rootly-mcp-server 2.2.10__tar.gz → 2.2.12__tar.gz

{rootly_mcp_server-2.2.10 → rootly_mcp_server-2.2.12}/.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main, staging]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true

{rootly_mcp_server-2.2.10 → rootly_mcp_server-2.2.12}/.github/workflows/pypi-release.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
@@ -31,4 +34,4 @@ jobs:
           TWINE_USERNAME: __token__
           TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
         run: |
-          twine upload dist/* 
+          twine upload dist/* 

{rootly_mcp_server-2.2.10 → rootly_mcp_server-2.2.12}/.gitignore

@@ -193,5 +193,6 @@ test_output/
 *.md
 !README.md
 !CONTRIBUTING.md
-!CHANGELOG.md.beads/
+!CHANGELOG.md
+.beads/
 .mcp.json

rootly_mcp_server-2.2.12/CHANGELOG.md

@@ -0,0 +1,153 @@
+# Changelog
+
+All notable changes to the Rootly MCP Server will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+- Gemini CLI extension support via `gemini-extension.json` manifest
+- Gemini CLI installation instructions in README
+
+## [2.1.1] - 2026-02-04
+
+### Fixed
+- Fixed parameter transformation bug where filter parameters (e.g., `filter_status`, `filter_services`) were not being transformed back to their API format (`filter[status]`, `filter[services]`) when making requests to the Rootly API
+- Root cause: The inner httpx client was being passed to FastMCP instead of the AuthenticatedHTTPXClient wrapper, bypassing the `_transform_params` method
+- Thanks to @smoya for reporting this issue in PR #29
+
+## [2.1.0] - 2026-01-27
+
+### Added
+
+#### Security Improvements
+- Comprehensive security module (`security.py`) with:
+  - API token validation (prevents invalid/short tokens)
+  - HTTPS enforcement for all API calls (rejects HTTP URLs)
+  - Input sanitization (SQL injection and XSS prevention)
+  - Rate limiting using token bucket algorithm (default: 100 req/min)
+  - Error message sanitization (removes stack traces and file paths)
+  - Sensitive data masking for logs (tokens, passwords, secrets)
+  - URL validation with allowed domain checking
+
+#### Exception Handling
+- Custom exception hierarchy (`exceptions.py`) with 11 specific exception types:
+  - `RootlyAuthenticationError` - 401 authentication failures
+  - `RootlyAuthorizationError` - 403 access denied
+  - `RootlyNetworkError` - Network/connection issues
+  - `RootlyTimeoutError` - Request timeouts
+  - `RootlyValidationError` - Input validation failures
+  - `RootlyRateLimitError` - Rate limit exceeded (with retry_after)
+  - `RootlyAPIError` - Generic API errors
+  - `RootlyServerError` - 5xx server errors
+  - `RootlyClientError` - 4xx client errors
+  - `RootlyConfigurationError` - Missing/invalid configuration
+  - `RootlyResourceNotFoundError` - 404 not found
+- Automatic exception categorization with `categorize_exception()`
+
+#### Input Validation
+- Input validation utilities (`validators.py`) with:
+  - Positive integer validation
+  - String validation with length and pattern checks
+  - Dictionary validation with required keys
+  - Enum value validation
+  - Pagination parameter validation
+
+#### Monitoring & Observability
+- Structured JSON logging with correlation IDs (`monitoring.py`)
+- Request metrics tracking:
+  - Request counts by endpoint and status code
+  - Response latency percentiles (p50, p95, p99)
+  - Error rate tracking by type
+  - Active connection monitoring
+- Health check support with `get_health_status()`
+- Request/response logging decorator (automatically sanitizes sensitive data)
+- Context manager for tracking request metrics
+
+#### Helper Utilities
+- Pagination helpers (`pagination.py`):
+  - Async pagination across multiple pages
+  - Pagination parameter building for Rootly API
+  - Pagination metadata extraction
+
+#### Testing Infrastructure
+- 66 comprehensive unit tests (100% passing)
+- Test coverage >90% for all new modules
+- Security-focused tests:
+  - SQL injection prevention
+  - XSS prevention
+  - Rate limiting behavior
+  - Token validation
+  - HTTPS enforcement
+  - Error message sanitization
+
+#### CI/CD Pipeline
+- GitHub Actions workflow (`.github/workflows/ci.yml`) with:
+  - Automated testing on Python 3.10, 3.11, 3.12
+  - Code coverage reporting (Codecov integration)
+  - Automated linting (ruff, black, isort, mypy)
+  - Security scanning (bandit, safety)
+  - Automated package building
+  - Runs on every push and pull request
+
+### Changed
+
+#### Security Enhancements
+- **BREAKING SECURITY FIX**: Removed all API token logging from `__main__.py` (line 100, 116)
+  - Changed from: `logger.debug(f"Token starts with: {api_token[:5]}...")`
+  - Changed to: `logger.info("ROOTLY_API_TOKEN is configured")`
+- **SECURITY**: Updated `client.py` to use structured logging without exposing tokens
+- **SECURITY**: All error messages now sanitized to remove stack traces
+- Replaced generic `except Exception` with specific exception types in:
+  - `__main__.py` - Now catches `RootlyConfigurationError`, `RootlyMCPError`
+  - `client.py` - Now catches specific HTTP errors and categorizes them
+
+#### API Client Improvements
+- `RootlyClient.make_request()` now raises specific exceptions instead of returning JSON errors
+- Added HTTPS enforcement to base URL validation
+- Added 30-second timeout to all requests (already existed, now enforced everywhere)
+- Better error categorization for HTTP status codes (401, 403, 404, 429, 4xx, 5xx)
+
+#### Configuration Validation
+- API token now validated on startup with `validate_api_token()`
+- Better error messages for missing or invalid configuration
+
+### Fixed
+
+- Security vulnerability: API tokens no longer logged (even partially)
+- Security vulnerability: Stack traces no longer exposed in error responses
+- Security vulnerability: HTTP URLs now rejected (HTTPS enforced)
+- Generic exception handling replaced with specific exception types
+- Error messages now user-friendly (sanitized of internal details)
+
+### Documentation
+
+- Added `IMPLEMENTATION_REPORT.md` - Detailed implementation summary
+- Added `GPT4O_REVIEW.md` - External review of improvements
+- Added `IMPLEMENTATION_CHECKLIST.md` - Implementation progress tracking
+- Updated `IMPROVEMENT_PLAN.md` with GPT-4o recommendations
+- All new modules have comprehensive docstrings
+- Updated package docstring with new features
+
+### Technical Details
+
+- **Lines of Code Added**: ~1,500 lines production code, ~500 lines test code
+- **Test Coverage**: >90% for new modules
+- **Tests Passing**: 66/66 (100%)
+- **Security Issues Fixed**: 6 critical vulnerabilities
+- **Breaking Changes**: 0 (fully backward compatible)
+
+### Backward Compatibility
+
+All changes are backward compatible:
+- Existing API unchanged
+- New modules are additive
+- Exception hierarchy maintains base `Exception` compatibility
+- Client behavior unchanged from external perspective
+- No migration required for existing users
+
+## [2.0.15] - Previous Release
+
+(Previous changelog entries would go here)

{rootly_mcp_server-2.2.10 → rootly_mcp_server-2.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.2.10
+Version: 2.2.12
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues
@@ -30,7 +30,7 @@ Requires-Dist: requests==2.32.5
 Requires-Dist: scikit-learn>=1.3.0
 Provides-Extra: dev
 Requires-Dist: bandit>=1.7.0; extra == 'dev'
-Requires-Dist: black>=23.0.0; extra == 'dev'
+Requires-Dist: black>=26.3.1; extra == 'dev'
 Requires-Dist: isort>=5.0.0; extra == 'dev'
 Requires-Dist: mypy>=1.0.0; extra == 'dev'
 Requires-Dist: pip-audit>=2.7.0; extra == 'dev'
@@ -55,6 +55,8 @@ The fastest way to get started is to connect to our hosted MCP server — no ins
 
 ### Claude Code
 
+**Hosted Server (Recommended)**
+
 ```bash
 claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
@@ -74,6 +76,26 @@ claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
+**Manual Configuration**
+
+Alternatively, create `.mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "type": "sse",
+      "url": "https://mcp.rootly.com/sse",
+      "headers": {
+        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
+      }
+    }
+  }
+}
+```
+
+Then restart Claude Code so it reloads the updated configuration.
+
 ### Gemini CLI
 
 Install the extension:
@@ -295,7 +317,7 @@ docker run -p 8000:8000 \
 
 ## Supported Tools
 
-The default server configuration currently exposes **99 tools** (including custom agentic tools and OpenAPI-generated tools).
+The default server configuration currently exposes **101 tools** (including custom agentic tools and OpenAPI-generated tools).
 
 ### Custom Agentic Tools
 
@@ -303,6 +325,7 @@ The default server configuration currently exposes **99 tools** (including custo
 - `check_responder_availability`
 - `create_override_recommendation`
 - `find_related_incidents`
+- `getIncident` - retrieve a single incident for direct verification, including PIR-related fields
 - `get_alert_by_short_id`
 - `get_oncall_handoff_summary`
 - `get_oncall_schedule_summary`
@@ -313,6 +336,7 @@ The default server configuration currently exposes **99 tools** (including custo
 - `list_shifts`
 - `search_incidents`
 - `suggest_solutions`
+- `updateIncident` - scoped incident update tool for `summary` and `retrospective_progress_status`
 
 ### OpenAPI-Generated Tools
 

{rootly_mcp_server-2.2.10 → rootly_mcp_server-2.2.12}/README.md

@@ -16,6 +16,8 @@ The fastest way to get started is to connect to our hosted MCP server — no ins
 
 ### Claude Code
 
+**Hosted Server (Recommended)**
+
 ```bash
 claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
@@ -35,6 +37,26 @@ claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
+**Manual Configuration**
+
+Alternatively, create `.mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "type": "sse",
+      "url": "https://mcp.rootly.com/sse",
+      "headers": {
+        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
+      }
+    }
+  }
+}
+```
+
+Then restart Claude Code so it reloads the updated configuration.
+
 ### Gemini CLI
 
 Install the extension:
@@ -256,7 +278,7 @@ docker run -p 8000:8000 \
 
 ## Supported Tools
 
-The default server configuration currently exposes **99 tools** (including custom agentic tools and OpenAPI-generated tools).
+The default server configuration currently exposes **101 tools** (including custom agentic tools and OpenAPI-generated tools).
 
 ### Custom Agentic Tools
 
@@ -264,6 +286,7 @@ The default server configuration currently exposes **99 tools** (including custo
 - `check_responder_availability`
 - `create_override_recommendation`
 - `find_related_incidents`
+- `getIncident` - retrieve a single incident for direct verification, including PIR-related fields
 - `get_alert_by_short_id`
 - `get_oncall_handoff_summary`
 - `get_oncall_schedule_summary`
@@ -274,6 +297,7 @@ The default server configuration currently exposes **99 tools** (including custo
 - `list_shifts`
 - `search_incidents`
 - `suggest_solutions`
+- `updateIncident` - scoped incident update tool for `summary` and `retrospective_progress_status`
 
 ### OpenAPI-Generated Tools
 

{rootly_mcp_server-2.2.10 → rootly_mcp_server-2.2.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.2.10"
+version = "2.2.12"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -70,7 +70,7 @@ rootly-mcp-server = "rootly_mcp_server.__main__:main"
 
 [project.optional-dependencies]
 dev = [
-    "black>=23.0.0",
+    "black>=26.3.1",
     "isort>=5.0.0",
     "mypy>=1.0.0",
     "types-requests>=2.32.0",

rootly_mcp_server-2.2.12/src/rootly_mcp_server/code_mode.py

@@ -0,0 +1,165 @@
+"""Code Mode helpers for exposing a third MCP endpoint."""
+
+from __future__ import annotations
+
+import importlib
+import os
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Any
+
+from fastmcp.experimental.transforms.code_mode import (
+    CodeMode,
+    GetSchemas,
+    GetTags,
+    ListTools,
+    MontySandboxProvider,
+    Search,
+    _ensure_async,
+)
+
+from .server import create_rootly_mcp_server
+
+if TYPE_CHECKING:
+    from fastmcp import FastMCP
+
+
+DEFAULT_CODE_MODE_PATH = "/mcp-codemode"
+
+
+def _normalize_http_path(path: str) -> str:
+    """Normalize hosted HTTP path values for reliable comparisons."""
+    if not path:
+        return "/"
+    normalized = path if path.startswith("/") else f"/{path}"
+    if len(normalized) > 1:
+        normalized = normalized.rstrip("/")
+    return normalized
+
+
+def normalize_code_mode_path(path: str) -> str:
+    """Normalize a hosted Code Mode path value."""
+    return _normalize_http_path(path)
+
+
+def code_mode_enabled_from_env(default: bool = True) -> bool:
+    """Return whether hosted Code Mode exposure is enabled.
+
+    Code Mode defaults on for hosted dual-transport deployments unless explicitly disabled.
+    """
+    raw = os.getenv("ROOTLY_CODE_MODE_ENABLED")
+    if raw is None:
+        return default
+    return raw.lower() in ("1", "true", "yes")
+
+
+def code_mode_path_from_env() -> str:
+    """Return the configured hosted Code Mode path."""
+    return normalize_code_mode_path(os.getenv("ROOTLY_CODE_MODE_PATH", DEFAULT_CODE_MODE_PATH))
+
+
+class CompatibleMontySandboxProvider(MontySandboxProvider):
+    """Monty sandbox provider that tolerates older constructor signatures.
+
+    Some deployed environments can end up with a Monty runtime that supports
+    ``run_monty_async(..., external_functions=...)`` but still rejects the
+    newer ``Monty(..., external_functions=[...])`` constructor argument. This
+    provider falls back to the older constructor form so Code Mode execution
+    continues to work during mixed-version rollouts.
+    """
+
+    @staticmethod
+    def _build_monty_runner(
+        pydantic_monty: Any,
+        code: str,
+        *,
+        input_names: list[str],
+        external_function_names: list[str],
+    ) -> Any:
+        try:
+            return pydantic_monty.Monty(
+                code,
+                inputs=input_names,
+                external_functions=external_function_names,
+            )
+        except TypeError as exc:
+            if "external_functions" not in str(exc):
+                raise
+            return pydantic_monty.Monty(code, inputs=input_names)
+
+    async def run(
+        self,
+        code: str,
+        *,
+        inputs: dict[str, Any] | None = None,
+        external_functions: dict[str, Callable[..., Any]] | None = None,
+    ) -> Any:
+        try:
+            pydantic_monty = importlib.import_module("pydantic_monty")
+        except ModuleNotFoundError as exc:
+            raise ImportError(
+                "CodeMode requires pydantic-monty for the Monty sandbox provider. "
+                "Install it with `fastmcp[code-mode]` or pass a custom SandboxProvider."
+            ) from exc
+
+        inputs = inputs or {}
+        async_functions = {
+            key: _ensure_async(value)
+            for key, value in (external_functions or {}).items()
+        }
+
+        monty = self._build_monty_runner(
+            pydantic_monty,
+            code,
+            input_names=list(inputs.keys()),
+            external_function_names=list(async_functions.keys()),
+        )
+        run_kwargs: dict[str, Any] = {"external_functions": async_functions}
+        if inputs:
+            run_kwargs["inputs"] = inputs
+        if self.limits is not None:
+            run_kwargs["limits"] = self.limits
+        return await pydantic_monty.run_monty_async(monty, **run_kwargs)
+
+
+def build_code_mode_transform() -> CodeMode:
+    """Build the shared Code Mode transform used by hosted deployments."""
+    return CodeMode(
+        sandbox_provider=CompatibleMontySandboxProvider(),
+        discovery_tools=[
+            ListTools(default_detail="brief"),
+            Search(name="tool_search", default_detail="detailed", default_limit=12),
+            GetSchemas(default_detail="detailed"),
+            GetTags(default_detail="brief"),
+        ],
+        execute_description=(
+            "Write a short async Python block and chain await call_tool(name, params) calls "
+            "to complete a Rootly workflow. Use tool_search only to discover tools and their "
+            "schemas, then call the actual Rootly tool with the exact parameter names shown in "
+            "the schema. For paginated data tools, pass pagination arguments like page_size, "
+            "page_number, and max_results exactly as documented by that tool instead of inventing "
+            "alternatives like per_page. Prefer Rootly's higher-level custom tools when they fit "
+            "the task, then fall back to lower-level API tools as needed. Example: "
+            "await call_tool('search_incidents', {'query': '', 'page_size': 1, 'page_number': 1, "
+            "'max_results': 1}). Use return to emit the final result."
+        ),
+    )
+
+
+def create_rootly_codemode_server(
+    swagger_path: str | None = None,
+    name: str = "Rootly Code Mode",
+    allowed_paths: list[str] | None = None,
+    hosted: bool = False,
+    base_url: str | None = None,
+) -> FastMCP:
+    """Create a Rootly MCP server instance wrapped with Code Mode."""
+    mcp: FastMCP = create_rootly_mcp_server(
+        swagger_path=swagger_path,
+        name=name,
+        allowed_paths=allowed_paths,
+        hosted=hosted,
+        base_url=base_url,
+        transport="streamable-http",
+    )
+    mcp.add_transform(build_code_mode_transform())
+    return mcp

{rootly_mcp_server-2.2.10 → rootly_mcp_server-2.2.12}/src/rootly_mcp_server/tools/incidents.py

@@ -14,6 +14,11 @@ MakeAuthenticatedRequest = Callable[..., Awaitable[Any]]
 StripHeavyNestedData = Callable[[JsonDict], JsonDict]
 GenerateRecommendation = Callable[[JsonDict], str]
 
+RETROSPECTIVE_PROGRESS_STATUSES = ("not_started", "active", "completed", "skipped")
+INCIDENT_SEARCH_FIELDS = (
+    "id,title,summary,status,created_at,updated_at,url,started_at,retrospective_progress_status"
+)
+
 
 def register_incident_tools(
     mcp: Any,
@@ -60,7 +65,7 @@ def register_incident_tools(
                 "page[size]": page_size,  # Use requested page size (already limited to max 20)
                 "page[number]": page_number,
                 "include": "",
-                "fields[incidents]": "id,title,summary,status,created_at,updated_at,url,started_at",
+                "fields[incidents]": INCIDENT_SEARCH_FIELDS,
             }
             if query:
                 params["filter[search]"] = query
@@ -85,7 +90,7 @@ def register_incident_tools(
                     "page[size]": effective_page_size,
                     "page[number]": current_page,
                     "include": "",
-                    "fields[incidents]": "id,title,summary,status,created_at,updated_at,url,started_at",
+                    "fields[incidents]": INCIDENT_SEARCH_FIELDS,
                 }
                 if query:
                     params["filter[search]"] = query
@@ -155,6 +160,99 @@ def register_incident_tools(
             error_type, error_message = mcp_error.categorize_error(e)
             return cast(JsonDict, mcp_error.tool_error(error_message, error_type))
 
+    @mcp.tool(name="getIncident")
+    async def get_incident(
+        incident_id: Annotated[str, Field(description="Incident ID to retrieve")],
+    ) -> JsonDict:
+        """Retrieve a single incident with PIR-related fields for direct verification."""
+        try:
+            response = await make_authenticated_request("GET", f"/v1/incidents/{incident_id}")
+            response.raise_for_status()
+
+            response_data = response.json()
+            if isinstance(response_data.get("data"), dict):
+                stripped = strip_heavy_nested_data({"data": [response_data["data"]]})
+                response_data["data"] = stripped["data"][0]
+            return cast(JsonDict, response_data)
+        except Exception as e:
+            error_type, error_message = mcp_error.categorize_error(e)
+            return cast(
+                JsonDict,
+                mcp_error.tool_error(
+                    f"Failed to retrieve incident: {error_message}",
+                    error_type,
+                ),
+            )
+
+    @mcp.tool(name="updateIncident")
+    async def update_incident(
+        incident_id: Annotated[str, Field(description="Incident ID to update")],
+        retrospective_progress_status: Annotated[
+            str | None,
+            Field(
+                description="Retrospective/PIR status: one of not_started, active, completed, skipped"
+            ),
+        ] = None,
+        summary: Annotated[
+            str | None,
+            Field(description="Updated incident summary"),
+        ] = None,
+    ) -> JsonDict:
+        """Update scoped incident fields for PIR lifecycle automation."""
+        attributes: dict[str, Any] = {}
+
+        if retrospective_progress_status is not None:
+            if retrospective_progress_status not in RETROSPECTIVE_PROGRESS_STATUSES:
+                allowed = ", ".join(RETROSPECTIVE_PROGRESS_STATUSES)
+                return cast(
+                    JsonDict,
+                    mcp_error.tool_error(
+                        f"retrospective_progress_status must be one of: {allowed}",
+                        "validation_error",
+                    ),
+                )
+            attributes["retrospective_progress_status"] = retrospective_progress_status
+
+        if summary is not None:
+            attributes["summary"] = summary
+
+        if not attributes:
+            return cast(
+                JsonDict,
+                mcp_error.tool_error(
+                    "Must provide at least one of retrospective_progress_status or summary",
+                    "validation_error",
+                ),
+            )
+
+        payload = {
+            "data": {
+                "type": "incidents",
+                "attributes": attributes,
+            }
+        }
+
+        try:
+            response = await make_authenticated_request(
+                "PUT", f"/v1/incidents/{incident_id}", json=payload
+            )
+            response.raise_for_status()
+
+            response_data = response.json()
+            if isinstance(response_data.get("data"), dict):
+                stripped = strip_heavy_nested_data({"data": [response_data["data"]]})
+                response_data["data"] = stripped["data"][0]
+            return cast(JsonDict, response_data)
+        except Exception as e:
+            error_type, error_message = mcp_error.categorize_error(e)
+            return cast(
+                JsonDict,
+                mcp_error.tool_error(
+                    f"Failed to update incident: {error_message}",
+                    error_type,
+                ),
+            )
+
     @mcp.tool()
     async def find_related_incidents(
         incident_id: str = "",