Skip to content

test(mcp): add deployed-server e2e suite#1057

Open
MaheshtheDev wants to merge 2 commits into
mainfrom
mahesh/mcp-e2e-layer1
Open

test(mcp): add deployed-server e2e suite#1057
MaheshtheDev wants to merge 2 commits into
mainfrom
mahesh/mcp-e2e-layer1

Conversation

@MaheshtheDev
Copy link
Copy Markdown
Member

@MaheshtheDev MaheshtheDev commented Jun 6, 2026

End-to-end tests that drive the deployed Supermemory MCP over streamable HTTP (no mocks):

  • discovery: handshake + tool/resource/prompt listing
  • identity: whoAmI, listProjects
  • memory: save -> recall round-trip, profile variants, forget, container scoping
  • graph/resources/prompts: memory-graph, fetch-graph-data, profile/projects, context
  • oauth: protected-resource discovery chain, dynamic client registration,
    token-endpoint negatives, and a real refresh -> access token round-trip
  • auth: GET / info, 401 on missing/invalid token
  • root-scope: x-sm-project scoping behavior

Tests skip without SUPERMEMORY_API_KEY (OAuth tier-D skips without its token env vars) so CI is safe without secrets. Adds vitest + a test:e2e script and documents running + the OAuth flow in apps/mcp/README.md.

End-to-end tests that drive the deployed Supermemory MCP over streamable
HTTP (no mocks):

- discovery: handshake + tool/resource/prompt listing
- identity: whoAmI, listProjects
- memory: save -> recall round-trip, profile variants, forget, container scoping
- graph/resources/prompts: memory-graph, fetch-graph-data, profile/projects, context
- oauth: protected-resource discovery chain, dynamic client registration,
  token-endpoint negatives, and a real refresh -> access token round-trip
- auth: GET / info, 401 on missing/invalid token
- root-scope: x-sm-project scoping behavior

Tests skip without SUPERMEMORY_API_KEY (OAuth tier-D skips without its token
env vars) so CI is safe without secrets. Adds vitest + a test:e2e script and
documents running + the OAuth flow in apps/mcp/README.md.
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Jun 6, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
supermemory-app 830fd3d Commit Preview URL

Branch Preview URL
Jun 06 2026, 12:48 AM

@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Jun 6, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs
supermemory-mcp 830fd3d Jun 06 2026, 12:48 AM

@graphite-app graphite-app Bot requested a review from Dhravya June 6, 2026 00:44
Copy link
Copy Markdown
Member Author


How to use the Graphite Merge Queue

Add the label Main to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

@claude
Copy link
Copy Markdown

claude Bot commented Jun 6, 2026

Claude finished @MaheshtheDev's task in 1m 17s —— View job


Review Complete

  • Fetch PR diff and existing review comments
  • Analyze test files for bugs, security issues, and logic errors
  • Check helper utilities and configuration
  • Submit review

Summary: Reviewed the e2e test suite — no bugs, security issues, or logic errors found. The tests are well-structured with proper CI safety (skip without secrets), unique markers to avoid pollution, appropriate timeouts for async operations, and good cleanup. Ready to ship.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Jun 6, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addeddestr@​2.0.510010010080100
Addeddotenv@​16.6.110010010090100
Addeddotenv@​17.4.29910010090100
Addedzod@​3.25.7610010010093100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Jun 6, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@pnpm/network.ca-file@1.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copy link
Copy Markdown

@claude claude Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overview: Adds a comprehensive e2e test suite for the MCP server covering OAuth flows, discovery, memory operations, and container scoping.

Issues found: None — this looks good to ship.

The test suite is well-structured:

  • Tests properly skip when required env vars are missing (CI-safe)
  • Unique markers via randomUUID() prevent test pollution across runs
  • Appropriate timeouts for eventually-consistent operations (90s polling for recall)
  • Proper cleanup in afterAll hooks
  • Good coverage of OAuth protocol wiring (PKCE, dynamic client registration, token exchange)
  • Container scoping tests verify isolation between projects

Score: 10/10

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant