Skip to content

feat(mcp): add local server lifecycle telemetry#1052

Draft
calebeden wants to merge 1 commit into
openclaw:mainfrom
calebeden:calebeden-mcp-lifecycle-telemetry
Draft

feat(mcp): add local server lifecycle telemetry#1052
calebeden wants to merge 1 commit into
openclaw:mainfrom
calebeden:calebeden-mcp-lifecycle-telemetry

Conversation

@calebeden

Copy link
Copy Markdown
Contributor
Additional instructions

MUST: Keep Allow edits from maintainers enabled for this PR so maintainers
can help update the branch when needed.

What Problem This Solves

The local MCP server is a core debugging path, especially in MCP-only mode, but operators currently cannot observe server startup and shutdown, listener failures, authentication rejection, handler saturation, request deadlines, or HTTP handling duration through OpenTelemetry.

Why This Change Was Made

This adds typed traces and metrics at the shared MCP HTTP server boundary so MCP-only and gateway-enabled local MCP use the same diagnostics. It preserves existing HTTP behavior, keeps node-tool invocation telemetry independent, and exports only finite operational classifications with no request content, addresses, headers, tokens, JSON-RPC fields, or error messages.

User Impact

Operators and developers can diagnose local MCP lifecycle failures, authentication rejection, busy responses, timeouts, shutdown cancellation, and request latency through the existing configured OpenTelemetry pipeline. No UI, configuration, command, or protocol changes are required.

Evidence

  • Full repository build completed successfully on Windows ARM64.
  • Focused MCP telemetry and server tests passed: 38/38.
  • Shared tests passed: 3,237 passed, 31 expected skips.
  • Tray tests passed: 1,954/1,954.
  • Dual-model adversarial review of current HEAD completed with no actionable findings from either Claude Opus or GPT Codex.

Change Type

  • Bug fix
  • Feature
  • Refactor
  • Docs or instructions
  • Tests or validation
  • Security hardening
  • Chore or infrastructure

Scope

  • Tray or WinUI UX
  • Windows node capability
  • Local MCP or winnode
  • Gateway, connection, or pairing
  • Setup or onboarding
  • Permissions, privacy, or security
  • Tests, CI, or docs

Validation

  • ./build.ps1
    • Passed. Shared, CLI, WinNode CLI, Setup Engine, and WinUI built successfully.
  • dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --filter "FullyQualifiedName~McpServerTelemetryTests|FullyQualifiedName~McpHttpServerTelemetryTests|FullyQualifiedName~McpHttpServerTests" --no-restore
    • Passed: 38, failed: 0, skipped: 0.
  • dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore
    • Passed: 3,237, failed: 0, skipped: 31.
  • dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore
    • Passed: 1,954, failed: 0, skipped: 0.

Real Behavior Proof

  • Environment tested: Windows 11 ARM64, .NET SDK 10.0.301
  • PR head or commit tested: 947448c4
  • Exact steps or command run: Focused McpServerTelemetryTests, McpHttpServerTelemetryTests, and McpHttpServerTests command listed above
  • Evidence after fix: Deterministic HTTP integration tests exercise lifecycle success and failure, authentication rejection, busy admission, timeout, shutdown cancellation, transport failure, drain timeout, first-writer cancellation attribution, and request duration histogram emission with matching finite tags.
  • Observed result: 38/38 focused tests passed. Request counts and duration measurements are emitted exactly once with matching reviewed tags.
  • Screenshot or artifact links verified? (Yes/No/N/A): N/A
  • Not verified or blocked: Current-head live OTLP collector output and winnode discovery/invocation were not rerun. The changed telemetry and cancellation behavior is covered by current-head deterministic MCP HTTP integration tests.

Security Impact

  • New permissions or capabilities? (Yes/No): No
  • Secrets or tokens handling changed? (Yes/No): No
  • New or changed network calls? (Yes/No): No
  • Command or tool execution surface changed? (Yes/No): No
  • Data access scope changed? (Yes/No): No
  • If any answer is Yes, explain the risk and mitigation: N/A

Compatibility and Migration

  • Backward compatible? (Yes/No): Yes
  • Config or environment changes? (Yes/No): No
  • Migration needed? (Yes/No): No
  • If yes, list the exact upgrade steps: N/A

Review Conversations

  • I replied to or resolved every bot review conversation addressed by this PR.
  • I left unresolved only conversations that still need maintainer judgment.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. labels Jul 24, 2026
@clawsweeper

clawsweeper Bot commented Jul 24, 2026

Copy link
Copy Markdown

Codex review: needs real behavior proof before merge. Reviewed July 24, 2026, 4:00 PM ET / 20:00 UTC.

ClawSweeper review

What this changes

This PR adds bounded OpenTelemetry traces and metrics for local MCP server start, stop, request handling, admission failures, timeouts, and listener errors, plus tests and telemetry documentation.

Merge readiness

Blocked until real behavior proof from a real setup is added - 4 items remain

Keep this draft PR open for normal review. The patch adds a useful diagnostics surface and focused coverage, but its claimed real behavior proof is test-only, so it does not yet demonstrate telemetry exported from a live MCP server or the required MCP discovery/invocation path.

Priority: P3
Reviewed head: 947448c4938013cf27f6a32b8b47a519e6a4c6fa

Review scores

Measure Result What it means
Overall readiness 🦪 silver shellfish (2/6) The implementation has useful focused coverage, but current-head real behavior proof for the telemetry and MCP transport path is still missing.
Proof confidence 🦪 silver shellfish (2/6) Needs real behavior proof before merge: The PR provides deterministic integration-test results but no live MCP server plus collector evidence, and it explicitly notes that current-head winnode discovery/invocation was not rerun. Add redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🦐 gold shrimp (3/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Needs proof Needs real behavior proof before merge: The PR provides deterministic integration-test results but no live MCP server plus collector evidence, and it explicitly notes that current-head winnode discovery/invocation was not rerun. Add redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 6 items PR telemetry surface: The proposed branch introduces a dedicated MCP server telemetry component with named spans and metrics, and wires it into the shared local MCP HTTP server.
Lifecycle-path scope: The main server implementation changes by 586 added and 103 removed lines, including lifecycle, admission, timeout, cancellation, and disposal paths; this is more than a documentation-only instrumentation change.
Focused regression coverage: The branch adds HTTP-server telemetry integration tests and finite-value telemetry contract tests, alongside a collection that serializes the telemetry-sensitive server tests.
Findings None None.
Security None None.

How this fits together

The local MCP HTTP server accepts requests from MCP clients and forwards JSON-RPC tool calls into the Windows node bridge. This change instruments that transport boundary so configured telemetry backends can observe server lifecycle and request outcomes without exporting request content.

flowchart LR
  A[MCP client] --> B[Local MCP HTTP server]
  B --> C[Admission and authentication]
  C --> D[Request handler]
  D --> E[Windows node bridge]
  B --> F[Lifecycle and request telemetry]
  F --> G[Configured telemetry backend]
Loading

Before merge

  • Add real behavior proof - Needs real behavior proof before merge: The PR provides deterministic integration-test results but no live MCP server plus collector evidence, and it explicitly notes that current-head winnode discovery/invocation was not rerun. Add redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
  • Resolve merge risk (P2) - The patch substantially changes the local server’s lifecycle, handler-admission, timeout, cancellation, and disposal paths. Focused tests reduce risk, but a live MCP request is still needed to confirm that normal tool traffic and shutdown behavior remain available.
  • Resolve merge risk (P1) - The new telemetry is exported through an operator-configured endpoint. Before merge, live collector evidence should confirm that emitted tags remain bounded and contain no request bodies, headers, addresses, tokens, JSON-RPC fields, or error messages.
  • Complete next step (P2) - This draft needs contributor-supplied real behavior proof rather than an automated code repair; maintainers can reassess once the live MCP and collector evidence is attached.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Server-path change 586 added, 103 removed in 1 server file The telemetry feature also restructures lifecycle and request-control code, so runtime proof matters beyond the new signal definitions.
Test coverage 994 added test lines across 2 new test files The patch contains focused contract and HTTP integration coverage for the new telemetry behavior.
PR scope 7 files affected, 2,041 additions, 103 deletions The size is notable for a draft feature that changes a core local transport boundary.

Merge-risk options

Maintainer options:

  1. Add live MCP telemetry proof (recommended)
    Run the current PR head against a configured collector and show redacted start, request, and stop output alongside a successful MCP discovery and invocation check.
  2. Pause until runtime proof is available
    Keep the draft open if a safe local collector or Windows-node environment is unavailable, because tests alone do not demonstrate the exported operational behavior.

Technical review

Best possible solution:

Keep the shared transport-level telemetry design, then add redacted current-head proof from a live configured collector plus a winnode --list-tools and representative winnode --command ... run before merging.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR proposes a new operational telemetry surface rather than reporting a currently broken behavior. The server paths can be exercised by live MCP discovery, invocation, and collector capture.

Is this the best way to solve the issue?

Unclear: the shared server boundary is a maintainable location for lifecycle instrumentation, and the included tests cover many paths, but the proposed solution still needs live collector and MCP invocation evidence to validate its privacy and runtime claims.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f50af187865c.

Labels

Label changes:

  • add P3: This is a diagnostics enhancement rather than a reported user-facing regression or release-blocking failure.
  • add merge-risk: 🚨 security-boundary: The patch introduces newly exported server telemetry and must prove that sensitive MCP request data cannot cross the configured telemetry boundary.
  • add merge-risk: 🚨 availability: The shared local MCP server’s start, stop, admission, timeout, and drain paths change, so a regression could make local MCP requests unavailable.
  • add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR provides deterministic integration-test results but no live MCP server plus collector evidence, and it explicitly notes that current-head winnode discovery/invocation was not rerun. Add redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

  • P3: This is a diagnostics enhancement rather than a reported user-facing regression or release-blocking failure.
  • merge-risk: 🚨 availability: The shared local MCP server’s start, stop, admission, timeout, and drain paths change, so a regression could make local MCP requests unavailable.
  • merge-risk: 🚨 security-boundary: The patch introduces newly exported server telemetry and must prove that sensitive MCP request data cannot cross the configured telemetry boundary.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR provides deterministic integration-test results but no live MCP server plus collector evidence, and it explicitly notes that current-head winnode discovery/invocation was not rerun. Add redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

  • PR telemetry surface: The proposed branch introduces a dedicated MCP server telemetry component with named spans and metrics, and wires it into the shared local MCP HTTP server. (src/OpenClaw.Shared/Telemetry/McpServerTelemetry.cs:1, 947448c49380)
  • Lifecycle-path scope: The main server implementation changes by 586 added and 103 removed lines, including lifecycle, admission, timeout, cancellation, and disposal paths; this is more than a documentation-only instrumentation change. (src/OpenClaw.Shared/Mcp/McpHttpServer.cs:6, 947448c49380)
  • Focused regression coverage: The branch adds HTTP-server telemetry integration tests and finite-value telemetry contract tests, alongside a collection that serializes the telemetry-sensitive server tests. (tests/OpenClaw.Shared.Tests/McpHttpServerTelemetryTests.cs:1, 947448c49380)
  • Telemetry privacy contract: The accompanying documentation defines lifecycle and request signals and states that exported values are finite operational classifications rather than request content or credentials. (docs/TELEMETRY.md:269, 947448c49380)
  • Feature-history routing: Repository release history identifies codemonkeychris as the author of the original local MCP HTTP server and the related winnode CLI work, making that history the strongest available routing signal for the affected boundary. (github.com) (src/OpenClaw.Shared/Mcp/McpHttpServer.cs:1)
  • Current review state: The PR body reports focused tests and repository test runs, but explicitly says that live OTLP collector output and winnode discovery/invocation were not rerun on the current head. (947448c49380)

Likely related people:

  • codemonkeychris: Release history attributes both the original local MCP HTTP server and the related winnode CLI surface to this contributor, which makes them the strongest available owner signal for changes at this transport boundary. (github.com) (role: local MCP feature introducer and adjacent CLI contributor; confidence: medium; files: src/OpenClaw.Shared/Mcp/McpHttpServer.cs, src/OpenClaw.WinNode.Cli/skill.md)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Capture redacted collector output from a live local MCP server showing start, request, and stop telemetry.
  • Run and capture winnode --list-tools plus a representative winnode --command ... invocation against the current PR head.
  • Update the PR body with the proof; a maintainer can request @clawsweeper re-review if a fresh review does not start automatically.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant