test(mongodb-mcp-remote): add cloud-dev e2e test skeleton + CI wiring (MCP-538)

Stack the real cloud-dev e2e tier on the unit/integration setup:

- wrapper.e2e.test.ts: runs in the normal suite but self-skips via describe.skipIf
  unless MDB_MCP_REMOTE_E2E_CLIENT_ID is set (and on SKIP_REMOTE_MCP_E2E=true).
  Bodies are it.todo for MCP-539 against the real wrapper (MCP-536).
- code-health.yml run-tests: inject MDB_MCP_REMOTE_E2E_* from dedicated
  TEST_REMOTE_MCP_* secrets/var (kept separate from MDB_MCP_API_* so cloud-dev
  creds don't leak into other tests). Until the secrets exist, e2e self-skips.
- scripts/path-b-smoke-test.sh: one-time provisioning of the ingress credentials
  via the group-level mcpConfig flow.
- Document e2e testing, provisioning, and secret rotation in CONTRIBUTING.md.

Author: maastha

.github/workflows/code-health.yml

@@ -49,6 +49,9 @@ jobs:
           SKIP_ATLAS_LOCAL_TESTS: "true"
           MDB_MONGOT_PASSWORD: ${{ secrets.TEST_MDB_MONGOT_PASSWORD }}
           MDB_VOYAGE_API_KEY: ${{ secrets.TEST_MDB_MCP_VOYAGE_API_KEY }}
+          MDB_MCP_REMOTE_E2E_CLIENT_ID: ${{ secrets.TEST_REMOTE_MCP_CLIENT_ID }}
+          MDB_MCP_REMOTE_E2E_CLIENT_SECRET: ${{ secrets.TEST_REMOTE_MCP_CLIENT_SECRET }}
+          MDB_MCP_REMOTE_E2E_BASE_URL: ${{ vars.TEST_REMOTE_MCP_BASE_URL }}
       - name: Upload test results
         if: always() && matrix.os == 'ubuntu-latest' && matrix.node-version == '22'
         uses: actions/upload-artifact@v7.0.1

CONTRIBUTING.md

@@ -88,6 +88,11 @@ pnpm --filter mongodb-mcp-remote test
 - **Unit** tests mock the network, so they need no external setup.
 - **Integration** tests spawn the built wrapper (`dist/cli.js`) over stdio and drive it
   against an in-process mock remote MCP server (`src/testHelpers/mockRemote.ts`), so they run deterministically.
+- **End-to-end** tests (`src/wrapper.e2e.test.ts`) hit the real cloud-dev Remote MCP server.
+  They run in the normal `pnpm test` but are skipped unless `MDB_MCP_REMOTE_E2E_CLIENT_ID`
+  is set, and skip when `SKIP_REMOTE_MCP_E2E=true`.
+  In CI the `run-tests` job injects `MDB_MCP_REMOTE_E2E_*` from the `TEST_REMOTE_MCP_*`
+  GitHub secrets/var; until those are registered the e2e tests self-skip and CI stays green.
 
 #### Accuracy Tests and colima
 

packages/mongodb-mcp-remote/src/wrapper.e2e.test.ts

@@ -0,0 +1,23 @@
+import { describe, it } from "vitest";
+
+/**
+ * These run in the default test flow but are skipped unless real ingress
+ * service-account credentials are present, so runs without secrets are not impacted.
+ *
+ * Skip when:
+ *   - SKIP_REMOTE_MCP_E2E=true, or
+ *   - no MDB_MCP_REMOTE_E2E_CLIENT_ID is set
+ * TODO: The tests below will be implemented in by MCP-539 once wrapper is code complete (MCP-536).
+ */
+const skipE2E = process.env.SKIP_REMOTE_MCP_E2E === "true" || !process.env.MDB_MCP_REMOTE_E2E_CLIENT_ID;
+
+describe.skipIf(skipE2E)("mongodb-mcp-remote wrapper (e2e, cloud-dev)", () => {
+    it.todo("acquires a token from the configured Atlas endpoint and lists tools");
+    // Spawn the built wrapper against MDB_MCP_API_* (cloud-dev ingress creds), then:
+    //   const res = await client.listTools();
+    //   expect(res.tools.length).toBeGreaterThan(0);
+
+    it.todo("invokes a read-only tool end-to-end against cloud-dev");
+
+    it.todo("surfaces a clear auth error when the ingress credentials are invalid");
+});