mirror of https://github.com/langbot-app/LangBot.git synced 2026-09-23 01:46:37 +08:00

Files

T

Junyan Chin e9dd584792 feat: MCP server + in-repo skills (agent-friendly platform) (#2269 )

* feat(api): support global API key from config.yaml (api.global_api_key)

Accept a config-defined global API key anywhere a web-UI key is accepted
(X-API-Key / Bearer), with no login session and no DB record. Useful for
automated deployments and AI agents (HTTP API + MCP). Defaults to empty
(disabled); does not require the lbk_ prefix.

- templates/config.yaml: add api.global_api_key with security notes
- service/apikey.py: verify_api_key checks global key first (constant-time)
- docs/API_KEY_AUTH.md: document the global key + security guidance
- tests: cover global-key match, prefix-free, fallback-to-db, disabled

* feat(mcp): expose LangBot management as an MCP server at /mcp

Add an MCP (Model Context Protocol) server so external AI agents can manage a
LangBot instance. Reuses the same API-key auth as the HTTP API (including the
config.yaml global API key).

- pkg/api/mcp/server.py: FastMCP server wrapping the service layer; 21 curated
  tools across system/bots/pipelines/models/knowledge/mcp-servers/skills
- pkg/api/mcp/mount.py: ASGI dispatcher fronting Quart; authenticates /mcp
  requests with an API key, runs the streamable-HTTP session manager lifespan
- controller/main.py: serve the wrapped ASGI app via hypercorn (was run_task)
- web: new 'MCP' tab in the API integration dialog showing endpoint, auth, and
  client config; i18n for 8 locales
- tests/manual/mcp_smoke.py: e2e check (401 unauth, list tools, call tools)

Tool surface is intentionally curated (not all ~25 route groups) to keep the
agent surface small, safe, and maintainable. Extend deliberately.

* feat(skills): add in-repo skills/ as the single source of truth

Migrate the agent skills + QA/e2e test harness from the (now archived)
langbot-app/langbot-skills repo into LangBot/skills/, and add four new skills.

Migrated:
- langbot-plugin-dev, langbot-testing (e2e), langbot-env-setup,
  langbot-skills-maintenance, langbot-eba-adapter-dev
- the bin/lbs CLI (src/, test/, scripts/, schemas/, qa-agent-docs/)

New:
- langbot-dev      core backend + web development
- langbot-deploy   Docker/K8s deployment + config.yaml + global API key
- langbot-mcp-ops  operating the LangBot MCP server (/mcp)
- langbot-space-ops operating the Space marketplace MCP server

- src/cli.ts repoRoot(): recognize the skills assets root (skills.index.json +
  bin/lbs) so the CLI works when nested inside the LangBot repo
- README.md: unified skill catalog; skills.index.json regenerated

Parity with source verified: bin/lbs validate + node test suite match the
source repo (only the uncommitted .lbpkg build-artifact fixture differs).

* docs(agents): document agent-facing surfaces + API/MCP/skills sync rule

* docs(readme): add 'Built for AI Agents' section across all locales

Highlight MCP server, in-repo skills (single source of truth), AGENTS.md
sync rule, and llms.txt. Cross-link LangBot Space MCP marketplace.

* style(mcp): fix ruff format + prettier lint in MCP server and API panel

* style(web): prettier format MCP i18n locale entries

* docs(skills): note MCP instance control in dev/testing skills

All development-guidance skills now point to the LangBot instance MCP
server (/mcp) and the Space marketplace MCP server, reusing API keys.

2026-06-20 15:14:47 +08:00

3.3 KiB

Raw Blame History

Curation Workflow

Use this checklist when the repository starts accumulating repeated cases, copied steps, or overlapping troubleshooting entries.

Audit Pass

Inspect the current surface:
- bin/lbs case list
- bin/lbs case list --json --priority p0 --automation
- bin/lbs case list --ready
- bin/lbs case list --machine-ready
- bin/lbs suite list
- bin/lbs fixture list
- rg "sandbox|provider|pipeline|plugin|knowledge|mcp" skills
- rg "If .* fails|Known Pitfalls|Debug Chat|/api/v1" skills
Group nearby assets by intent, not by file path:
- user-facing scenario
- backend or provider dependency
- failure signature
- pass/fail evidence
Pick one canonical owner:
- stable procedures belong in references/
- deterministic files and packages belong in fixtures/ plus fixtures/fixtures.json
- repeated failure signatures belong in troubleshooting/
- runnable QA paths belong in cases/
- reusable groups of QA paths belong in suites/
- skill entry points belong in SKILL.md

Merge Or Split

Merge when two files share the same trigger, root cause, and fix. Keep the stronger id and move missing patterns into it.

Split when a file mixes unrelated failure modes or requires different fixes. Each troubleshooting id should map to one diagnosis path.

Move repeated step lists out of cases and into a reference when more than one case would need the same prompt, UI path, or log interpretation.

Add or update a suite when developers repeatedly run the same ordered group of cases. Do not copy case steps into suites; use bin/lbs suite plan <suite-id> to expand the group. Use bin/lbs suite start <suite-id> and bin/lbs suite report <suite-id> --evidence-dir <dir> when validating that a suite is operational end to end.

Add or update fixtures/fixtures.json when a case depends on a deterministic file, plugin package, or local test server. The manifest should use repo-relative paths under the owning skill and should not contain machine-local absolute paths.

When adding Debug Chat Playwright automation, reuse scripts/e2e/lib/debug-chat.mjs for navigation, prompt send, response leaf matching, and known failure classification. Keep case-specific prompts and expected sentinels in case YAML automation fields when possible.

Case Review

For every changed case:

Ensure steps describe what to execute, not every command in the underlying implementation.
Ensure checks contain observable UI, log, network, or filesystem evidence.
Ensure diagnostics are fallback investigation hints, not pass criteria.
Ensure priority, risk, ci_eligible, and evidence_required match the actual repeatability and evidence burden.
Put must-have env vars in env / automation_env; put one-of choices such as URL-or-name in env_any / automation_env_any.
Ensure linked skills and troubleshooting ids exist.

Run:

bin/lbs validate
bin/lbs index --check
bin/lbs index
bin/lbs test plan <case-id>

Final Gate

Before handing off:

git diff --stat should show a focused change set.
skills.index.json should be regenerated only by bin/lbs index.
No new asset should contain local credentials, OAuth tokens, API keys, or copied localStorage values.
The final note should say which checks ran and which cases or troubleshooting ids changed.

3.3 KiB Raw Blame History