Colby MchenryandGitHub
68eaf0dbd8
## Summary
Completes the explore-overhaul arc: `codegraph_explore` becomes the single primary tool an agent reaches for, and its coverage + output shape are tuned so flow/architecture questions resolve with near-zero Read/Grep.
### What changed
- **explore is the sole primary tool** — removed `codegraph_context` (the fuzzy-input Read-trigger) and `codegraph_trace` (under-picked by agents); explore already surfaces the call flow among the symbols you name. A plain natural-language question now works as the query.
- **Store/handler coverage** — functions defined inside object literals (Zustand `create((set, get) => ({ … }))`, Redux/Pinia/MobX, exported handler/route maps) are indexed as real symbols, including calls through `useStore.getState().fn()` and destructured `const { fn } = useStore.getState()`. A general AST rule, not a per-lib hack.
- **Overload disambiguation** — explore leads with the *right* definition when a method name is overloaded across types (a PascalCase type token in the query biases to that type's own def); `codegraph_node` returns *every* overload's body in one call, with an optional `file`/`line` selector to pin one.
- **Method-atomic render** — explore never returns half a method; at the size budget it drops whole methods/files (and lists what it dropped) instead of truncating a body mid-method.
- **Native-read-shaped output** — per-call output is capped to ~24K with a 25K hard ceiling and concentrated into ~150–250-line flow windows, mirroring how the agent natively reads; repo size scales the *call* budget, not the per-call size (a larger response just gets externalized to a file the host Reads back).
- **Blast radius** folded into explore (dependents + covering tests, locations only).
### Benchmark (refreshed on this build)
Re-validated the 7-repo A/B on 2026-06-02 (Opus 4.8, effort=high, median of 4). WITH arm re-measured on this build, WITHOUT reused:
**~16% cheaper · 47% fewer tokens · 22% faster · 58% fewer tool calls** — 0 file reads on 6 of 7 repos (Gin ~1).
The arc trades larger, cache-heavy explore responses for guaranteed near-zero reads, so cost/token margins soften vs the prior build (Excalidraw and Tokio land at cost break-even) while time and tool-calls stay clear wins everywhere — consistent with the project's stated optimization target (latency + tool-calls, not token cost).
### Validation
- Full suite green: **1112 passed, 2 skipped**.
- 28/28 plain WITH runs across the 7 README repos completed clean; reads median 0 on 6/7.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
110 lines
3.8 KiB
TypeScript
110 lines
3.8 KiB
TypeScript
/**
|
|
* MCP tool input-size limits
|
|
*
|
|
* Regression coverage for the DoS vector: MCP clients can ship
|
|
* unbounded payloads (`query`, `task`, `symbol`, `projectPath`,
|
|
* `path`, `pattern`). Before the cap, a 100MB string would hit
|
|
* the FTS5 layer and pin the server. These tests assert that the
|
|
* tool layer rejects oversize inputs early.
|
|
*/
|
|
|
|
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
|
import * as fs from 'fs';
|
|
import * as path from 'path';
|
|
import * as os from 'os';
|
|
import CodeGraph from '../../src/index';
|
|
import { ToolHandler } from '../../src/mcp/tools';
|
|
|
|
describe('MCP input size limits', () => {
|
|
let tempDir: string;
|
|
let cg: CodeGraph;
|
|
let handler: ToolHandler;
|
|
|
|
beforeEach(async () => {
|
|
tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'codegraph-mcp-limits-'));
|
|
fs.mkdirSync(path.join(tempDir, 'src'), { recursive: true });
|
|
fs.writeFileSync(
|
|
path.join(tempDir, 'src', 'a.ts'),
|
|
`export function alpha(): number { return 1; }\n`
|
|
);
|
|
cg = await CodeGraph.init(tempDir, {
|
|
config: { include: ['**/*.ts'], exclude: [] },
|
|
});
|
|
await cg.indexAll();
|
|
handler = new ToolHandler(cg);
|
|
});
|
|
|
|
afterEach(() => {
|
|
if (cg) cg.destroy();
|
|
if (fs.existsSync(tempDir)) {
|
|
fs.rmSync(tempDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it('accepts a normal-sized query', async () => {
|
|
const result = await handler.execute('codegraph_search', { query: 'alpha' });
|
|
expect(result.isError).toBeFalsy();
|
|
});
|
|
|
|
it('rejects an oversize query on codegraph_search', async () => {
|
|
const huge = 'a'.repeat(20_000);
|
|
const result = await handler.execute('codegraph_search', { query: huge });
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/maximum length/i);
|
|
});
|
|
|
|
it('rejects an oversize query on codegraph_explore', async () => {
|
|
const huge = 'b'.repeat(50_000);
|
|
const result = await handler.execute('codegraph_explore', { query: huge });
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/maximum length/i);
|
|
});
|
|
|
|
it('rejects an oversize symbol on codegraph_callers', async () => {
|
|
const huge = 'c'.repeat(15_000);
|
|
const result = await handler.execute('codegraph_callers', { symbol: huge });
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/maximum length/i);
|
|
});
|
|
|
|
it('rejects an oversize symbol on codegraph_impact', async () => {
|
|
const huge = 'd'.repeat(11_000);
|
|
const result = await handler.execute('codegraph_impact', { symbol: huge });
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/maximum length/i);
|
|
});
|
|
|
|
it('rejects an oversize projectPath', async () => {
|
|
const hugePath = '/tmp/' + 'x'.repeat(5_000);
|
|
const result = await handler.execute('codegraph_search', {
|
|
query: 'alpha',
|
|
projectPath: hugePath,
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/projectPath/);
|
|
});
|
|
|
|
it('rejects an oversize path filter on codegraph_files', async () => {
|
|
const hugePath = 'src/' + 'y'.repeat(5_000);
|
|
const result = await handler.execute('codegraph_files', { path: hugePath });
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/path/);
|
|
});
|
|
|
|
it('rejects an oversize glob pattern on codegraph_files', async () => {
|
|
const hugePattern = '*'.repeat(5_000);
|
|
const result = await handler.execute('codegraph_files', { pattern: hugePattern });
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/pattern/);
|
|
});
|
|
|
|
it('rejects a non-string projectPath', async () => {
|
|
const result = await handler.execute('codegraph_search', {
|
|
query: 'alpha',
|
|
projectPath: 12345 as unknown as string,
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(result.content[0]!.text).toMatch(/projectPath/);
|
|
});
|
|
});
|