Skip to content

feat: add MCP server layer for FinBot (Week 7-8)#550

Open
ashike24 wants to merge 10 commits into
GenAI-Security-Project:mainfrom
ashike24:feat/week7-8-mcp-server
Open

feat: add MCP server layer for FinBot (Week 7-8)#550
ashike24 wants to merge 10 commits into
GenAI-Security-Project:mainfrom
ashike24:feat/week7-8-mcp-server

Conversation

@ashike24

Copy link
Copy Markdown

Summary

Adds an MCP server layer exposing FinBot as an MCP server, so it can be
used from MCP-compatible AI clients (Claude Desktop, Codex Desktop)
instead of only the browser. Per proposal section 6.4.

What's included

  • New finbot/mcp_server/ package with two tools:
    • submit_tool_call(session_id, message) — wraps VendorChatAssistant.stream_response()
    • get_scoring_results(session_id) — wraps UserChallengeProgressRepository
  • run_mcp_server.py entry point
  • New mcp_server Docker service (port 8100), sharing the sqlite_data
    volume and Redis with the main app
  • Auth reuses the existing SessionManager — no new auth mechanism.
    MCP clients pass an existing FinBot session_id.

Deviation from proposal

start_challenge_session (mentioned in the original proposal wording)
was dropped — there's no such concept in the codebase. Sessions already
exist via login, and challenge progress is tracked implicitly as the
player interacts with the agent (via the event detection pipeline).

Bug fix included

Found and fixed a pre-existing .env issue: DATABASE_URL pointed
outside the sqlite_data mounted volume, so app's SQLite data wasn't
actually persisted across container rebuilds. Fixed to point inside
the volume.

Testing

  • get_scoring_results: verified end-to-end against a real session — works.
  • submit_tool_call: verified it correctly resolves the session and reaches
    the LLM call, but is blocked by a missing OPENAI_API_KEY in my local
    dev env (pre-existing gap, unrelated to this change — the main app's
    /chat endpoint would hit the same issue).
  • Not yet tested with a real Claude Desktop / Codex Desktop connection —
    will follow up if needed.

Open questions for mentor

  • Is the session_id-based auth approach acceptable, or would you prefer
    a dedicated API token / different auth flow for MCP clients?
  • Confirming the start_challenge_session deviation above is fine.

ashike24 added 10 commits May 29, 2026 17:23
- New finbot/mcp_server/ package with submit_tool_call and
  get_scoring_results tools, wrapping VendorChatAssistant and
  UserChallengeProgressRepository respectively
- Auth via existing SessionManager (session_id -> SessionContext),
  no new auth mechanism needed
- Runs as separate Docker service (mcp_server) on port 8100,
  sharing sqlite_data volume + Redis with the main app
- Fixed pre-existing .env bug: DATABASE_URL pointed outside the
  mounted sqlite_data volume, causing data loss on container
  rebuild for both services
- Verified end-to-end: get_scoring_results fully working;
  submit_tool_call reaches the LLM call correctly, blocked only
  by a missing OPENAI_API_KEY in local dev env (pre-existing gap,
  unrelated to this change)
- start_challenge_session from original proposal wording dropped:
  no such concept exists in the codebase; sessions already exist
  via login and challenges progress implicitly
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant