46 lines
2.1 KiB
Markdown
46 lines
2.1 KiB
Markdown
# Roadmap
|
|
|
|
Where the project stands and what is deliberately not planned. Design decisions are in
|
|
[docs/adr](adr/0001-full-access-by-default.md).
|
|
|
|
## 1.0.0
|
|
|
|
1.0.0 is a breaking rebuild of 0.x:
|
|
|
|
- one tool per operation of the pinned Gitea 28.1.0 swagger (537) plus `gitea_api_request`;
|
|
- stdio and streamable HTTP on the official `mcp` SDK;
|
|
- admin-token mode and per-user OAuth with dynamic client registration;
|
|
- a `setup` command, a generated tool inventory and a docs drift check in CI;
|
|
- live-Gitea integration tests and MCP smoke tests in CI.
|
|
|
|
The gates that 0.x used to restrict a shared service token (write opt-in, a policy file, per-resource
|
|
checks) are gone, together with the old web adapter and its extras (ADR 0001, 0006). All tool names
|
|
changed to `gitea_<domain>_<action>`.
|
|
|
|
## Known limits
|
|
|
|
- Tool list size. 538 tools is a lot for clients without tool search. Use `TOOLSETS`,
|
|
`READ_ONLY` and `DISABLED_TOOLS` for a slim profile. How claude.ai and Mistral Le Chat cope
|
|
with the full list is to be confirmed against the real clients.
|
|
- Gitea has no queue management, no instance configuration writes and no instance-wide OAuth
|
|
application endpoints, so there are no tools for them.
|
|
- The catalog follows one pinned swagger. A newer Gitea needs a re-pin and regeneration, and
|
|
`gitea_api_request` covers the gap in the meantime.
|
|
- Some operations need state that is hard to reproduce in CI (a registered runner executing a
|
|
job, a reachable remote for mirrors and migrations, uploaded packages). The integration sweep
|
|
calls every tool, and asserts Gitea's documented response where a full happy path is not
|
|
reproducible.
|
|
- In OAuth mode the server holds per-user Gitea tokens, encrypted at rest. That store is the most
|
|
sensitive asset after the admin token.
|
|
|
|
## Not planned
|
|
|
|
- A policy engine or per-repository allow lists inside the server. Restrict with the token's
|
|
scopes, per-user OAuth and the tool filters.
|
|
- Metrics endpoints, webhook ingest and scheduled jobs. This is an API bridge.
|
|
- Scraping the Gitea web UI for features the API lacks.
|
|
|
|
## Possible later work
|
|
|
|
- Re-pinning to newer Gitea releases as they ship.
|