MCP-198 Immediately start up the MCP and dynamically load some tools

[nquinquenel]

No description provided.

[hashicorp-vault-sonar-prod]

MCP-198

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
3 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
85.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[damien-urruty-sonarsource]

I think this should work but it brings a lot of complexity:

• The SonarQubeMcpServer is now pretty long and the code is hard to follow between what can be initialized at startup and what is initialized later
• We rely on the good will of MCP clients to call listTools when we notify them of a change, which should work, but I find the approach a bit complex

The real source of the complexity is the download of analyzers, that currently delays initialization of the backend. Those analyzers are used only in the context of the analysis tool but somehow delay all other tools too. I think we could come up with a simpler alternative:

• at startup initialize the backend without analyzers
• trigger the download of analyzers in the background
• restart the backend when analyzers are downloaded

This way we can still initialize most services, register telemetry, and move the wait for the initialization to only the Analysis tool, which reduces the friction for all other tools. There might be some state to keep and re-transmit after a restart, e.g. the automatic analysis. Some telemetry notification can be called only at first startup and not at consecutive restart. Devil is in the details, so I maybe miss something, otherwise I think it would make the code simpler and limit the impact of the analyzers download.

I still approved the PR in case you want to move ahead with this approach. Even if complex, it should work

[lobaorn-bitso]

Hi @nquinquenel @damien-urruty-sonarsource sorry for using this approach, but two things:

I tried to build locally as per the README, but got 401 from your internal jfrog repo. So I guess it does not work to build locally?

And with that, I am really interested in the READ_ONLY and TOOLSETS features, and also this one but those two even more. Is there a new release coming soon? I would appreciate since I can get from the release jars so not to wait until the new docker is published, since I can not build from a commit hash...

[nquinquenel]

Hi @nquinquenel @damien-urruty-sonarsource sorry for using this approach, but two things:

I tried to build locally as per the README, but got 401 from your internal jfrog repo. So I guess it does not work to build locally?

Building from a release tag should work, as all the dependencies should be available on Maven central. However, this branch has a modification of our SLCORE dependency, which has not been released yet, meaning it's only available internally and you need to authenticate to our private JFrog repo.

And with that, I am really interested in the READ_ONLY and TOOLSETS features, and also this one but those two even more. Is there a new release coming soon? I would appreciate since I can get from the release jars so not to wait until the new docker is published, since I can not build from a commit hash...

We will try to release in the coming days, and you will be able to use the Jar immediately. As for the docker image, it's not 100% under our control so there's usually a small delay before it gets updated.