Add MCP test coverage: ToolSchema, ResourceProvider, McpAuth, AuthContext, PolicyEngine

New test files:
- MCP.ToolSchemaTest — tool list structure, skill/workflow prefixes, Peri types
- MCP.ResourceProviderTest — all 6 URI templates: list, get, search, not_found, invalid_id
- McpAuthTest — valid/invalid/missing Bearer token, unconfigured key

Updated tests:
- AuthContextTest — build_mcp/2 for MCP caller type
- PolicyEngineTest — MCP caller evaluation path
- HealthControllerTest — assert mcp status field
- MetricsControllerTest — assert mcp section with status and tools_registered

855 tests, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: thatsme

test/alex_claw/auth/auth_context_test.exs

@@ -33,4 +33,22 @@ defmodule AlexClaw.Auth.AuthContextTest do
       end
     end
   end
+
+  describe "build_mcp/2" do
+    test "builds context for MCP tool invocation" do
+      ctx = AuthContext.build_mcp("skill:web_search", :execute)
+      assert ctx.caller == "mcp:skill:web_search"
+      assert ctx.caller_type == :mcp
+      assert ctx.permission == :execute
+      assert ctx.tool_name == "skill:web_search"
+      assert ctx.chain_depth == 0
+      assert ctx.token == nil
+      assert %DateTime{} = ctx.timestamp
+    end
+
+    test "sets tool_name field" do
+      ctx = AuthContext.build_mcp("workflow:Tech News Digest", :execute)
+      assert ctx.tool_name == "workflow:Tech News Digest"
+    end
+  end
 end

test/alex_claw/auth/policy_engine_test.exs

@@ -67,4 +67,29 @@ defmodule AlexClaw.Auth.PolicyEngineTest do
       assert {:deny, _reason} = PolicyEngine.evaluate(ctx, nil)
     end
   end
+
+  describe "MCP caller type" do
+    test "MCP calls are allowed when no mcp_restriction policies exist" do
+      ctx = build_mcp_context("skill:system_info")
+      assert :allow == PolicyEngine.evaluate(ctx, [])
+    end
+
+    test "MCP calls bypass chain depth and token checks" do
+      ctx = build_mcp_context("skill:research")
+      # MCP path doesn't check chain_depth or token, only policies
+      assert :allow == PolicyEngine.evaluate(ctx, [])
+    end
+  end
+
+  defp build_mcp_context(tool_name) do
+    %AuthContext{
+      caller: "mcp:#{tool_name}",
+      caller_type: :mcp,
+      permission: :execute,
+      tool_name: tool_name,
+      chain_depth: 0,
+      timestamp: DateTime.utc_now(),
+      token: nil
+    }
+  end
 end

test/alex_claw/mcp/resource_provider_test.exs

@@ -0,0 +1,243 @@
+defmodule AlexClaw.MCP.ResourceProviderTest do
+  use AlexClaw.DataCase, async: false
+
+  alias AlexClaw.MCP.ResourceProvider
+  alias Anubis.Server.{Frame, Response}
+
+  defp new_frame, do: Frame.new()
+
+  describe "register_templates/1" do
+    test "registers all 6 resource templates" do
+      frame = ResourceProvider.register_templates(new_frame())
+
+      assert map_size(frame.resource_templates) == 6
+
+      names = Map.keys(frame.resource_templates)
+      assert "resources" in names
+      assert "knowledge" in names
+      assert "memory" in names
+      assert "workflows" in names
+      assert "runs" in names
+      assert "config" in names
+    end
+  end
+
+  describe "read alexclaw://resources/" do
+    test "list returns all resources" do
+      AlexClaw.Resources.create_resource(%{
+        name: "Test Feed",
+        type: "rss_feed",
+        url: "https://example.com/feed.xml",
+        tags: ["test"]
+      })
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://resources/list", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+      assert Enum.any?(data, &(&1["name"] == "Test Feed"))
+    end
+
+    test "get by ID returns specific resource" do
+      {:ok, resource} =
+        AlexClaw.Resources.create_resource(%{
+          name: "Get Test",
+          type: "website",
+          url: "https://example.com"
+        })
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://resources/#{resource.id}", new_frame())
+
+      data = decode_response(resp)
+      assert data["id"] == resource.id
+      assert data["name"] == "Get Test"
+    end
+
+    test "returns error for non-existent resource" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("alexclaw://resources/999999", new_frame())
+    end
+
+    test "returns error for invalid ID" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("alexclaw://resources/abc", new_frame())
+    end
+  end
+
+  describe "read alexclaw://knowledge/" do
+    test "list returns recent knowledge entries" do
+      AlexClaw.Knowledge.store(:documentation, "Test knowledge content",
+        source: "test://knowledge-test"
+      )
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://knowledge/list", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+      assert Enum.any?(data, &(&1["content"] == "Test knowledge content"))
+    end
+
+    test "search returns matching entries" do
+      AlexClaw.Knowledge.store(:documentation, "Elixir GenServer patterns",
+        source: "test://knowledge-search"
+      )
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://knowledge/search:GenServer", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+    end
+
+    test "returns error for non-existent entry" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("alexclaw://knowledge/999999", new_frame())
+    end
+  end
+
+  describe "read alexclaw://memory/" do
+    test "list returns recent memory entries" do
+      AlexClaw.Memory.store(:fact, "Test memory fact", source: "test://memory-test")
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://memory/list", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+      assert Enum.any?(data, &(&1["content"] == "Test memory fact"))
+    end
+
+    test "search returns matching entries" do
+      AlexClaw.Memory.store(:fact, "BEAM concurrency model", source: "test://memory-search")
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://memory/search:BEAM", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+    end
+
+    test "returns error for non-existent entry" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("alexclaw://memory/999999", new_frame())
+    end
+  end
+
+  describe "read alexclaw://workflows/" do
+    test "list returns all workflows" do
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://workflows/list", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+
+      for wf <- data do
+        assert Map.has_key?(wf, "id")
+        assert Map.has_key?(wf, "name")
+        assert Map.has_key?(wf, "enabled")
+      end
+    end
+
+    test "get by ID returns workflow with steps" do
+      workflows = AlexClaw.Workflows.list_workflows()
+
+      if length(workflows) > 0 do
+        wf = hd(workflows)
+
+        {:reply, %Response{} = resp, _frame} =
+          ResourceProvider.read("alexclaw://workflows/#{wf.id}", new_frame())
+
+        data = decode_response(resp)
+        assert data["id"] == wf.id
+        assert Map.has_key?(data, "steps")
+        assert is_list(data["steps"])
+      end
+    end
+
+    test "returns error for non-existent workflow" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("alexclaw://workflows/999999", new_frame())
+    end
+  end
+
+  describe "read alexclaw://runs/" do
+    test "list returns recent runs" do
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://runs/list", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+    end
+
+    test "returns error for non-existent run" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("alexclaw://runs/999999", new_frame())
+    end
+  end
+
+  describe "read alexclaw://config/" do
+    test "list returns all settings" do
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://config/list", new_frame())
+
+      data = decode_response(resp)
+      assert is_list(data)
+
+      for setting <- data do
+        assert Map.has_key?(setting, "key")
+        assert Map.has_key?(setting, "value")
+      end
+    end
+
+    test "sensitive values are redacted" do
+      AlexClaw.Config.set("test.secret", "super_secret",
+        type: "string",
+        category: "test",
+        sensitive: true
+      )
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://config/list", new_frame())
+
+      data = decode_response(resp)
+      secret = Enum.find(data, &(&1["key"] == "test.secret"))
+
+      if secret do
+        assert secret["value"] == "[REDACTED]"
+      end
+    end
+
+    test "get by key returns specific setting" do
+      AlexClaw.Config.set("test.mcp.key", "test_value", type: "string", category: "test")
+
+      {:reply, %Response{} = resp, _frame} =
+        ResourceProvider.read("alexclaw://config/test.mcp.key", new_frame())
+
+      data = decode_response(resp)
+      assert data["key"] == "test.mcp.key"
+      assert data["value"] == "test_value"
+    end
+
+    test "returns error for non-existent key" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("alexclaw://config/nonexistent.key.xyz", new_frame())
+    end
+  end
+
+  describe "unknown URI" do
+    test "returns error for unrecognized scheme" do
+      {:error, _error, _frame} =
+        ResourceProvider.read("unknown://something/123", new_frame())
+    end
+  end
+
+  defp decode_response(%Response{} = resp) do
+    # Response stores content as list of maps with "type" => "text", "text" => json_string
+    # For resource responses, content is stored in `contents` field
+    text = resp.contents["text"]
+    Jason.decode!(text)
+  end
+end

test/alex_claw/mcp/tool_schema_test.exs

@@ -0,0 +1,91 @@
+defmodule AlexClaw.MCP.ToolSchemaTest do
+  use AlexClaw.DataCase, async: false
+
+  alias AlexClaw.MCP.ToolSchema
+
+  describe "all_tools/0" do
+    test "returns a list of tool definitions" do
+      tools = ToolSchema.all_tools()
+      assert is_list(tools)
+      assert length(tools) > 0
+    end
+
+    test "each tool has name, description, and input_schema" do
+      for tool <- ToolSchema.all_tools() do
+        assert is_binary(tool.name), "tool name should be binary, got: #{inspect(tool.name)}"
+        assert is_binary(tool.description), "tool description should be binary for #{tool.name}"
+        assert is_map(tool.input_schema), "tool input_schema should be map for #{tool.name}"
+      end
+    end
+
+    test "skill tools are prefixed with skill:" do
+      skills = ToolSchema.skill_tools()
+
+      for tool <- skills do
+        assert String.starts_with?(tool.name, "skill:"),
+               "expected skill: prefix, got: #{tool.name}"
+      end
+    end
+
+    test "workflow tools are prefixed with workflow:" do
+      workflows = ToolSchema.workflow_tools()
+
+      for tool <- workflows do
+        assert String.starts_with?(tool.name, "workflow:"),
+               "expected workflow: prefix, got: #{tool.name}"
+      end
+    end
+  end
+
+  describe "skill_tools/0" do
+    test "includes core skills from registry" do
+      tools = ToolSchema.skill_tools()
+      names = Enum.map(tools, & &1.name)
+
+      # At minimum, these core skills should exist
+      assert "skill:web_search" in names
+      assert "skill:telegram_notify" in names
+    end
+
+    test "input_schema uses Peri-compatible types" do
+      tools = ToolSchema.skill_tools()
+
+      for tool <- tools do
+        schema = tool.input_schema
+
+        for {key, value} <- schema do
+          assert is_binary(key), "schema key should be string for #{tool.name}"
+
+          assert valid_peri_type?(value),
+                 "invalid Peri type for #{tool.name}.#{key}: #{inspect(value)}"
+        end
+      end
+    end
+  end
+
+  describe "workflow_tools/0" do
+    test "returns only enabled workflows" do
+      workflows = ToolSchema.workflow_tools()
+
+      for tool <- workflows do
+        name = String.replace_leading(tool.name, "workflow:", "")
+        wf = Enum.find(AlexClaw.Workflows.list_workflows(), &(&1.name == name))
+        assert wf == nil or wf.enabled, "disabled workflow should not be in tool list: #{name}"
+      end
+    end
+
+    test "workflow tools have input field in schema" do
+      for tool <- ToolSchema.workflow_tools() do
+        assert Map.has_key?(tool.input_schema, "input"),
+               "workflow tool #{tool.name} should have input field"
+      end
+    end
+  end
+
+  # Validates that a value is a valid Peri schema type
+  defp valid_peri_type?(type) when is_atom(type), do: true
+  defp valid_peri_type?({atom, _}) when is_atom(atom), do: true
+  defp valid_peri_type?({atom, _, _}) when is_atom(atom), do: true
+  defp valid_peri_type?(map) when is_map(map), do: true
+  defp valid_peri_type?(_), do: false
+end