Repository navigation
fix(mcp): stabilize five AWS server launch environments - #290
Draft
jesterG1979 wants to merge 2 commits into
Draft
jesterG1979 wants to merge 2 commits into
jesterG1979 wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The integration-test home-directory safeguard needs correction, and full build and security validation remain outstanding.
1 open issue
What changed in this PR
This PR stabilizes five AWS MCP launch environments to reduce cache growth from dependency re-resolution, complementing the separate proxy changes in #274.
Changes:
- Pins server versions and adds a fixed dependency-release cutoff across four plugin manifests.
- Adds local-index regression tests and opt-in real MCP startup and cache-reuse checks.
- Documents dependency updates, security considerations, and cutoff limitations.
| File | Description |
|---|---|
tools/test_mcp_environments.py |
Adds resolver, cache-reuse, and MCP startup checks. |
plugins/deploy-on-aws/.mcp.json |
Pins IaC and Pricing launches with a cutoff. |
plugins/codebase-documentor-for-aws/.mcp.json |
Applies the matching IaC pin and cutoff. |
plugins/aws-transform/.mcp.json |
Pins Transform with a cutoff. |
plugins/aws-serverless/.mcp.json |
Pins Serverless while preserving write access. |
mise.toml |
Adds the opt-in MCP integration-test task. |
docs/MCP_DEPENDENCIES.md |
Documents update procedures and resolution limitations. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repeated
uvx ...@latestlaunches refresh package resolution and can accumulate environments. Pin the five IaC, Pricing, Serverless and Transform launch requests to exact server versions and a fixed--exclude-newercutoff covering transitive releases.Related
Related to #255. Complements #274; its three proxy manifests are unchanged.
Changes
2026-10-18T00:00:00Z.--allow-writeargument.mise run test:mcp-launchesto check real MCP initialization, tool catalogs and environment reuse, plus dependency-update guidance.The cutoff needs deliberate updates, including for security fixes. It is not a cross-platform lockfile: Python/platform/index differences and yanked or removed distributions can still affect fresh resolution. Existing accumulated caches are not removed.
Validation
mise run test:python(24 October 2026): 138 passed; 5 opt-in integration cases skipped in this default run.mise run test:mcp-launches(18 October 2026): all 5 passed. Three launches per request, including a forced resolver refresh, preserved environment identity/count, all installed package versions, MCP server identity and complete tool catalog. Tool counts: IaC 8, Pricing 9, Serverless 25, Transform 19. No AWS tool operations were invoked.mise run lintandmise run validate(24 October 2026): passed with existing repository warnings.mise run buildis blocked downloading the configured dprint Markdown plugin (HTTP 403/proxy denial). The full pre-commit run is blocked by the environment's Go executable while installing Gitleaks; the Bandit hook separately references a missing.bandit-baseline.json. Full build/security validation remains outstanding.The published tree is byte-for-byte identical to the validated source tree (
e31d3f70dd0554d8428cecf540b04030479462ce) and is based directly on current upstream mainfbefb3764e67558fe10ac834dd85db49734aa9b6.Acknowledgment
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.