rootly-mcp-server 2.3.7__tar.gz → 2.3.8__tar.gz

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.8}/.github/workflows/dependency-review.yml

@@ -12,4 +12,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Dependency Review
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.8}/.gitignore

@@ -199,3 +199,4 @@ test_output/
 !CONTRIBUTING.md
 !CHANGELOG.md
 .beads/
+.claude/

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.8}/CHANGELOG.md

@@ -5,6 +5,42 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.8] - Released 2026-05-19
+
+### Security
+
+- **Bearer Auth Enforcement on Hosted Transports**: Required Bearer authentication on MCP transport paths in hosted mode so unauthenticated requests are rejected before any tool dispatch
+- **Upstream Token Validation**: Validated Bearer tokens against the upstream Rootly API before granting MCP access, surfacing malformed or expired credentials at the edge with clearer errors
+- **Dependency Advisories**: Bumped `urllib3` (≥2.7.0), `python-multipart` (≥0.0.27), and `pip` (≥26.1) to resolve five open Dependabot advisories (urllib3 CVE-2026-44431/44432, python-multipart CVE-2026-42561, pip CVE-2026-6357/3219)
+
+### Performance
+
+- **`get_alert_by_short_id` Now O(1)**: Replaced the up-to-20-page sequential scan with a single direct `GET /v1/alerts/{short_id}` point lookup. P95 spikes of 41s on this tool collapse to ~200ms; not-found responses no longer cost 10+ seconds; workspaces with >2,000 alerts no longer silently fail
+- **`get_oncall_handoff_summary` Fan-Out Parallelized**: Replaced sequential per-schedule shift and incident fetches with `asyncio.gather` capped by a `Semaphore(10)`. Worst-case p95 of ~15s on populated workspaces drops to ~1–2s
+- **Lookup-Maps Helper Parallelized**: `_fetch_users_and_schedules_maps` (used by `list_shifts`, `check_responder_availability`, `check_oncall_health_risk`, `create_override_recommendation`, `find_related_incidents`) now runs the three independent resource fetches concurrently with intra-resource page fan-out. Cold-cache worst case drops from ~15s to ~1s — meaningfully more impactful since v2.3.7 made sessions stateless and the in-memory cache is repaid more often
+- **Shared `_fetch_all_pages` Helper Across Five Shift Tools**: `list_shifts`, `get_oncall_schedule_summary`, `check_responder_availability`, `create_override_recommendation`, and `check_oncall_health_risk` now all route through the same paginated, concurrency-capped helper instead of duplicating sequential pagination loops. Each tool saves 2–5s worst case under load
+
+### Fixed
+
+- **`get_oncall_shift_metrics` Silent Data Loss**: The function previously fetched only page 1 of schedules and teams (no pagination loop), causing team-id filtering to silently drop schedules whose teams lived past page 1. Now uses the shared paginated, cached helper so all schedules are considered
+- **OAuth Authorization Server Discovery**: Derived the OAuth authorization server URL from the API base URL so discovery works against staging and self-hosted Rootly instances
+- **OAuth Protected Resource Metadata**: Removed `scopes_supported` from the protected resource metadata, advertised only the granular scopes the resource actually accepts, and included resource-specific scopes for clients that key off them
+- **Pagination Resilience**: `asyncio.gather` callsites that fan out pages now use `return_exceptions=True` with an `isinstance(_, BaseException)` guard so a single transient httpx error on one page no longer aborts the entire handler
+- **Missing `total_pages` Metadata Fallback**: When upstream omits `meta.total_pages`, the helper now falls back to fetching up to `max_pages` (preserving the legacy "keep going until a short page" semantics) instead of silently truncating to page 1
+
+### Dependencies
+
+- **Routine Refresh**: Pulled in the latest minor and patch dependency updates from Dependabot
+- **CI Action Bump**: Updated `actions/dependency-review-action` from 4.9.0 to 5.0.0
+
+### Repo
+
+- **`.claude/` Ignored**: Stopped tracking transient `.claude/worktrees/` directories and added `.claude/` to `.gitignore` so local Claude Code state no longer pollutes diffs
+
+### Testing
+
+- New unit tests for the parallelized fan-out paths, the missing-`total_pages` fallback, exception-tolerance in `asyncio.gather`, the `get_oncall_shift_metrics` pagination regression, and the direct-GET path for `get_alert_by_short_id`
+
 ## [2.3.7] - Released 2026-05-08
 
 ### Features

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.3.7
+Version: 2.3.8
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues
@@ -27,11 +27,11 @@ Requires-Dist: cryptography>=46.0.7
 Requires-Dist: fastmcp[code-mode]==3.2.4
 Requires-Dist: httpx==0.28.1
 Requires-Dist: numpy>=1.24.0
-Requires-Dist: pydantic==2.13.3
+Requires-Dist: pydantic==2.13.4
 Requires-Dist: pygments>=2.20.0
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: python-multipart>=0.0.26
-Requires-Dist: requests==2.33.1
+Requires-Dist: requests==2.34.0
 Requires-Dist: scikit-learn>=1.3.0
 Provides-Extra: dev
 Requires-Dist: bandit>=1.7.0; extra == 'dev'

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.3.7"
+version = "2.3.8"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -42,9 +42,9 @@ dependencies = [
     "python-multipart>=0.0.26",  # Override vulnerable transitive python-multipart (CVE-2026-40347)
     "cryptography>=46.0.7",  # Override vulnerable transitive cryptography
     "Pygments>=2.20.0",  # Override vulnerable transitive Pygments
-    "requests==2.33.1", # Pin to patched version
+    "requests==2.34.0", # Pin to patched version
     "httpx==0.28.1",   # Pin to specific version
-    "pydantic==2.13.3",  # Pin to specific version
+    "pydantic==2.13.4",  # Pin to specific version
     "brotli>=1.2.0",    # For Brotli compression support in httpx
     "scikit-learn>=1.3.0", # For text similarity and ML utilities
     "numpy>=1.24.0",    # For numerical operations

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.8}/src/rootly_mcp_server/server.py

@@ -27,6 +27,8 @@ from .tools.oncall import register_oncall_tools
 from .tools.resources import register_resource_handlers
 from .utils import (
     OAUTH_PROTECTED_RESOURCE_PATH,
+    auth_header_state,
+    derive_oauth_server_url,
     is_mcp_server_url_static,
     resolve_mcp_server_url,
     sanitize_parameters_in_spec,
@@ -89,15 +91,7 @@ def _fingerprint_auth_header(auth_header: str) -> str:
 
 def _auth_header_state(auth_header: str) -> str:
     """Classify Authorization header shape without exposing token contents."""
-    raw = (auth_header or "").strip()
-    if not raw:
-        return "missing"
-    parts = raw.split(None, 1)
-    if not parts or parts[0].lower() != "bearer":
-        return "invalid_format"
-    if len(parts) == 1 or not parts[1].strip():
-        return "missing_token"
-    return "bearer"
+    return auth_header_state(auth_header)
 
 
 def _validate_bearer_auth_header(auth_header: str) -> str:
@@ -558,12 +552,57 @@ def create_rootly_mcp_server(
             return JSONResponse(
                 {
                     "resource": mcp_server_url,
-                    "authorization_servers": [base_url],
+                    "authorization_servers": [derive_oauth_server_url(base_url)],
                     "scopes_supported": [
                         "openid",
                         "profile",
                         "email",
-                        "all",
+                        "ir.incidents:read",
+                        "ir.incidents:write",
+                        "ir.services:read",
+                        "ir.services:write",
+                        "ir.environments:read",
+                        "ir.environments:write",
+                        "ir.functionalities:read",
+                        "ir.functionalities:write",
+                        "ir.severities:read",
+                        "ir.severities:write",
+                        "ir.incident_types:read",
+                        "ir.incident_types:write",
+                        "ir.incident_roles:read",
+                        "ir.incident_roles:write",
+                        "ir.workflows:read",
+                        "ir.workflows:write",
+                        "ir.catalogs:read",
+                        "ir.catalogs:write",
+                        "ir.groups:read",
+                        "ir.groups:write",
+                        "ir.playbooks:read",
+                        "ir.playbooks:write",
+                        "ir.retrospectives:read",
+                        "ir.retrospectives:write",
+                        "ir.status_pages:read",
+                        "ir.status_pages:write",
+                        "ir.form_fields:read",
+                        "ir.form_fields:write",
+                        "ir.pulses:read",
+                        "ir.pulses:write",
+                        "oc.alerts:read",
+                        "oc.alerts:write",
+                        "oc.schedules:read",
+                        "oc.schedules:write",
+                        "oc.escalation_policies:read",
+                        "oc.escalation_policies:write",
+                        "oc.alert_routing_rules:read",
+                        "oc.alert_routing_rules:write",
+                        "oc.heartbeats:read",
+                        "oc.heartbeats:write",
+                        "oc.alert_sources:read",
+                        "oc.alert_sources:write",
+                        "oc.live_call_routing:read",
+                        "oc.live_call_routing:write",
+                        "oc.shift_overrides:read",
+                        "oc.shift_overrides:write",
                     ],
                     "bearer_methods_supported": ["header"],
                 },

rootly_mcp_server-2.3.8/src/rootly_mcp_server/tools/alerts.py

@@ -0,0 +1,87 @@
+"""Alert tool registration for Rootly MCP server."""
+
+from __future__ import annotations
+
+from collections.abc import Awaitable, Callable
+from typing import Annotated, Any, Protocol
+from urllib.parse import quote
+
+from pydantic import Field
+
+JsonDict = dict[str, Any]
+MakeAuthenticatedRequest = Callable[..., Awaitable[Any]]
+
+
+class MCPErrorLike(Protocol):
+    """Protocol for MCP error helpers used by alert tools."""
+
+    @staticmethod
+    def tool_error(
+        error_message: str,
+        error_type: str = "execution_error",
+        details: dict[str, Any] | None = None,
+    ) -> JsonDict: ...
+
+    @staticmethod
+    def categorize_error(exception: Exception) -> tuple[str, str]: ...
+
+
+def register_alert_tools(
+    mcp: Any,
+    make_authenticated_request: MakeAuthenticatedRequest,
+    mcp_error: MCPErrorLike,
+) -> None:
+    """Register alert tools on the MCP server."""
+
+    @mcp.tool()
+    async def get_alert_by_short_id(
+        short_id: Annotated[
+            str,
+            Field(
+                description="The alert short_id (e.g., 'PhIQtP') or full alert URL (e.g., 'https://rootly.com/account/alerts/PhIQtP')"
+            ),
+        ],
+    ) -> JsonDict:
+        """Get alert details by short_id or alert URL. Use this when a user pastes an alert URL or short_id from a pager notification and wants to investigate the alert."""
+        try:
+            alert_short_id = short_id.strip()
+            if "/" in alert_short_id:
+                alert_short_id = alert_short_id.rstrip("/").split("/")[-1]
+
+            if not alert_short_id:
+                return mcp_error.tool_error("short_id is required", "validation_error")
+
+            # GET /v1/alerts/{id} accepts the short_id as well as the UUID
+            # (undocumented but supported), so a single point lookup avoids
+            # listing/filtering altogether.
+            response = await make_authenticated_request(
+                "GET", f"/v1/alerts/{quote(alert_short_id, safe='')}"
+            )
+            if response.status_code == 404:
+                return mcp_error.tool_error(
+                    f"Alert with short_id '{alert_short_id}' not found",
+                    "not_found",
+                )
+            response.raise_for_status()
+
+            data = response.json().get("data", {})
+            attrs = data.get("attributes", {})
+            return {
+                "id": data.get("id"),
+                "short_id": attrs.get("short_id"),
+                "summary": attrs.get("summary"),
+                "status": attrs.get("status"),
+                "source": attrs.get("source"),
+                "description": attrs.get("description"),
+                "started_at": attrs.get("started_at"),
+                "ended_at": attrs.get("ended_at"),
+                "noise": attrs.get("noise"),
+                "url": attrs.get("url"),
+                "created_at": attrs.get("created_at"),
+            }
+
+        except Exception as e:
+            error_type, error_message = mcp_error.categorize_error(e)
+            return mcp_error.tool_error(
+                f"Failed to get alert by short_id: {error_message}", error_type
+            )