src/mcp_agent/cli/cloud/commands/auth/whoami/main.py (1)

47-53: Make token expiry timezone-safe (optional).

If token_expires_at may be naive or non-UTC, label “UTC” only after converting: expiry = token_expires_at.astimezone(timezone.utc); then format. Add from datetime import timezone.

src/mcp_agent/cli/cloud/commands/auth/login/main.py (1)

84-86: Prefer “No” as default when already logged in (safer UX).

Reduces accidental re-login.

-        if not Confirm.ask("You are already logged in. Do you want to login again?"):
+        if not Confirm.ask(
+            "You are already logged in. Do you want to login again?",
+            default=False,
+        ):

src/mcp_agent/cli/cloud/commands/auth/logout/main.py (1)

10-36: Optional: support non-interactive logout with --yes/-y.
For CI/scripts, add a flag to skip the prompt. This also justifies keeping the typer import.

- def logout() -> None:
+ def logout(
+     yes: bool = typer.Option(False, "--yes", "-y", help="Do not prompt for confirmation"),
+ ) -> None:
@@
-    if not Confirm.ask(f"Are you sure you want to logout {user_info}?"):
+    if not yes and not Confirm.ask(f"Are you sure you want to logout {user_info}?", default=False):
         print_info("Logout cancelled.")
         return

And re-introduce the import at the top if you take this route:

+import typer

src/mcp_agent/cli/cloud/main.py (1)

137-175: CLI grouping and aliases are well-structured.
Nested cloud auth with root-level aliases is ergonomic and backwards-compatible.

Consider de-duplicating the multi-line login help string (lines 153-155 and 169-171) into a constant to avoid drift, and capitalize “API keys”.

-Direct to the api keys page for obtaining credentials, routing through login.
+Direct to the API keys page for obtaining credentials, routing through login.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

src/mcp_agent/cli/auth/main.py (1)

21-25: Fix double-open race and permission leak; write atomically with 0600.

Current code creates the file with default perms, then reopens it, leaving a window where credentials may be world-readable and risking incorrect final mode. Replace with atomic write to a 0600 temp file + os.replace.

Apply:

-    # Create file with restricted permissions (0600) to prevent leakage
-    with open(credentials_path, "w", encoding="utf-8") as f:
-        fd = os.open(credentials_path, os.O_WRONLY | os.O_CREAT, 0o600)
-        with os.fdopen(fd, "w") as f:
-            f.write(credentials.to_json())
+    # Atomic write with restricted permissions (0600)
+    cred_dir = os.path.dirname(credentials_path)
+    fd, tmp_path = tempfile.mkstemp(prefix="credentials.", dir=cred_dir, text=True)
+    try:
+        try:
+            os.fchmod(fd, 0o600)  # posix
+        except AttributeError:
+            os.chmod(tmp_path, 0o600)  # windows fallback
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(credentials.to_json())
+            f.flush()
+            try:
+                os.fsync(f.fileno())
+            except (AttributeError, OSError):
+                pass
+        if os.path.islink(credentials_path):
+            raise RuntimeError("Refusing to overwrite symlink at credentials path")
+        os.replace(tmp_path, credentials_path)
+    finally:
+        try:
+            os.unlink(tmp_path)
+        except FileNotFoundError:
+            pass

src/mcp_agent/cli/auth/__init__.py (1)

6-12: Restore legacy export to keep backward compatibility (and prevent import errors).

save_api_key_credentials was removed from exports, but the PR claims BC. Provide a thin wrapper and re-export it.

Apply:

 from .main import (
     clear_credentials,
     load_api_key_credentials,
     load_credentials,
     save_credentials,
 )
 from .models import UserCredentials

+def save_api_key_credentials(api_key: str) -> None:
+    """Backward-compat wrapper; prefer save_credentials(UserCredentials(...))."""
+    save_credentials(UserCredentials(api_key=api_key))
 
 __all__ = [
     "clear_credentials",
     "load_api_key_credentials",
     "load_credentials",
     "save_credentials",
+    "save_api_key_credentials",
     "UserCredentials",
 ]

Run to confirm any legacy imports are now satisfied:

#!/bin/bash
rg -nP '\bsave_api_key_credentials\b' -C2

Also applies to: 14-20

src/mcp_agent/cli/cloud/commands/auth/login/main.py (1)

132-147: Mask API key input and avoid returning secrets from manual prompt.

Hide input and normalize whitespace; do not return the key.

Apply:

-def _handle_manual_key_input() -> str:
+def _handle_manual_key_input() -> None:
     """Handle manual API key input.
 
-    Returns:
-        API key string
+    Returns:
+        None
     """
-    input_api_key = Prompt.ask("Please enter your API key :key:")
+    input_api_key = Prompt.ask("Please enter your API key :key:", password=True)
+    if input_api_key is not None:
+        input_api_key = input_api_key.strip()
 
     if not input_api_key:
         print_warning("No API key provided.")
         raise CLIError("Failed to set valid API key")
 
     if not _is_valid_api_key(input_api_key):
         print_warning("Invalid API key provided.")
         raise CLIError("Failed to set valid API key")
 
     credentials = _load_user_credentials(input_api_key)
 
     save_credentials(credentials)
     print_success("API key set.")
     if credentials.username:
         print_info(f"Logged in as: {credentials.username}")
 
-    return input_api_key
+    return None

Also applies to: 150-156

src/mcp_agent/cli/auth/main.py (2)

1-6: Imports required for secure atomic writes and path resolution.

Add tempfile and updated constants.

Apply:

-import json
+import json
 import os
 from typing import Optional
@@
-from .constants import DEFAULT_CREDENTIALS_PATH
+import tempfile
+from .constants import DEFAULT_CREDENTIALS_PATH, DEFAULT_CREDENTIALS_ENV, LEGACY_CREDENTIALS_PATHS

---

51-55: Make delete robust and race-safe; optionally remove legacy files too.

Handle TOCTOU and permission errors gracefully; consider cleaning legacy files.

Apply:

-    credentials_path = os.path.expanduser(DEFAULT_CREDENTIALS_PATH)
-    if os.path.exists(credentials_path):
-        os.remove(credentials_path)
-        return True
-    return False
+    deleted = False
+    for path in [os.path.expanduser(DEFAULT_CREDENTIALS_PATH), *[os.path.expanduser(p) for p in LEGACY_CREDENTIALS_PATHS]]:
+        try:
+            os.remove(path)
+            deleted = True
+        except FileNotFoundError:
+            pass
+        except OSError:
+            pass
+    return deleted

src/mcp_agent/cli/cloud/commands/auth/login/main.py (2)

101-117: Optional: warn on non-HTTPS API base URL.

Reduce MITM risk by validating scheme.

 base_url = settings.API_BASE_URL
+if not base_url.startswith("https://"):
+    print_warning("Non-HTTPS API base URL detected; proceed with caution.")

---

93-99: Ensure credentials file is written atomically with 0600 perms.

Current save implementation (in auth/main.py) appears to open twice and may not enforce permissions atomically. Consider a single secure, atomic write.

Proposed implementation for save_credentials (in src/mcp_agent/cli/auth/main.py):

import os, tempfile

def save_credentials(credentials: UserCredentials) -> None:
    path = os.path.expanduser(DEFAULT_CREDENTIALS_PATH)
    os.makedirs(os.path.dirname(path), exist_ok=True)
    dir_ = os.path.dirname(path) or "."
    with tempfile.NamedTemporaryFile("w", dir=dir_, delete=False, encoding="utf-8") as tf:
        os.chmod(tf.name, 0o600)
        tf.write(credentials.to_json())
        tmp_name = tf.name
    os.replace(tmp_name, path)

Also applies to: 148-154

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: CR
PR: lastmile-ai/mcp-agent#0
File: examples/usecases/reliable_conversation/CLAUDE.md:0-0
Timestamp: 2025-07-22T18:59:49.368Z
Learning: Applies to examples/usecases/reliable_conversation/examples/reliable_conversation/src/utils/config.py : Configuration values such as quality_threshold, max_refinement_attempts, consolidation_interval, and evaluator_model_provider must be loaded from mcp_agent.config.yaml.