stacklok / toolhive / 19064108888

push

github

vMCP: Implement composite tools workflow engine (#2439)

* Implement vMCP composite tools workflow engine

Implements stacklok/stacklok-epics#149 - Phase 2 basic workflow engine
for Virtual MCP Server that orchestrates multi-step operations across
multiple backend MCP servers.

Core Features:
- Sequential workflow execution with dependency tracking
- Template expansion using Go text/template for dynamic arguments
- Support for .params.* and .steps.*.output variable references
- Router integration for tool calls to backend servers
- Comprehensive error handling (abort/continue/retry strategies)
- Conditional execution support
- Retry logic with exponential backoff
- Timeout management at workflow and step levels

Security Hardening:
- Template expansion depth limit (100 levels)
- Template output size limit (10 MB)
- Maximum workflow steps limit (100 steps)
- Retry count capping (10 retries max)
- Safe template function set (json, quote only)
- Thread-safe context management
- Circular dependency detection
- No sensitive data in error messages

Test coverage: 85.9% with compact, elegant test helpers and
comprehensive security tests for DoS protection and injection attempts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add `te` to codespell's ignorefile

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

* Improve workflow engine retry logic and documentation

Address review feedback by:

1. Clarify Clone() documentation: Update docstring to accurately
   describe that it performs a shallow copy of maps, not a deep copy.
   This is sufficient for the current use case (testing/validation).

2. Replace manual exponential backoff with backoff library: Refactor
   retry logic to use github.com/cenkalti/backoff/v5, which is already
   used elsewhere in the codebase. This provides:
   - Standard exponential backoff algorithm
   - Built-in max interval capping (60x initial delay)
   - Con... (continued)

502 of 600 new or added lines in 4 files covered. (83.67%)

21756 of 45131 relevant lines covered (48.21%)

37.48 hits per line