feat(codex): add OpenIAP Codex plugin#168
Open
hyochan wants to merge 14 commits into
Open
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughImplements an IAPKit MCP server and HTTP/web transports, exposes a new /mcp endpoint in the kit server, adds revenue metrics and product-sync APIs and client helpers, updates docs and site navigation with a Codex plugin page, adds tests, updates Docker/build and dependency wiring, and requires PR preview recordings. ChangesMCP Server Integration and API Expansion
Sequence Diagram (high-level MCP flow) sequenceDiagram
participant Client
participant KitServer
participant WebMcpHandler
participant IapKitMcpServer
participant KitAPI
Client->>KitServer: POST /mcp (SSE/stream, Authorization Bearer)
KitServer->>WebMcpHandler: forward raw request
WebMcpHandler->>IapKitMcpServer: initialize / tools/call (session transport)
IapKitMcpServer->>KitAPI: proxied /v1/* calls (with bearer/API key)
KitAPI-->>IapKitMcpServer: SSE / job stream / JSON responses
IapKitMcpServer-->>WebMcpHandler: SSE response (data:)
WebMcpHandler-->>KitServer: response body/headers (mcp-session-id)
KitServer-->>Client: stream responses (SSE)
Estimated code review effort 🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyochan
added
kit
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces a ChatGPT / MCP connector endpoint at /mcp to the IAPKit server, allowing MCP clients to inspect products, subscriptions, and setup state. It adds new HTTP and Web-standard transports to the MCP server package and updates the documentation pages. The review feedback points out several important issues: a runtime ReferenceError in Web Standard environments due to the use of Node's Buffer global, a potential credential leak where client API keys from bearer tokens are not redacted in error responses, and improper handling of client-side parsing and payload-size errors which incorrectly return 500 Internal Server Error instead of 400 or 413 status codes.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
hyochan
changed the title
hyochan
force-pushed
the
codex/iapkit-chatgpt-mcp
branch
from
1ef85d4 to
86c5eb0
Compare
Add an IAPKit-branded MCP server entrypoint for ChatGPT connectors, expose the hosted Kit /mcp endpoint, and document the ChatGPT plugin setup flow with a captured docs screenshot. Validation: bun run --filter @hyodotdev/openiap-mcp-server lint; bun run --filter @hyodotdev/openiap-mcp-server test; bun run --filter @hyodotdev/openiap-mcp-server build; bun run audit:docs; bun run --filter @hyodotdev/openiap-kit lint; bun run --filter @hyodotdev/openiap-kit test; VITE_KIT_CONVEX_URL=https://example.convex.cloud bun run --filter @hyodotdev/openiap-kit smoke:server
Address PR review findings by removing the Web-standard Buffer dependency, returning 400/413 for client JSON and payload errors, and redacting bearer project keys from MCP tool error payloads. Validation: bun run --filter @hyodotdev/openiap-mcp-server lint; bun run --filter @hyodotdev/openiap-mcp-server test; bun run --filter @hyodotdev/openiap-mcp-server build; bun run audit:docs; bun run --filter @hyodotdev/openiap-kit lint; bun run --filter @hyodotdev/openiap-kit test; VITE_KIT_CONVEX_URL=https://example.convex.cloud bun run --filter @hyodotdev/openiap-kit smoke:server
hyochan
force-pushed
the
codex/iapkit-chatgpt-mcp
branch
from
86c5eb0 to
2af1bea
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
packages/kit/server/mcp.ts (1)
3-5: ⚡ Quick winAdd JSDoc for the exported MCP handler.
This exported API should include a short JSDoc describing purpose and env-driven behavior.
Suggested change
+/** + * Handles MCP HTTP requests for the Kit-hosted IAPKit MCP endpoint. + * Set IAPKIT_MCP_LEGACY_ALIASES=true to expose legacy OpenIAP tool aliases. + */ export const handleIapKitMcpRequest = createIapKitWebMcpHandler({ includeLegacyOpenIapAliases: process.env.IAPKIT_MCP_LEGACY_ALIASES === "true", });As per coding guidelines, "Add JSDoc comments for public functions and exported APIs".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/kit/server/mcp.ts` around lines 3 - 5, Add a JSDoc block above the exported constant handleIapKitMcpRequest that briefly describes its purpose (it creates/exports the MCP request handler for IAP Kit via createIapKitWebMcpHandler) and documents the env-driven behavior: that the includeLegacyOpenIapAliases option is toggled by the IAPKIT_MCP_LEGACY_ALIASES environment variable (accepted value "true"), explaining the effect when enabled; reference the symbol names handleIapKitMcpRequest, createIapKitWebMcpHandler, includeLegacyOpenIapAliases and the env var IAPKIT_MCP_LEGACY_ALIASES in the comment.packages/mcp-server/src/http.ts (1)
36-48: ⚡ Quick winAdd JSDoc for exported interfaces/functions.
This file exports public APIs without JSDoc comments.
💡 Suggested fix
+/** Configuration for the remote MCP HTTP server. */ export interface RemoteMcpHttpServerOptions { @@ +/** Runtime handle for a started or startable remote MCP HTTP server. */ export interface RemoteMcpHttpServer { @@ +/** Creates the remote MCP HTTP server without binding a socket. */ export function createRemoteMcpHttpServer( @@ +/** Creates and starts the remote MCP HTTP server. */ export async function startRemoteMcpHttpServer(As per coding guidelines: Add JSDoc comments for public functions and exported APIs.
Also applies to: 50-52, 160-163
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/mcp-server/src/http.ts` around lines 36 - 48, Add JSDoc comments for the exported public APIs: document the RemoteMcpHttpServerOptions and RemoteMcpHttpServer interfaces and any other exported symbols around the indicated ranges (the exports at lines ~50-52 and ~160-163). For each interface include a short description and per-property `@property/`@param-style entries that state the type, purpose, optionality, and default value (e.g., host, port, mcpPath, allowedOrigins, includeLegacyOpenIapAliases, logger). For exported functions/classes (those around 50-52 and 160-163) add a brief description, parameter and return annotations (`@param`, `@returns`), and an example or note about side effects (e.g., server creation/close semantics) so the public API is well-documented.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/kit/src/pages/docs/sections/codex-plugin.tsx`:
- Around line 131-160: The "Available tools" list is missing three
MCP-registered tools and should match the server exports: add list entries for
iapkit_check_status, iapkit_simulate_purchase, and iapkit_simulate_webhook
(using the same <li><code>...</code> format as the other items), ensure
iapkit_inspect_state remains (do not rename to iapkit_insert_state), and update
the prose/count to reflect the full set of 13 iapkit_* tools so the docs exactly
mirror the MCP server registrations.
In `@packages/mcp-server/src/http.ts`:
- Around line 171-173: The startup promise that calls remote.server.listen must
also reject on server 'error' events and remove its listener after
resolution/rejection: update the Promise in startRemoteMcpHttpServer (the block
that calls remote.server.listen) to attach a one-time 'error' listener that
rejects the Promise (and remove that listener when the listen callback runs), so
EADDRINUSE and other listen errors cause initialization to fail; also add JSDoc
comments for the exported types and functions RemoteMcpHttpServerOptions,
RemoteMcpHttpServer, createRemoteMcpHttpServer, and startRemoteMcpHttpServer
following the project’s JSDoc guideline to document parameters, return values,
and thrown errors.
In `@packages/mcp-server/src/mcp.ts`:
- Line 550: The simulate_webhook code currently uses
Buffer.from(...).toString("base64") which relies on Node globals and breaks in
non-Node runtimes; replace that line by encoding the JSON with TextEncoder and
then base64-encoding via btoa (e.g., const json = JSON.stringify(message); const
bytes = new TextEncoder().encode(json); const data =
btoa(String.fromCharCode(...bytes))); update the reference in simulate_webhook
to use TextEncoder and btoa instead of Buffer so the function is web-standard
and UTF-8 safe.
---
Nitpick comments:
In `@packages/kit/server/mcp.ts`:
- Around line 3-5: Add a JSDoc block above the exported constant
handleIapKitMcpRequest that briefly describes its purpose (it creates/exports
the MCP request handler for IAP Kit via createIapKitWebMcpHandler) and documents
the env-driven behavior: that the includeLegacyOpenIapAliases option is toggled
by the IAPKIT_MCP_LEGACY_ALIASES environment variable (accepted value "true"),
explaining the effect when enabled; reference the symbol names
handleIapKitMcpRequest, createIapKitWebMcpHandler, includeLegacyOpenIapAliases
and the env var IAPKIT_MCP_LEGACY_ALIASES in the comment.
In `@packages/mcp-server/src/http.ts`:
- Around line 36-48: Add JSDoc comments for the exported public APIs: document
the RemoteMcpHttpServerOptions and RemoteMcpHttpServer interfaces and any other
exported symbols around the indicated ranges (the exports at lines ~50-52 and
~160-163). For each interface include a short description and per-property
`@property/`@param-style entries that state the type, purpose, optionality, and
default value (e.g., host, port, mcpPath, allowedOrigins,
includeLegacyOpenIapAliases, logger). For exported functions/classes (those
around 50-52 and 160-163) add a brief description, parameter and return
annotations (`@param`, `@returns`), and an example or note about side effects (e.g.,
server creation/close semantics) so the public API is well-documented.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: dd79cdea-24f9-409d-86e1-eb878b7390a8
⛔ Files ignored due to path filters (3)
.github/pr-previews/pr-168-iapkit-codex-mcp-preview.gifis excluded by!**/*.gif.github/pr-previews/pr-168-iapkit-codex-mcp-preview.mp4is excluded by!**/*.mp4bun.lockis excluded by!**/*.lock
📒 Files selected for processing (33)
.claude/commands/commit.md.codex/skills/openiap-workflows/SKILL.mdknowledge/internal/06-git-deployment.mdpackages/kit/Dockerfilepackages/kit/README.mdpackages/kit/package.jsonpackages/kit/public/docs/screenshots/codex-plugin.webppackages/kit/public/llms-full.txtpackages/kit/public/llms.txtpackages/kit/public/sitemap.xmlpackages/kit/server/api/v1/products.test.tspackages/kit/server/api/v1/products.tspackages/kit/server/api/v1/subscriptions.test.tspackages/kit/server/api/v1/subscriptions.tspackages/kit/server/mcp.test.tspackages/kit/server/mcp.tspackages/kit/server/server.tspackages/kit/src/pages/auth/index.tsxpackages/kit/src/pages/docs/DocsLayout.tsxpackages/kit/src/pages/docs/nav.tspackages/kit/src/pages/docs/routes.tsxpackages/kit/src/pages/docs/sections/ai-assistants.tsxpackages/kit/src/pages/docs/sections/codex-plugin.tsxpackages/kit/src/pages/index.tsxpackages/kit/vite.config.tspackages/mcp-server/package.jsonpackages/mcp-server/src/http.tspackages/mcp-server/src/index.tspackages/mcp-server/src/kit-client.tspackages/mcp-server/src/mcp.tspackages/mcp-server/src/web.tspackages/mcp-server/test/http.test.tspackages/mcp-server/test/kit-client.test.ts
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/mcp-server/src/mcp.ts (1)
486-500:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winDon't gate the iOS instruction path on credentials.
This resolves
apiKeyandbaseUrlbefore branching onplatform, soiapkit_simulate_webhook({ platform: "IOS" })now returnsapiKey requiredeven though the iOS branch only prints instructions and never calls Kit.💡 Suggested fix
async (args, extra) => { - const apiKey = - args.apiKey ?? - extra?.authInfo?.token ?? - process.env.IAPKIT_API_KEY; - if (!apiKey) return err(new Error("apiKey required")); - const validationError = validateApiKey(apiKey); - if (validationError) return err(new Error(validationError), apiKey); - let baseUrl: string; - try { - baseUrl = normalizeKitBaseUrl( - args.baseUrl ?? process.env.IAPKIT_BASE_URL, - ); - } catch (error) { - return err(error, apiKey); - } if (args.platform === "Android") { + const apiKey = + args.apiKey ?? + extra?.authInfo?.token ?? + process.env.IAPKIT_API_KEY; + if (!apiKey) return err(new Error("apiKey required")); + const validationError = validateApiKey(apiKey); + if (validationError) return err(new Error(validationError), apiKey); + let baseUrl: string; + try { + baseUrl = normalizeKitBaseUrl( + args.baseUrl ?? process.env.IAPKIT_BASE_URL, + ); + } catch (error) { + return err(error, apiKey); + } const message = { version: "1.0", packageName: "com.example.app",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/mcp-server/src/mcp.ts` around lines 486 - 500, The code resolves apiKey and baseUrl (using validateApiKey and normalizeKitBaseUrl) before switching on platform, which causes iOS-only flows (e.g., iapkit_simulate_webhook with platform "IOS") to fail with "apiKey required"; fix by moving the apiKey and baseUrl resolution/validation (the calls to validateApiKey and normalizeKitBaseUrl and their error returns) into the branch that actually calls the Kit (the non-iOS/web path), and ensure the iOS branch in the function iapkit_simulate_webhook (or the surrounding platform switch) returns the instructional output without requiring apiKey/baseUrl; keep existing error handling logic but scope it so only the code paths that call the Kit perform the credential checks.
🧹 Nitpick comments (1)
packages/mcp-server/src/mcp.ts (1)
211-218: ⚡ Quick winDocument the exported MCP factory.
createIapKitMcpServeris a public API and its contract changed in this PR, but it still has no JSDoc.As per coding guidelines "Add JSDoc comments for public functions and exported APIs".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/mcp-server/src/mcp.ts` around lines 211 - 218, Add a JSDoc block above the exported factory function createIapKitMcpServer describing its purpose, return type and important behavior: document that it creates and returns an McpServer configured with name IAPKIT_MCP_SERVER_NAME, version IAPKIT_MCP_SERVER_VERSION and websiteUrl "https://kit.openiap.dev", and that it registers tools via registerIapKitTools before returning; include `@returns` {McpServer} and mention any side effects (registration) and stability/usage notes for callers.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/mcp-server/src/mcp.ts`:
- Around line 486-500: The code resolves apiKey and baseUrl (using
validateApiKey and normalizeKitBaseUrl) before switching on platform, which
causes iOS-only flows (e.g., iapkit_simulate_webhook with platform "IOS") to
fail with "apiKey required"; fix by moving the apiKey and baseUrl
resolution/validation (the calls to validateApiKey and normalizeKitBaseUrl and
their error returns) into the branch that actually calls the Kit (the
non-iOS/web path), and ensure the iOS branch in the function
iapkit_simulate_webhook (or the surrounding platform switch) returns the
instructional output without requiring apiKey/baseUrl; keep existing error
handling logic but scope it so only the code paths that call the Kit perform the
credential checks.
---
Nitpick comments:
In `@packages/mcp-server/src/mcp.ts`:
- Around line 211-218: Add a JSDoc block above the exported factory function
createIapKitMcpServer describing its purpose, return type and important
behavior: document that it creates and returns an McpServer configured with name
IAPKIT_MCP_SERVER_NAME, version IAPKIT_MCP_SERVER_VERSION and websiteUrl
"https://kit.openiap.dev", and that it registers tools via registerIapKitTools
before returning; include `@returns` {McpServer} and mention any side effects
(registration) and stability/usage notes for callers.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 375ddcb2-c0b2-47fc-84cd-b25e9dcbd358
📒 Files selected for processing (8)
packages/docs/src/pages/docs/kit-backend.tsxpackages/docs/src/pages/docs/webhooks.tsxpackages/kit/server/mcp.tspackages/mcp-server/src/http.tspackages/mcp-server/src/index.tspackages/mcp-server/src/mcp.tspackages/mcp-server/src/web.tspackages/mcp-server/test/http.test.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- packages/kit/server/mcp.ts
- packages/mcp-server/src/web.ts
- packages/mcp-server/test/http.test.ts
hyochan
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/mcproute for Codex/MCP connectors with bearer-token IAPKit project key support.Preview
Readable Playwright-generated preview of the Codex MCP flow. The recording initializes the PR's MCP HTTP server, lists the
iapkit_*tools visible to Codex, callsiapkit_revenue_analytics, callsiapkit_create_product, and returns an Expo setup snippet throughiapkit_setup.MP4: https://github.com/user-attachments/assets/f3432dc8-9246-4301-870e-aa9b25024fe1
The preview assets were uploaded as GitHub PR attachments and are intentionally not committed to the repository.
Validation
bun run --filter @hyodotdev/openiap-mcp-server lintbun run --filter @hyodotdev/openiap-mcp-server testbun run --filter @hyodotdev/openiap-mcp-server buildbun run audit:docsbun run --filter @hyodotdev/openiap-kit lintbun run --filter @hyodotdev/openiap-kit testVITE_KIT_CONVEX_URL=https://example.convex.cloud bun run --filter @hyodotdev/openiap-kit smoke:serverpython3 /Users/hyo/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py plugins/openiapvia a temporary venv with PyYAML/mcpe2e: initialize, tools/list,iapkit_revenue_analytics,iapkit_create_product, andiapkit_simulate_webhookagainst a mock Kit APINotes
iapkit_*tools.hyodotdev/openiapmarketplace.AGENTS.mdhas a pre-existing local typechange and is intentionally not included in this PR.Summary by CodeRabbit
New Features
Documentation
Tests