supabase / mcp / 33731279743

96%

Build Type

push

github

Committed by web-flow

Commit Message

feat(mcp): add branch cost confirmation elicitation (#394)

Stacked on [#391](https://github.com/supabase/mcp/pull/391). Review that
first. This is part of
[AI-1091](https://linear.app/supabase/issue/AI-1091/ship-form-mode-cost-confirmation-stage-a-supabasemcp).

## What kind of change does this PR introduce?

Feature: add form-mode cost confirmation to `create_branch`.

## What is the current behavior?

#391 provides the shared confirmation codec/verifier, `ServerContext`,
result passthrough, and project flow. Branch creation still uses the
existing hash validation.

## What is the new behavior?

Modern form clients can call `create_branch` without `confirm_cost_id`.
They receive an action-only, property-less prompt for **$0.01344/hr**
(about **$9.68 over 30 days**).

Acceptance creates the branch from signed arguments. Missing responses
and changed costs re-prompt. A wrong-tool state or changed arguments
fail. Decline and cancel create no branch.

Capability-free and URL-only clients keep hash validation. A supplied
legacy ID cannot bypass the capable-client flow. Project-scoped
injection works, and existing output fields such as `with_data` remain.

## How to Review

1. **Server and shared state**
   - `packages/mcp-server-supabase/src/server.ts`
   - `packages/mcp-server-supabase/src/tools/cost-confirmation.ts`

2. **Branch handler and pricing**
   - `packages/mcp-server-supabase/src/tools/branching-tools.ts`
   - `packages/mcp-server-supabase/src/pricing.ts`

3. **Behavioral coverage**
   - `packages/mcp-server-supabase/src/server.test.ts`
- Inspect the capable, legacy, argument-binding, and project-scoped
paths.

- [ ] Is `create_branch` enabled only through the intended server path?
- [ ] Does the discriminated state bind project ID, branch name, and
`BranchCost`?
- [ ] Do capable clients always use elicitation, even with a legacy ID?
- [ ] Do accept, decline, cancellation, wrong-tool, and argument-change
outcomes look correct?

## Verification... (continued)

Coverage Stats

439 of 473 branches covered (92.81%)

Branch coverage included in aggregate %.

126 of 128 new or added lines in 3 files covered. (98.44%)

21 existing lines in 1 file now uncovered.

3273 of 3375 relevant lines covered (96.98%)

58.32 hits per line