feat: streamable HTTP transport, launch dashboard widget, tool annotations, LLM docs

- MCP Streamable HTTP transport (spec 2025-03-26): POST /mcp endpoint
  with Mcp-Session-Id session management; legacy /sse + /messages kept
  for backward compatibility
- Launch dashboard MCP app widget (get_launch_dashboard): renders live
  status, progress bar, pass/fail stats inline in Claude Desktop/claude.ai;
  ext-apps bundle fetched lazily from unpkg with fallback stub
- MCP resources support: resources/list + resources/read dispatch,
  Resource registry with RWMutex, ui:// URI scheme
- Tool annotations: readOnlyHint / destructiveHint auto-classified for all
  102 tools by naming convention (get_/list_/search_ → readonly,
  delete_/bulk_delete_/detach_ → destructive, rest → write)
- Tool _meta field: ui.resourceUri wiring for widget tools
- llms.txt + llms-full.txt: LLM-friendly project docs with full tool
  signatures for AI-assisted discovery
- Protocol: resources capability in InitializeResponse, Resource types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: MimoJanra

README.md

@@ -46,7 +46,7 @@ Add this to the `mcpServers` section:
 {
   "mcpServers": {
     "testops": {
-      "url": "http://your-server.com:3000/sse",
+      "url": "http://your-server.com:3000/mcp",
       "headers": {
         "Authorization": "Bearer your-mcp-auth-token", // optional
         "X-Allure-Token": "your-personal-allure-token"

cmd/server/main.go

@@ -61,6 +61,9 @@ func runHTTP(mcpServer *mcp.Server, cfg *config.Config, logger *core.Logger) {
 	}
 
 	mux := http.NewServeMux()
+	// Streamable HTTP transport (MCP spec 2025-03-26) — recommended
+	mux.HandleFunc("/mcp", mcpServer.HandleMCP)
+	// Legacy HTTP+SSE transport (MCP spec 2024-11-05) — kept for backward compat
 	mux.HandleFunc("/sse", mcpServer.HandleSSE)
 	mux.HandleFunc("/messages", mcpServer.HandleMessages)
 

internal/adapters/allure/client.go

@@ -50,9 +50,14 @@ func (c *Client) SetSessionTokenFunc(fn func(ctx context.Context) string) {
 
 // resolveAPIToken returns the API token to use for this request: the per-session
 // token (if set by the user via configure_allure_token) or the server-wide token.
+// The function-pointer field is read under the mutex to avoid a data race with
+// SetSessionTokenFunc, which writes the field under the same mutex.
 func (c *Client) resolveAPIToken(ctx context.Context) string {
-	if c.getSessionToken != nil {
-		if t := c.getSessionToken(ctx); t != "" {
+	c.mu.Lock()
+	fn := c.getSessionToken
+	c.mu.Unlock()
+	if fn != nil {
+		if t := fn(ctx); t != "" {
 			return t
 		}
 	}
@@ -65,14 +70,19 @@ func (c *Client) getJWTToken(ctx context.Context) (string, error) {
 		return "", fmt.Errorf("no token configured - set ALLURE_TOKEN env var or use configure_allure_token tool")
 	}
 
-	// Check cache without holding the lock during the HTTP call.
+	// Fast path: check cache under the lock.
 	c.mu.Lock()
 	if entry, ok := c.jwtCache[apiToken]; ok && time.Now().Before(entry.expiresAt) {
 		c.mu.Unlock()
 		return entry.jwt, nil
 	}
 	c.mu.Unlock()
 
+	// Cache miss – fetch a new JWT outside the lock so we don't block other
+	// goroutines. Two concurrent goroutines may both reach here for the same
+	// apiToken; that results in a harmless double-fetch. After the fetch we
+	// re-check the cache before writing so a race winner's entry is not
+	// needlessly overwritten with a stale result.
 	jwt, expiresIn, err := c.fetchJWT(ctx, apiToken)
 	if err != nil {
 		return "", err
@@ -84,6 +94,11 @@ func (c *Client) getJWTToken(ctx context.Context) (string, error) {
 	}
 
 	c.mu.Lock()
+	// Re-check: another goroutine may have already populated the cache.
+	if existing, ok := c.jwtCache[apiToken]; ok && time.Now().Before(existing.expiresAt) {
+		c.mu.Unlock()
+		return existing.jwt, nil
+	}
 	c.jwtCache[apiToken] = jwtEntry{jwt: jwt, expiresAt: expiresAt}
 	c.mu.Unlock()
 
@@ -2662,8 +2677,11 @@ func (c *Client) RemoveTestCaseMembers(ctx context.Context, testCaseID int64, me
 	return nil
 }
 
+// GetTestCaseExternalLinks returns the external URL links attached to a test case.
+// The spec exposes these only via GET /api/testcase/{id}/overview (field "links").
+// The /relation endpoint returns test-case-to-test-case relations (different schema).
 func (c *Client) GetTestCaseExternalLinks(ctx context.Context, testCaseID int64) ([]ExternalLinkDto, error) {
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodGet, c.url(fmt.Sprintf("/api/testcase/%d/relation", testCaseID)), nil)
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodGet, c.url(fmt.Sprintf("/api/testcase/%d/overview", testCaseID)), nil)
 	if err != nil {
 		return nil, fmt.Errorf("create request: %w", err)
 	}
@@ -2682,62 +2700,53 @@ func (c *Client) GetTestCaseExternalLinks(ctx context.Context, testCaseID int64)
 		return nil, errFromResponse(resp)
 	}
 
-	var result []ExternalLinkDto
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+	// Decode only the "links" field to avoid pulling the full overview into memory.
+	var overview struct {
+		Links []ExternalLinkDto `json:"links"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&overview); err != nil {
 		return nil, fmt.Errorf("decode response: %w", err)
 	}
 
-	return result, nil
+	return overview.Links, nil
 }
 
+// AddTestCaseExternalLink appends an external URL link to a test case.
+// The spec provides no per-item POST endpoint; the only way to mutate links is
+// PATCH /api/testcase/{id} with the complete desired "links" array (replace-all).
+// We therefore fetch the current links first and patch with the appended list.
 func (c *Client) AddTestCaseExternalLink(ctx context.Context, testCaseID int64, link ExternalLinkDto) error {
-	body, err := json.Marshal(link)
-	if err != nil {
-		return fmt.Errorf("marshal request: %w", err)
-	}
-
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, c.url(fmt.Sprintf("/api/testcase/%d/relation", testCaseID)), bytes.NewBuffer(body))
-	if err != nil {
-		return fmt.Errorf("create request: %w", err)
-	}
-	if err := c.setAuthHeader(ctx, httpReq); err != nil {
-		return fmt.Errorf("set auth: %w", err)
-	}
-	httpReq.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.httpClient.Do(httpReq)
+	current, err := c.GetTestCaseExternalLinks(ctx, testCaseID)
 	if err != nil {
-		return fmt.Errorf("http request: %w", err)
+		return fmt.Errorf("get current links: %w", err)
 	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusCreated {
-		return errFromResponse(resp)
-	}
-
-	return nil
+	updated := append(current, link)
+	return c.UpdateTestCase(ctx, testCaseID, UpdateTestCaseRequest{Links: updated})
 }
 
-func (c *Client) DeleteTestCaseExternalLink(ctx context.Context, testCaseID int64, relationID int64) error {
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodDelete, c.url(fmt.Sprintf("/api/testcase/%d/relation/%d", testCaseID, relationID)), nil)
+// DeleteTestCaseExternalLink removes the external link with the given URL from a test case.
+// The spec has no DELETE endpoint for external links; removal is achieved by fetching
+// the current list and PATCHing with the matching entry omitted.
+func (c *Client) DeleteTestCaseExternalLink(ctx context.Context, testCaseID int64, linkURL string) error {
+	current, err := c.GetTestCaseExternalLinks(ctx, testCaseID)
 	if err != nil {
-		return fmt.Errorf("create request: %w", err)
-	}
-	if err := c.setAuthHeader(ctx, httpReq); err != nil {
-		return fmt.Errorf("set auth: %w", err)
+		return fmt.Errorf("get current links: %w", err)
 	}
 
-	resp, err := c.httpClient.Do(httpReq)
-	if err != nil {
-		return fmt.Errorf("http request: %w", err)
+	remaining := make([]ExternalLinkDto, 0, len(current))
+	found := false
+	for _, l := range current {
+		if l.URL == linkURL {
+			found = true
+			continue
+		}
+		remaining = append(remaining, l)
 	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
-		return errFromResponse(resp)
+	if !found {
+		return fmt.Errorf("external link not found: %s", linkURL)
 	}
 
-	return nil
+	return c.UpdateTestCase(ctx, testCaseID, UpdateTestCaseRequest{Links: remaining})
 }
 
 func (c *Client) RestoreTestCase(ctx context.Context, testCaseID int64) error {

internal/core/logger.go

@@ -90,6 +90,10 @@ func (l *Logger) Error(message string, err error, data any) {
 }
 
 func (l *Logger) log(level Level, message string, data any) {
+	// Read l.level under the mutex to avoid a data race if SetLevel is ever
+	// called concurrently (and to keep the level check + write atomic).
+	l.mu.Lock()
+	defer l.mu.Unlock()
 	if level < l.level {
 		return
 	}
@@ -99,10 +103,7 @@ func (l *Logger) log(level Level, message string, data any) {
 		Message:   message,
 		Data:      data,
 	}
-
 	bytes, err := json.Marshal(entry)
-	l.mu.Lock()
-	defer l.mu.Unlock()
 	if err != nil {
 		fmt.Fprintf(os.Stderr, `{"timestamp":%q,"level":%q,"message":%q,"error":"log marshal failed: %s"}`+"\n",
 			entry.Timestamp, entry.Level, entry.Message, err.Error())

internal/mcp/protocol.go

@@ -46,7 +46,8 @@ type InitializeRequest struct {
 type InitializeResponse struct {
 	ProtocolVersion string `json:"protocolVersion"`
 	Capabilities    struct {
-		Tools struct{} `json:"tools"`
+		Tools     struct{} `json:"tools"`
+		Resources struct{} `json:"resources"`
 	} `json:"capabilities"`
 	ServerInfo struct {
 		Name    string `json:"name"`
@@ -55,15 +56,42 @@ type InitializeResponse struct {
 }
 
 type Tool struct {
-	Name        string `json:"name"`
-	Description string `json:"description"`
-	InputSchema any    `json:"inputSchema"`
+	Name        string         `json:"name"`
+	Description string         `json:"description"`
+	InputSchema any            `json:"inputSchema"`
+	Annotations map[string]any `json:"annotations,omitempty"`
+	Meta        map[string]any `json:"_meta,omitempty"`
 }
 
 type ToolsListResponse struct {
 	Tools []Tool `json:"tools"`
 }
 
+// Resource represents an MCP resource entry (e.g. a widget HTML page).
+type MCPResource struct {
+	URI      string `json:"uri"`
+	Name     string `json:"name"`
+	MimeType string `json:"mimeType,omitempty"`
+}
+
+type ResourcesListResponse struct {
+	Resources []MCPResource `json:"resources"`
+}
+
+type ResourcesReadRequest struct {
+	URI string `json:"uri"`
+}
+
+type ResourceContent struct {
+	URI      string `json:"uri"`
+	MimeType string `json:"mimeType,omitempty"`
+	Text     string `json:"text"`
+}
+
+type ResourcesReadResponse struct {
+	Contents []ResourceContent `json:"contents"`
+}
+
 type ToolCallRequest struct {
 	Name      string          `json:"name"`
 	Arguments json.RawMessage `json:"arguments"`