Missing: Tests for MCP API Controller tool execution

[Snider]

Description

The McpApiController has significant functionality but lacks dedicated test coverage for critical paths including tool execution, version resolution, and error handling.

Location

• src/Api/Controllers/McpApiController.php
• No corresponding test file found in src/Api/Tests/Feature/

Missing Test Coverage

1. Tool execution flow (callTool method):

   • Valid tool execution
   • Invalid server/tool combinations
   • Version resolution and deprecation warnings
   • Input validation against JSON schema
   • Error handling for failed executions

2. Version management:

   • Version resolution (latest, specific, deprecated)
   • Sunset version blocking (410 responses)
   • Deprecation header injection

3. Security boundaries:

   • API key scope enforcement on POST /tools/call
   • Server scope restrictions
   • Rate limiting behaviour

4. Error conditions:

   • Invalid server ID
   • Invalid tool name
   • Schema validation failures
   • Process execution failures

Impact

Without tests, regressions in the MCP API could go undetected, potentially breaking integrations for API consumers.

Recommended Tests

// src/Api/Tests/Feature/McpApiControllerTest.php

it('returns 404 for unknown server', function () {
    $response = $this->withApiKey()->postJson('/api/v1/mcp/tools/call', [
        'server' => 'nonexistent',
        'tool' => 'some-tool',
    ]);
    
    $response->assertNotFound();
});

it('returns 404 for unknown tool', function () {
    // Mock registry to return a valid server
    $response = $this->withApiKey()->postJson('/api/v1/mcp/tools/call', [
        'server' => 'hosthub-agent',
        'tool' => 'nonexistent-tool',
    ]);
    
    $response->assertNotFound();
});

it('returns 422 for schema validation failures', function () {
    // Test with missing required arguments
});

it('returns 410 for sunset versions', function () {
    // Test version that has been sunset
});

it('includes deprecation headers for deprecated versions', function () {
    // Test deprecation warning headers
});

Priority

Medium - Test coverage is essential for maintainability and catching regressions.

[Snider]

Parent: #29

[Snider]

Target branch: epic/29-mcp-api-hardening (epic #29)

[google-labs-jules]

Jules is on it. When finished, you will see another comment and be able to review a PR.

[google-labs-jules]

Ready for a review! A PR has been created.