Add hello/self tool (v0)

[jstjoe]

Summary

• Adds a simple hello MCP tool that acts as a health/self endpoint
• Returns server name, version, the vault ID the connection is using, anonymous-mode flag, an ISO timestamp, and a greeting (optionally personalized via a name arg)
• No UI app in this v0 — registered with the standard SDK registerTool so it's text/structured-content only

Implementation notes

• Handler: src/lib/tools/hello.ts — pure function following the existing ToolResult<T> pattern, no Skyflow API calls
• Wired in src/server.ts; extracted SERVER_NAME / SERVER_VERSION constants and added a getCurrentVaultId() helper alongside the existing getCurrentSkyflow() / isAnonymousMode() accessors
• Works in both authenticated and anonymous modes (no credential requirements beyond what the /mcp endpoint already enforces)

Test plan

• pnpm test — 171 tests pass, including 5 new handleHello cases (default greeting, personalized, whitespace-only name, metadata echo, ISO timestamp)
• pnpm build:server — clean tsc build
• Manually invoke hello via MCP Inspector to confirm structured output renders in a host

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sky-mcp-streamable	Ready	Preview, Comment	May 26, 2026 3:54pm

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[claude]

Code Review

Nice, tight v0. Handler is a pure function, follows the existing ToolResult<T> pattern, and the tests cover the meaningful branches. A few notes, mostly minor:

Bugs / correctness

• getCurrentVaultId() throws outside a request context. Same pattern as the existing accessors, so it's consistent — just worth flagging that any future code path that registers/inspects the tool outside of requestContextStorage.run(...) will hit the throw. Not an issue today.
• No behavioral handling of anonymous mode in the tool itself. That's fine for a "self" endpoint — but in anonymous mode vaultId will be the demo vault ID (ANON_MODE_VAULT_ID). Worth confirming that's intentional and that you're OK exposing it to anonymous callers (the demo vault is already shared, so probably fine, just calling it out).

Conventions / style (per CLAUDE.md)

• CLAUDE.md is now out of date. The "Modifying Tools → When adding a new tool" checklist explicitly calls out updating CLAUDE.md, and the file currently says "Registers two active tools: de-identify and re-identify" plus the Tool Implementations and Anonymous Mode table sections — all of which now need a hello entry. Worth doing in this PR rather than letting it drift.
• server.registerTool vs registerAppTool. CLAUDE.md states "Each tool is registered via registerAppTool from @modelcontextprotocol/ext-apps/server". Using the bare SDK registerTool here is reasonable since there's no UI, but it's a divergence — either update CLAUDE.md to note that tools without a UI use registerTool, or use registerAppTool without a _meta.ui.resourceUri for consistency (depending on whether ext-apps tolerates the missing UI gracefully).
• outputSchema field descriptions. de-identify / re-identify give nearly every output field a .describe(...). The hello output schema only describes timestamp. Adding short descriptions to the other fields would be more consistent and helps clients/UIs that surface schema docs.

Duplication / drift risk

• SERVER_VERSION = \"0.4.0\" duplicates package.json. If you bump the package version you'll silently lie about the server version here. Consider reading it from package.json (e.g. import pkg from \"../package.json\" with { type: \"json\" }) so they can't diverge. Not blocking, but cheap to fix while the constant is fresh.

Tests

• Good coverage of the four interesting cases (default greeting, personalized, blank-name fallback, metadata echo, ISO format).
• One small gap: no assertion that the default anonymousMode: false from baseContext is echoed back unchanged — every test either accepts the default implicitly or overrides it to true. A one-liner expect(result.output.anonymousMode).toBe(false) in the default-greeting test would lock that in.
• Optional polish: assert the timestamp is within a few seconds of Date.now() so a future bug that hard-codes a date wouldn't sneak through the current regex check.

Security

• Nothing new. No credential handling, no Skyflow API calls, no untrusted input rendered as HTML. name is reflected into a JSON string, which is safe in this transport.

Overall: ship-ready once CLAUDE.md is updated to reflect the third tool and the registerTool (non-app) variant. Everything else is nice-to-have.