feat(mcp): read HONCHO_API_URL env var to support self-hosted Honcho instances#575
Conversation
The MCP Worker hardcoded https://api.honcho.dev for every request, forcing anyone running a self-hosted Honcho instance to patch the source before deploying their own Worker alongside it. Route the baseUrl through the Worker env so operators can set HONCHO_API_URL (via .dev.vars for local development or wrangler secret for deployed Workers) and point the Worker at their instance. The variable is intentionally not exposed as a request header: that would let public clients steer traffic to internal URLs, which is a latency and security regression. When HONCHO_API_URL is unset, the Worker falls back to https://api.honcho.dev, so existing deployments are unaffected. Closes plastic-labs#508
WalkthroughThe PR adds support for self-hosted Honcho instances by enabling configuration of a custom API base URL. An Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
mcp/src/config.ts (1)
11-53: LGTM overall; consider lightweight URL validation.The
Envinterface, defaultenv = {}parameter, andenv.HONCHO_API_URL?.trim() || "https://api.honcho.dev"resolution are correct and backward-compatible — empty/whitespace values correctly fall back to the managed default.Optional hardening: if
HONCHO_API_URLis set to a malformed value (e.g., missing scheme), the error surfaces later from the SDK at request time with a less obvious message. A one-linenew URL(trimmed)check inparseConfigwould fail fast at Worker startup/first request with a clear operator-facing error. Non-blocking.🔧 Optional hardening
- baseUrl: env.HONCHO_API_URL?.trim() || "https://api.honcho.dev", + baseUrl: (() => { + const override = env.HONCHO_API_URL?.trim(); + if (!override) return "https://api.honcho.dev"; + try { + new URL(override); + } catch { + throw new Error( + `Invalid HONCHO_API_URL: ${override}. Must be an absolute URL (e.g., http://127.0.0.1:8000).`, + ); + } + return override; + })(),Note:
parseConfigerrors currently return 401 inindex.ts; a misconfigured env var is really a 500-class condition, so if you adopt this you may also want to distinguish config errors from auth errors in the caller.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@mcp/src/config.ts` around lines 11 - 53, parseConfig currently accepts HONCHO_API_URL values as-is which can be malformed and cause confusing errors later; add a lightweight URL validation by trimming env.HONCHO_API_URL and, when non-empty, passing it to new URL(...) to throw early on invalid values (update the Env usage in parseConfig and the baseUrl resolution logic that computes baseUrl to validate the trimmedHONCHO variable before falling back to "https://api.honcho.dev"). Ensure you reference Env, parseConfig, HONCHO_API_URL, and baseUrl so the change is easy to locate.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@mcp/src/config.ts`:
- Around line 11-53: parseConfig currently accepts HONCHO_API_URL values as-is
which can be malformed and cause confusing errors later; add a lightweight URL
validation by trimming env.HONCHO_API_URL and, when non-empty, passing it to new
URL(...) to throw early on invalid values (update the Env usage in parseConfig
and the baseUrl resolution logic that computes baseUrl to validate the
trimmedHONCHO variable before falling back to "https://api.honcho.dev"). Ensure
you reference Env, parseConfig, HONCHO_API_URL, and baseUrl so the change is
easy to locate.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4dbc07f0-5e7a-4169-8d78-7df46782a071
📒 Files selected for processing (5)
mcp/.dev.vars.examplemcp/.gitignoremcp/README.mdmcp/src/config.tsmcp/src/index.ts
2 participants
Summary
HONCHO_API_URLenv binding,falling back to
https://api.honcho.devwhen unset..dev.varslocally,wrangler secretfor deployed Workers) in
mcp/README.md.mcp/.dev.vars.exampleso the convention is discoverable.Motivation
Closes #508. Prior PRs #540 and #503 tried to solve the same problem with an
X-Honcho-Base-URLrequest header; both were declined because exposing theupstream URL as a header is a latency/security regression for the hosted
Worker. This PR uses the env-var mechanism suggested by @ajspig in #540:
Changes
mcp/src/config.tsEnvbinding; readHONCHO_API_URLwith fallbackmcp/src/index.tsenvtoparseConfigmcp/.dev.vars.examplemcp/README.mdBackwards compatibility
No breaking change.
HONCHO_API_URLis optional. Unset → identical behaviorto
maintoday.Test plan
bun run tsc --noEmitpasseshttp://127.0.0.1:28000succeeds withHONCHO_API_URLsetapi.honcho.devsucceeds withHONCHO_API_URLunset (no regression)Summary by CodeRabbit
New Features
HONCHO_API_URLenvironment variable, allowing the Worker to integrate with self-hosted Honcho instances while maintaining backward compatibility with the default endpoint.Documentation