Add MCP server with OAuth for Cursor, Claude, ChatGPT, and Gemini

[Modsofthenation]

Why

Loadpath’s review loop lived in the local app and CLI. Cursor, Claude, ChatGPT, and Gemini can all speak MCP; remote hosts also expect OAuth 2.1 on Streamable HTTP.

What changed

• loadpath mcp — stdio MCP for Cursor / Claude Desktop. No OAuth; the process is already the user’s.
• loadpath serve hosts Streamable HTTP MCP at /mcp with an in-process OAuth 2.1 authorization server:
  • Protected Resource Metadata (RFC 9728) and Authorization Server Metadata (RFC 8414)
  • Dynamic client registration (RFC 7591) and Client ID Metadata Documents
  • Authorization code + PKCE, refresh tokens, optional consent PIN (--oauth-pin)
  • --public-url for HTTPS tunnels (Claude / ChatGPT / Gemini)
• Tools stay on the load path: list_workspaces, init_repo, index_repo, architecture, review, detect_repo, list_pull_requests, post_review_comment. review returns the brief (confidence, sinks, reviewers), not the full graph.

The local UI and /api/* stay unauthenticated. MCP HTTP requires a Bearer token.

Tests

pytest -m "not playwright" (including tests/e2e/test_mcp_oauth.py: metadata, DCR+PKCE, consent, CIMD, billing-path review).

  

Summary by CodeRabbit

• New Features

  • Added MCP support for workspace discovery, indexing, architecture reports, code reviews, pull requests, and review comments.
  • Added local stdio MCP access and authenticated HTTP MCP access at /mcp.
  • Added OAuth 2.1 authentication with client registration, PKCE, consent, token refresh, revocation, and optional PIN approval.
  • Added configurable public URL and OAuth settings to the server command.
  • Added compact architecture and review responses for MCP clients.

• Documentation

  • Documented MCP setup, OAuth configuration, supported tools, token storage, and review output.

• Tests

  • Added CLI and end-to-end MCP OAuth coverage.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6df43429-fd52-49d6-a5d9-846eff3f9d74

📥 Commits

Reviewing files that changed from the base of the PR and between 91abdf0 and ff60b44.

📒 Files selected for processing (11)

• README.md
• pyproject.toml
• src/loadpath/cli.py
• src/loadpath/mcp/__init__.py
• src/loadpath/mcp/compact.py
• src/loadpath/mcp/oauth.py
• src/loadpath/mcp/server.py
• src/loadpath/mcp/tools.py
• src/loadpath/server/app.py
• tests/e2e/test_cli_review.py
• tests/e2e/test_mcp_oauth.py

---

📝 Walkthrough

Walkthrough

This change adds MCP access to Loadpath through local stdio and authenticated Streamable HTTP modes. It adds repository, review, architecture, and SCM tools; compact responses; OAuth 2.1 flows; CLI options; application integration; documentation; and end-to-end tests.

Changes

MCP integration

Layer / File(s)	Summary
MCP tools and response contracts src/loadpath/mcp/compact.py, src/loadpath/mcp/tools.py, src/loadpath/mcp/server.py, src/loadpath/mcp/__init__.py, tests/e2e/test_mcp_oauth.py	MCP tools now support workspace operations, indexing, architecture reports, range reviews, repository detection, pull-request listing, and comment publication. Architecture and review responses are compacted and bounded.
OAuth authorization and token lifecycle src/loadpath/mcp/oauth.py, tests/e2e/test_mcp_oauth.py	The in-process OAuth provider supports client registration, CIMD, PKCE, consent, PIN approval, persistent tokens, scope validation, expiration, refresh, and revocation.
HTTP, stdio, and CLI integration src/loadpath/mcp/server.py, src/loadpath/server/app.py, src/loadpath/cli.py, pyproject.toml, README.md, tests/e2e/test_cli_review.py	The application exposes MCP at /mcp with OAuth and supports local stdio execution. The CLI accepts public URL and OAuth PIN options and adds the mcp command. Documentation, dependency configuration, and CLI coverage are updated.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPClient
  participant LoadpathOAuthProvider
  participant FastAPIApp
  participant MCPTools
  MCPClient->>LoadpathOAuthProvider: register client and authorize with PKCE
  LoadpathOAuthProvider-->>MCPClient: authorization code redirect
  MCPClient->>LoadpathOAuthProvider: exchange authorization code
  LoadpathOAuthProvider-->>MCPClient: access token
  MCPClient->>FastAPIApp: MCP request with bearer token
  FastAPIApp->>LoadpathOAuthProvider: validate access token
  FastAPIApp->>MCPTools: execute requested tool
  MCPTools-->>MCPClient: compact MCP response

Loading

Possibly related PRs

• Modsofthenation/PR-Reviewer#1: This change exposes the existing architecture, review, indexing, and SCM capabilities through MCP tools and the server layer.

Suggested reviewers: cursoragent

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/mcp-oauth-ccb4

---

_{Comment @coderabbitai help to get the list of available commands.}