `[data-server-tools="${CSS.escape(serverUuid)}"]`
+    )
+    const icon = event.currentTarget.querySelector(".server-toggle-icon")
+
+    if (!toolsContainer) return
+
+    const isVisible = toolsContainer.style.display !== "none"
+    toolsContainer.style.display = isVisible ? "none" : "block"
+    icon.classList.toggle("bi-chevron-right", isVisible)
+    icon.classList.toggle("bi-chevron-down", !isVisible)
+
+    // Fetch tools if not yet loaded
+    if (
+      !isVisible &&
+      toolsContainer.dataset.loaded !== "true"
+    ) {
+      this.#fetchToolsForServer(serverUuid, toolsContainer)
+    }
+  }
+
+  toggleTool(event) {
+    const toolId = event.currentTarget.value
+    if (event.currentTarget.checked) {
+      this.selectedToolIds.add(toolId)
+    } else {
+      this.selectedToolIds.delete(toolId)
+    }
+    this.#updateCountBadge()
+    this.#updateHiddenFields()
+  }
+
+  async #fetchMcpServers() {
+    this.loadingTarget.style.display = "block"
+    this.serverListTarget.innerHTML = ""
+
+    try {
+      const response = await fetch("/api/mcp_servers", {
+        headers: { Accept: "application/json" },
+      })
+
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status}`)
+      }
+
+      const data = await response.json()
+      this.mcpServers = data.mcp_servers || []
+
+      if (this.mcpServers.length === 0) {
+        this.serverListTarget.innerHTML =
+          '<div class="no-servers">No MCP servers available</div>'
+      } else {
+        this.#renderServerList()
+      }
+    } catch (e) {
+      console.error("Failed to fetch MCP servers:", e)
+      this.serverListTarget.innerHTML =
+        '<div class="no-servers">Failed to load MCP servers</div>'
+    } finally {
+      this.loadingTarget.style.display = "none"
+    }
+  }
+
+  #renderServerList() {
+    this.serverListTarget.innerHTML = ""
+
+    for (const server of this.mcpServers) {
+      if (!server.active) continue
+
+      const serverDiv = document.createElement("div")
+      serverDiv.className = "mcp-server-item"
+      const escapedUuid = this.#escapeAttr(server.uuid)
+      serverDiv.innerHTML = `
+        <div class="mcp-server-header" data-action="click->tool-selector#toggleServer" data-server-uuid="${escapedUuid}">
+          <i class="bi bi-chevron-right server-toggle-icon"></i>
+          <i class="bi bi-server"></i>
+          <span class="mcp-server-name">${this.#escapeHtml(server.name)}</span>
+          ${server.tools && server.tools.length > 0 ? `<span class="tool-available-count">${server.tools.filter((t) => t.active).length} tools</span>` : ""}
+        </div>
+        <div class="mcp-server-tools" data-server-tools="${escapedUuid}" style="display: none;" data-loaded="${server.tools && server.tools.length > 0 ? "true" : "false"}">
+          ${server.tools && server.tools.length > 0 ? this.#renderTools(server.tools) : '<div class="tool-loading-inline">Click to load tools...</div>'}
+        </div>
+      `
+      this.serverListTarget.appendChild(serverDiv)
+    }
+  }
+
+  #renderTools(tools) {
+    const activeTools = tools.filter((t) => t.active)
+    if (activeTools.length === 0) {
+      return '<div class="no-tools">No active tools</div>'
+    }
+
+    return activeTools
+      .map(
+        (tool) => `
+      <label class="tool-item">
+        <input type="checkbox"
+               value="${this.#escapeAttr(String(tool.id))}"
+               data-action="change->tool-selector#toggleTool"
+               ${this.selectedToolIds.has(String(tool.id)) ? "checked" : ""}>
+        <div class="tool-info">
+          <span class="tool-name">${this.#escapeHtml(tool.name)}</span>
+          ${tool.description ? `<span class="tool-description">${this.#escapeHtml(tool.description)}</span>` : ""}
+        </div>
+      </label>
+    `
+      )
+      .join("")
+  }
+
+  async #fetchToolsForServer(serverUuid, container) {
+    container.innerHTML =
+      '<div class="tool-loading-inline">Loading tools...</div>'
+
+    try {
+      const response = await fetch(
+        `/api/mcp_servers/${encodeURIComponent(serverUuid)}/tools`,
+        {
+          headers: { Accept: "application/json" },
+        }
+      )
+
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status}`)
+      }
+
+      const data = await response.json()
+      const tools = data.tools || []
+
+      container.dataset.loaded = "true"
+      container.innerHTML = this.#renderTools(tools)
+
+      // Update cached server data
+      const server = this.mcpServers.find((s) => s.uuid === serverUuid)
+      if (server) {
+        server.tools = tools
+      }
+    } catch (e) {
+      console.error("Failed to fetch tools:", e)
+      container.innerHTML =
+        '<div class="no-tools">Failed to load tools</div>'
+    }
+  }
+
+  #updateCountBadge() {
+    const count = this.selectedToolIds.size
+    this.countBadgeTarget.textContent = count
+    this.countBadgeTarget.style.display = count > 0 ? "inline-block" : "none"
+  }
+
+  #ensureHiddenFields() {
+    // Container for hidden tool_ids fields
+    let container = this.element.querySelector(".tool-ids-hidden-fields")
+    if (!container) {
+      container = document.createElement("div")
+      container.className = "tool-ids-hidden-fields"
+      container.style.display = "none"
+      this.element.appendChild(container)
+    }
+  }
+
+  #updateHiddenFields() {
+    const container = this.element.querySelector(".tool-ids-hidden-fields")
+    if (!container) return
+
+    container.innerHTML = ""
+    for (const toolId of this.selectedToolIds) {
+      const input = document.createElement("input")
+      input.type = "hidden"
+      input.name = "tool_ids[]"
+      input.value = toolId
+      container.appendChild(input)
+    }
+  }
+
+  #escapeHtml(text) {
+    const div = document.createElement("div")
+    div.textContent = text
+    return div.innerHTML
+  }
+
+  #escapeAttr(text) {
+    return String(text)
+      .replace(/&/g, "&amp;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&#39;")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+  }
+}

data/lib/generators/llm_meta_client/scaffold/templates/app/models/chat.rb

@@ -67,8 +67,8 @@ class Chat < ApplicationRecord
   end
 
   # Add assistant response by sending to LLM
-  def add_assistant_response(prompt_execution, jwt_token)
-    response_content = send_to_llm(jwt_token)
+  def add_assistant_response(prompt_execution, jwt_token, tool_ids: [])
+    response_content = send_to_llm(jwt_token, tool_ids: tool_ids)
     prompt_execution.update!(
       llm_platform: llm_type(jwt_token),
       response: response_content
@@ -122,7 +122,7 @@ class Chat < ApplicationRecord
   end
 
   # Send messages to LLM and get response
-  def send_to_llm(jwt_token)
+  def send_to_llm(jwt_token, tool_ids: [])
     # Get LLM options
     llm_options = LlmMetaClient::ServerResource.available_llm_options(jwt_token)
 
@@ -148,7 +148,7 @@ class Chat < ApplicationRecord
 
     summarized_context += "Additional prompt: Responses from the assistant must consist solely of the response body."
 
-    # Send chat request using LlmMetaServerQuery
-    LlmMetaClient::ServerQuery.new.call(jwt_token, llm_uuid, model, summarized_context, prompt)
+    # Send chat request using LlmMetaClient::ServerQuery
+    LlmMetaClient::ServerQuery.new.call(jwt_token, llm_uuid, model, summarized_context, prompt, tool_ids: tool_ids)
   end
 end

data/lib/generators/llm_meta_client/scaffold/templates/app/views/chats/edit.html.erb

@@ -15,6 +15,9 @@
           <%%= render "shared/api_key_field", stimulus_controller: "llm-selector" %>
           <%%= render "shared/model_field", stimulus_controller: "llm-selector" %>
         </div>
+        <%% if user_signed_in? %>
+          <%%= render "shared/tool_selector_field", stimulus_controller: "tool-selector" %>
+        <%% end %>
       <%% end %>
       <div class="input-wrapper">
         <%%= f.text_area :message,

data/lib/generators/llm_meta_client/scaffold/templates/app/views/chats/new.html.erb

@@ -15,6 +15,9 @@
           <%%= render "shared/api_key_field", stimulus_controller: "llm-selector" %>
           <%%= render "shared/model_field", stimulus_controller: "llm-selector" %>
         </div>
+        <%% if user_signed_in? %>
+          <%%= render "shared/tool_selector_field", stimulus_controller: "tool-selector" %>
+        <%% end %>
       <%% end %>
       <div class="input-wrapper">
         <%%= f.text_area :message,

data/lib/generators/llm_meta_client/scaffold/templates/app/views/shared/_tool_selector_field.html.erb

@@ -0,0 +1,23 @@
+<%%
+  stimulus_controller = local_assigns[:stimulus_controller] || "tool-selector"
+%>
+<div class="tool-selector-field" data-controller="<%%= stimulus_controller %>">
+  <div class="tool-selector-toggle">
+    <button type="button"
+            class="tool-toggle-button"
+            data-<%%= stimulus_controller %>-target="toggleButton"
+            data-action="click-><%%= stimulus_controller %>#toggle">
+      <i class="bi bi-tools"></i>
+      Tools
+      <span class="tool-count-badge" data-<%%= stimulus_controller %>-target="countBadge" style="display: none;">0</span>
+      <i class="bi bi-chevron-down toggle-icon" data-<%%= stimulus_controller %>-target="toggleIcon"></i>
+    </button>
+  </div>
+  <div class="tool-selector-panel" data-<%%= stimulus_controller %>-target="panel" style="display: none;">
+    <div class="tool-loading" data-<%%= stimulus_controller %>-target="loading" style="display: none;">
+      Loading tools...
+    </div>
+    <div class="mcp-server-list" data-<%%= stimulus_controller %>-target="serverList">
+    </div>
+  </div>
+</div>

data/lib/llm_meta_client/server_query.rb

@@ -1,11 +1,11 @@
 module LlmMetaClient
   class ServerQuery
-    def call(id_token, api_key_uuid, model_id, context, user_content)
+    def call(id_token, api_key_uuid, model_id, context, user_content, tool_ids: [])
       debug_log "Context: #{context}"
       context_and_user_content = "Context:#{context}, User Prompt: #{user_content}"
       debug_log "Request to LLM: \n===>\n#{context_and_user_content}\n===>"
 
-      response = request(api_key_uuid, id_token, model_id, context_and_user_content)
+      response = request(api_key_uuid, id_token, model_id, context_and_user_content, tool_ids)
 
       raise Exceptions::ServerError, "LLM server returned HTTP #{response.code}" unless response.success?
 
@@ -28,14 +28,17 @@ module LlmMetaClient
       Rails.logger.info(message) if Rails.env.development?
     end
 
-    def request(api_key_uuid, id_token, model_id, user_content)
+    def request(api_key_uuid, id_token, model_id, user_content, tool_ids)
       headers = { "Content-Type" => "application/json" }
       headers["Authorization"] = "Bearer #{id_token}" if id_token.present?
 
+      body = { prompt: user_content.to_s }
+      body[:tool_ids] = tool_ids if tool_ids.present?
+
       HTTParty.post(
         url(api_key_uuid, model_id),
         headers: headers,
-        body: { prompt: "#{user_content}" }.to_json,
+        body: body.to_json,
         timeout: 300 # 5 minute timeout setting (both read and connect)
       )
     end

data/lib/llm_meta_client/server_resource.rb

@@ -53,6 +53,38 @@ module LlmMetaClient
         build_families(ollama_opts, api_keys)
       end
 
+      def fetch_mcp_servers(jwt_token)
+        return [] if jwt_token.blank?
+
+        response = authenticated_get(jwt_token, "api/mcp_servers")
+
+        if response.success?
+          response.parsed_response["mcp_servers"] || []
+        else
+          Rails.logger.error "Failed to fetch MCP servers: HTTP #{response.code}"
+          []
+        end
+      rescue StandardError => e
+        Rails.logger.error "Error fetching MCP servers: #{e.class} - #{e.message}"
+        []
+      end
+
+      def fetch_mcp_tools(jwt_token, mcp_server_uuid)
+        return [] if jwt_token.blank? || mcp_server_uuid.blank?
+
+        response = authenticated_get(jwt_token, "api/mcp_servers/#{mcp_server_uuid}/tools")
+
+        if response.success?
+          response.parsed_response["tools"] || []
+        else
+          Rails.logger.error "Failed to fetch MCP tools for #{mcp_server_uuid}: HTTP #{response.code}"
+          []
+        end
+      rescue StandardError => e
+        Rails.logger.error "Error fetching MCP tools: #{e.class} - #{e.message}"
+        []
+      end
+
       private
 
       def build_families(ollama_opts, api_keys)
@@ -110,10 +142,7 @@ module LlmMetaClient
       end
 
       def llm_api_keys(jwt_token)
-        api_url = "#{Rails.configuration.llm_service_base_url}/api/llm_api_keys"
-        headers = { "Content-Type" => "application/json", "Authorization" => "Bearer #{jwt_token}" }
-
-        response = HTTParty.get api_url, headers: headers
+        response = authenticated_get(jwt_token, "api/llm_api_keys")
 
         if response.success?
           response.parsed_response["llm_api_keys"] || []
@@ -122,6 +151,15 @@ module LlmMetaClient
           []
         end
       end
+
+      def authenticated_get(jwt_token, path)
+        api_url = "#{Rails.configuration.llm_service_base_url}/#{path}"
+        headers = {
+          "Content-Type" => "application/json",
+          "Authorization" => "Bearer #{jwt_token}"
+        }
+        HTTParty.get(api_url, headers: headers)
+      end
     end
   end
 end

data/lib/llm_meta_client/version.rb

@@ -1,3 +1,3 @@
 module LlmMetaClient
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: llm_meta_client
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - dhq_boiler
@@ -101,11 +101,13 @@ files:
 - lib/generators/llm_meta_client/authentication/templates/config/locales/devise.en.yml
 - lib/generators/llm_meta_client/authentication/templates/db/migrate/create_users.rb
 - lib/generators/llm_meta_client/scaffold/scaffold_generator.rb
+- lib/generators/llm_meta_client/scaffold/templates/app/controllers/api/mcp_servers_controller.rb
 - lib/generators/llm_meta_client/scaffold/templates/app/controllers/chats_controller.rb
 - lib/generators/llm_meta_client/scaffold/templates/app/controllers/prompts_controller.rb
 - lib/generators/llm_meta_client/scaffold/templates/app/javascript/controllers/chat_title_edit_controller.js
 - lib/generators/llm_meta_client/scaffold/templates/app/javascript/controllers/chats_form_controller.js
 - lib/generators/llm_meta_client/scaffold/templates/app/javascript/controllers/llm_selector_controller.js
+- lib/generators/llm_meta_client/scaffold/templates/app/javascript/controllers/tool_selector_controller.js
 - lib/generators/llm_meta_client/scaffold/templates/app/javascript/popover.js
 - lib/generators/llm_meta_client/scaffold/templates/app/models/chat.rb
 - lib/generators/llm_meta_client/scaffold/templates/app/models/message.rb
@@ -121,6 +123,7 @@ files:
 - lib/generators/llm_meta_client/scaffold/templates/app/views/shared/_api_key_field.html.erb
 - lib/generators/llm_meta_client/scaffold/templates/app/views/shared/_family_field.html.erb
 - lib/generators/llm_meta_client/scaffold/templates/app/views/shared/_model_field.html.erb
+- lib/generators/llm_meta_client/scaffold/templates/app/views/shared/_tool_selector_field.html.erb
 - lib/generators/llm_meta_client/scaffold/templates/config/initializers/llm_service.rb
 - lib/generators/llm_meta_client/scaffold/templates/db/migrate/create_chats.rb
 - lib/generators/llm_meta_client/scaffold/templates/db/migrate/create_messages.rb