feat(tasks/mcp): Add all 18 Oxc examples as MCP server tools #13226

Copilot · 2025-08-20T06:09:28Z

This PR expands the MCP server to expose all Oxc examples as tools, providing comprehensive access to the entire Oxc toolchain through a unified Model Context Protocol interface.

Changes

Added 17 New MCP Tools

The MCP server now provides access to all 18 Oxc examples (previously only had the parse tool):

Parser Tools:

parser_tsx - Parse TSX files
visitor - Demonstrate AST visitor pattern
regular_expression - Parse regular expressions

Analysis Tools:

linter - Lint JavaScript/TypeScript code
semantic - Perform semantic analysis with symbol resolution
cfg - Generate control flow graph visualizations

Code Processing Tools:

formatter - Format JavaScript/TypeScript code
transformer - Transform code with environment targeting
define - Replace global defines using transformer plugins

Compilation Tools:

compiler - Run complete Oxc pipeline (parse → transform → codegen)
codegen - Generate code from AST

Minification Tools:

minifier - Minify JavaScript code
dce - Perform dead code elimination
mangler - Mangle variable names

Type Tools:

isolated_declarations - Generate isolated TypeScript declarations

Regular Expression Tools:

regex_visitor - Analyze regex patterns with visitor pattern
parse_literal - Parse regex literals

Technical Implementation

Temporary file handling: Source code is written to /tmp/oxc-mcp/ before processing
Spawn-based execution: Each tool executes the corresponding cargo run -p <crate> --example <example> command
Comprehensive schemas: All tools have proper input validation and documentation
Error handling: Robust error reporting with timeouts and proper cleanup

Usage Example

// Format messy JavaScript code
{
  "name": "formatter",
  "arguments": {
    "sourceCode": "const x=1;if(x){console.log('hello');}"
  }
}

// Lint code and find issues
{
  "name": "linter", 
  "arguments": {
    "sourceCode": "debugger; const {} = {};"
  }
}

// Transform modern JavaScript to ES5
{
  "name": "transformer",
  "arguments": {
    "sourceCode": "const arrow = () => 42;",
    "targets": "es5"
  }
}

This makes the entire Oxc toolchain easily accessible through MCP-compatible clients, enabling powerful JavaScript/TypeScript analysis and transformation workflows.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

graphite-app · 2025-08-20T06:09:33Z

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

0-merge - adds this PR to the back of the merge queue
hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

_{An organization admin has enabled the Graphite Merge Queue in this repository.} _{Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.}

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Boshen · 2025-08-20T06:34:33Z

@copilot unify the code https://github.com/oxc-project/oxc/blob/main/tasks/mcp/src/parser.ts

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Copilot · 2025-08-20T06:40:30Z

@copilot unify the code https://github.com/oxc-project/oxc/blob/main/tasks/mcp/src/parser.ts

I've unified the code by extracting all tool implementations into modular functions following the same pattern as the existing parseCode function. Created a new tools.ts module with clean, reusable functions for each tool, eliminating the code duplication in index.ts. The code is now properly organized and maintainable. Commit: 1167671

Boshen · 2025-08-20T06:51:07Z

@copilot move logic of tasks/mcp/src/parser.ts to tasks/mcp/src/tools.ts and remove tasks/mcp/src/parser.ts

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Copilot · 2025-08-20T06:55:54Z

@copilot move logic of tasks/mcp/src/parser.ts to tasks/mcp/src/tools.ts and remove tasks/mcp/src/parser.ts

Moved the parseCode function and ParseOptions interface from tasks/mcp/src/parser.ts to tasks/mcp/src/tools.ts and removed the parser.ts file. All tool implementations are now consolidated in the tools.ts module. The import in index.ts has been updated accordingly. Commit: 41ee2cb

Copilot

Pull Request Overview

This PR significantly expands the MCP server functionality by adding 17 new tools that expose all Oxc examples, transforming it from a simple echo server into a comprehensive JavaScript/TypeScript analysis toolchain accessible through the Model Context Protocol.

Key changes:

Added 17 new MCP tools covering the entire Oxc toolchain (parser, linter, formatter, semantic analysis, transformation, compilation, minification, etc.)
Consolidated tool implementations into a unified tools.ts file with shared temporary file handling
Updated documentation to reflect the comprehensive tool set available

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
`tasks/mcp/src/tools.ts`	New comprehensive file containing all 18 Oxc tool implementations with shared utilities
`tasks/mcp/src/parser.ts`	Removed - functionality moved to tools.ts
`tasks/mcp/src/index.ts`	Updated to expose all 18 tools through MCP interface with proper schemas
`tasks/mcp/README.md`	Extensively updated documentation covering all available tools and usage examples

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

tasks/mcp/src/tools.ts

Copilot · 2025-08-20T08:05:29Z

tasks/mcp/src/tools.ts

+  // Create temp directory if it doesn't exist
+  mkdirSync('/tmp/oxc-mcp', { recursive: true });
+
+  const tempPath = join('/tmp/oxc-mcp', filename);


The filename parameter is directly used in the path construction without sanitization, which could lead to path traversal vulnerabilities if malicious filenames like '../../../etc/passwd' are provided. Consider sanitizing the filename or using a generated unique filename.

Suggested change

const tempPath = join('/tmp/oxc-mcp', filename);

const safeFilename = basename(filename);

const tempPath = join('/tmp/oxc-mcp', safeFilename);

tasks/mcp/src/tools.ts

Copilot · 2025-08-20T08:05:29Z

tasks/mcp/src/tools.ts

+  const literalContent = `/${pattern}/${flags}`;
+  const tempPath = writeTempFile(literalContent, 'regex.txt');
+
+  try {


The parseLiteral function duplicates the temporary file handling logic instead of using the executeWithTempFile helper. This creates code duplication and maintenance overhead. Consider refactoring to use the shared helper function.

Suggested change

try {

return executeWithTempFile(literalContent, 'regex.txt', async (tempPath) => {

graphite-app · 2025-08-20T08:05:32Z

tasks/mcp/src/tools.ts

+ */
+function writeTempFile(sourceCode: string, filename: string): string {
+  // Create temp directory if it doesn't exist
+  mkdirSync('/tmp/oxc-mcp', { recursive: true });


The hardcoded path /tmp/oxc-mcp creates a cross-platform compatibility issue. Windows systems don't have a /tmp directory, which will cause mkdirSync to fail at runtime. Consider using os.tmpdir() from Node's standard library to get the platform-appropriate temporary directory:

import { tmpdir } from 'os'; // ... const tempDir = join(tmpdir(), 'oxc-mcp'); mkdirSync(tempDir, { recursive: true });

This ensures the code works correctly across all operating systems that Node.js supports.

Suggested change

mkdirSync('/tmp/oxc-mcp', { recursive: true });

import { tmpdir } from 'os';

import { join } from 'path';

const tempDir = join(tmpdir(), 'oxc-mcp');

mkdirSync(tempDir, { recursive: true });

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

graphite-app · 2025-08-20T08:05:34Z

tasks/mcp/src/tools.ts

+  // Create temp directory if it doesn't exist
+  mkdirSync('/tmp/oxc-mcp', { recursive: true });
+
+  const tempPath = join('/tmp/oxc-mcp', filename);


The hardcoded path /tmp/oxc-mcp introduces both a path traversal vulnerability and cross-platform compatibility issues. The filename parameter could be manipulated to write files outside the intended directory (e.g., using ../ sequences).

For better security and compatibility:

Use os.tmpdir() to get the system's temporary directory

Create a unique subdirectory with mkdtemp()

Sanitize the filename parameter to prevent path traversal

Example implementation:

import { mkdtempSync } from 'fs'; import { tmpdir } from 'os'; import { join, basename } from 'path'; // Create a secure temporary directory const tempDir = mkdtempSync(join(tmpdir(), 'oxc-mcp-')); // Use basename to strip any path components from filename const safePath = join(tempDir, basename(filename));

This approach works across platforms and prevents writing files outside the temporary directory.

Suggested change

const tempPath = join('/tmp/oxc-mcp', filename);

const tempDir = mkdtempSync(join(tmpdir(), 'oxc-mcp-'));

const tempPath = join(tempDir, basename(filename));

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

graphite-app · 2025-08-20T08:05:35Z

tasks/mcp/src/tools.ts

+  const regexContent = `/${pattern}/${flags}`;
+  const tempPath = writeTempFile(regexContent, 'regex.txt');


Security Vulnerability: The code creates a regex string by directly concatenating user-provided pattern and flags without validation or escaping. This introduces a potential regex injection vulnerability that could lead to ReDoS (Regular Expression Denial of Service) attacks or parsing failures.

Consider adding validation for both the pattern and flags:

// Validate flags (should only contain valid regex flags: gimsuyd) if (flags && !/^[gimsuyd]*$/.test(flags)) { throw new Error('Invalid regex flags'); } // Consider validating pattern syntax or using a safe regex construction method // instead of string concatenation

Additionally, the pattern itself should be validated to ensure it represents a valid regular expression before being passed to the parser.

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

graphite-app · 2025-08-20T08:12:30Z

tasks/mcp/src/tools.ts

+function writeTempFile(sourceCode: string, filename: string): string {
+  // Create temp directory if it doesn't exist
+  mkdirSync('/tmp/oxc-mcp', { recursive: true });
+  const tempPath = join('/tmp/oxc-mcp', filename);


The temporary file path lacks a unique identifier, which creates a risk of race conditions when handling concurrent requests. Consider adding a timestamp and random string to ensure uniqueness:

const tempPath = join('/tmp/oxc-mcp', `${Date.now()}-${Math.random().toString(36).substring(2)}-${filename}`);

This approach is similar to what's already implemented in the original parser.ts file, which properly handles concurrent requests with unique filenames.

Suggested change

const tempPath = join('/tmp/oxc-mcp', filename);

const tempPath = join('/tmp/oxc-mcp', `${Date.now()}-${Math.random().toString(36).substring(2)}-${filename}`);

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Boshen · 2025-08-20T08:18:09Z

@copilot apply review comments

tasks/mcp/src/tools.ts

…move broken code Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Copilot · 2025-08-20T08:24:14Z

@copilot apply review comments

Applied all review comments to clean up the code. Fixed duplicate imports, removed broken code patterns, and unified all tools to use the consistent executeWithTempFile pattern. The code is now clean, maintainable, and follows the same structure throughout. Commit: 975e538

graphite-app · 2025-08-20T08:26:35Z

tasks/mcp/src/tools.ts

+    const args = ['run', '-p', 'oxc_linter', '--example', 'linter', tempPath];
+    if (opts.showAst) {


There appears to be an incorrect package and example reference in the parseCode function. The function is using oxc_linter and the linter example, but based on the function name and purpose, it should be using oxc_parser and the parser example instead:

const args = ['run', '-p', 'oxc_linter', '--example', 'linter', tempPath];

This will cause the parse tool to execute the linter example rather than the parser example, which would produce incorrect results when users attempt to use the parse functionality.

Suggested change

const args = ['run', '-p', 'oxc_linter', '--example', 'linter', tempPath];

if (opts.showAst) {

const args = ['run', '-p', 'oxc_parser', '--example', 'parser', tempPath];

if (opts.showAst) {

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

Boshen · 2025-08-20T11:10:33Z

I'll add these 1 by 1 so I can test them.

Initial plan

5324129

Copilot AI assigned Copilot and Boshen Aug 20, 2025

Copilot started work on behalf of Boshen August 20, 2025 06:09 View session

Copilot AI and others added 2 commits August 20, 2025 06:18

Add all 18 Oxc examples as MCP tools

49b208c

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Update MCP server documentation with all 18 tools

acc35d6

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Get all the examples from @oxc-project/oxc/files/crates and add them to mcp server in @oxc-project/oxc/files/tasks/mcp~~ Add all 18 Oxc examples as MCP server tools Aug 20, 2025

Copilot AI requested a review from Boshen August 20, 2025 06:21

Copilot finished work on behalf of Boshen August 20, 2025 06:21

Copilot started work on behalf of Boshen August 20, 2025 06:34 View session

Unify MCP code by extracting modular tool functions

1167671

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Copilot finished work on behalf of Boshen August 20, 2025 06:41

Copilot started work on behalf of Boshen August 20, 2025 06:51 View session

Move parseCode function from parser.ts to tools.ts and remove parser.ts

41ee2cb

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Copilot finished work on behalf of Boshen August 20, 2025 06:56

Boshen and others added 2 commits August 20, 2025 15:46

update

f39fee0

[autofix.ci] apply automated fixes

4b7297e

Boshen changed the title ~~Add all 18 Oxc examples as MCP server tools~~ feat(tasks/mcp): Add all 18 Oxc examples as MCP server tools Aug 20, 2025

github-actions bot added the C-enhancement Category - New feature or request label Aug 20, 2025

Boshen marked this pull request as ready for review August 20, 2025 08:03

Copilot AI review requested due to automatic review settings August 20, 2025 08:03

update

c30636f

Copilot AI reviewed Aug 20, 2025

View reviewed changes

graphite-app bot reviewed Aug 20, 2025

View reviewed changes

Boshen and others added 2 commits August 20, 2025 16:16

Update tasks/mcp/src/tools.ts

40cc6b2

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update tasks/mcp/src/tools.ts

fd316ff

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of Boshen August 20, 2025 08:18 View session

graphite-app bot reviewed Aug 20, 2025

View reviewed changes

tasks/mcp/src/tools.ts Show resolved Hide resolved

Clean up tools.ts: fix duplicate imports, unify code patterns, and re…

975e538

…move broken code Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

Copilot stopped work on behalf of Boshen due to an error August 20, 2025 08:25
The "Run pnpm run --filter mcp-oxc build" custom setup step from your .github/workflows/copilot-setup-steps.yml file failed.

graphite-app bot reviewed Aug 20, 2025

View reviewed changes

Boshen marked this pull request as draft August 20, 2025 11:10

	const tempPath = join('/tmp/oxc-mcp', filename);
	const safeFilename = basename(filename);
	const tempPath = join('/tmp/oxc-mcp', safeFilename);

	try {
	return executeWithTempFile(literalContent, 'regex.txt', async (tempPath) => {

-  mkdirSync('/tmp/oxc-mcp', { recursive: true });
+  import { tmpdir } from 'os';
+  import { join } from 'path';
+  const tempDir = join(tmpdir(), 'oxc-mcp');
+  mkdirSync(tempDir, { recursive: true });

	const tempPath = join('/tmp/oxc-mcp', filename);
	const tempDir = mkdtempSync(join(tmpdir(), 'oxc-mcp-'));
	const tempPath = join(tempDir, basename(filename));

		const regexContent = `/${pattern}/${flags}`;
		const tempPath = writeTempFile(regexContent, 'regex.txt');

	const tempPath = join('/tmp/oxc-mcp', filename);
	const tempPath = join('/tmp/oxc-mcp', `${Date.now()}-${Math.random().toString(36).substring(2)}-${filename}`);

		const args = ['run', '-p', 'oxc_linter', '--example', 'linter', tempPath];
		if (opts.showAst) {

Uh oh!

feat(tasks/mcp): Add all 18 Oxc examples as MCP server tools #13226

Are you sure you want to change the base?

feat(tasks/mcp): Add all 18 Oxc examples as MCP server tools #13226

Uh oh!

Conversation

Copilot AI commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Added 17 New MCP Tools

Technical Implementation

Usage Example

Uh oh!

graphite-app bot commented Aug 20, 2025

How to use the Graphite Merge Queue

Uh oh!

Boshen commented Aug 20, 2025

Uh oh!

Copilot AI commented Aug 20, 2025

Uh oh!

Boshen commented Aug 20, 2025

Uh oh!

Copilot AI commented Aug 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

Boshen commented Aug 20, 2025

Uh oh!

Uh oh!

Copilot AI commented Aug 20, 2025

Uh oh!

graphite-app bot Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

Boshen commented Aug 20, 2025

Uh oh!

Uh oh!

Copilot AI commented Aug 20, 2025 •

edited

Loading