Uh oh!
There was an error while loading. Please reload this page.
feat(mcp): Add optional visibility parameter to control chat visibility - #903
Merged
Merged
Conversation
- Add visibility parameter to askCodebaseRequestSchema in MCP - Update blocking chat API to accept and use visibility parameter - Allow agents to override default visibility (PRIVATE/PUBLIC) - Useful for shared environments like Slack where links should be public Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
Cursor Agent can help with this pull request. Just |
Contributor
No actionable comments were generated in the recent review. 🎉 WalkthroughAdds an optional Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant MCP_Tool as MCP Tool
participant Server
participant DB
Client->>MCP_Tool: send ask_codebase request (optional visibility)
MCP_Tool->>Server: POST /api/chat/blocking (visibility param forwarded)
Server->>Server: determine chatVisibility (requested or default based on auth)
Server->>DB: create chat record with chatVisibility
DB-->>Server: chat created
Server-->>MCP_Tool: return chat link/metadata
MCP_Tool-->>Client: present chat link (visibility noted)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
brendan-kellam
commented
Feb 18, 2026
ContributorAuthor
@cursoragent add changelog entries to the main changelog and the packages/mcp changelog. The PR link is #903 |
brendan-kellam
marked this pull request as ready for review
February 18, 2026 20:36
Done! I've added changelog entries to both CHANGELOG.md files and pushed the changes. Changes MadeMain CHANGELOG.md (
MCP CHANGELOG.md (
Both entries follow the repository's changelog conventions with the PR link included. The changes have been committed and pushed to the |
This comment has been minimized.
This comment has been minimized.
- Add entry to main CHANGELOG.md - Add entry to packages/mcp/CHANGELOG.md Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
visibility parameter to control chat visibilityUh oh!
There was an error while loading. Please reload this page.
- Clarify that the change affects both the API endpoint and MCP tool Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/web/src/app/api/`(server)/chat/blocking/route.ts:
- Around line 102-103: The code computes chatVisibility using
requestedVisibility ?? (user ? ChatVisibility.PRIVATE : ChatVisibility.PUBLIC),
which allows an anonymous caller to explicitly set PRIVATE; change the guard so
PRIVATE is only allowed for authenticated users — e.g., if (!user &&
requestedVisibility === ChatVisibility.PRIVATE) set chatVisibility =
ChatVisibility.PUBLIC, otherwise use requestedVisibility ?? (user ?
ChatVisibility.PRIVATE : ChatVisibility.PUBLIC); update the logic around the
chatVisibility variable (and any downstream use) to enforce that
ChatVisibility.PRIVATE is only accepted when user is present.
Uh oh!
There was an error while loading. Please reload this page.
- Update visibility logic to ignore PRIVATE requests from unauthenticated users - Add guard to ensure anonymous users can only create PUBLIC chats - Update tool description and schema to document this behavior - Prevents creation of inaccessible ownerless private chats Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
- Remove note from MCP tool descriptions (schemas.ts and index.ts) - Add note to blocking chat API route's visibility parameter description - Clarifies that the restriction is enforced at the API level Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an optional
visibilityparameter to theask_codebasetool to allow agents to control chat session visibility.This enables agents to set chat sessions to
publicin shared environments like Slack, preventing 404 errors for users who did not create the API key used by the MCP server.Linear Issue: SOU-510
Summary by CodeRabbit