feat(mcp): add REST + CLI mirrors for finding and enrichment taxonomies(#6620)

[andriypolanski]

Summary

• Add unauthenticated REST mirrors for the existing MCP taxonomy resources: GET /v1/mcp/finding-taxonomy and GET /v1/mcp/enrichment-analyzers, returning buildFindingTaxonomyDocument() / buildEnrichmentAnalyzersTaxonomyDocument() (same shape as the remote MCP server resources from feat(mcp): register a gittensory://finding-taxonomy resource enumerating review finding categories #2225 / feat(mcp): register a gittensory://enrichment-analyzers resource from REES analyzer metadata #2226).
• Exclude both routes from requiresApiToken() and pre-auth rate limiting (same treatment as /v1/mcp/compatibility).
• Register matching CLI resources in @loopover/mcp: loopover://finding-taxonomy and gittensory://enrichment-analyzers, each fetching via unauthenticated apiFetch(..., { auth: false }) with { status: "unavailable" } fallback on API failure.
• Cover REST routes, CLI discovery/read, API-mirror success, and fallback-on-failure paths in unit + integration tests; extend the MCP CLI fixture server with both routes.

Closes #6620

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Targeted local runs: npx vitest run test/unit/mcp-finding-taxonomy-rest.test.ts test/unit/mcp-enrichment-analyzers-rest.test.ts test/unit/mcp-discovery.test.ts (29/29) and npx vitest run test/integration/api.test.ts -t "serves health and OpenAPI openly" (1/1). Full npm run test:ci / npm run test:coverage / audit still needed before push. No OpenAPI spec regeneration — routes are public read-only mirrors of static taxonomy builders, not new authenticated API surface.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — API + MCP CLI resource mirrors only; no mounted UI change.

State / title	JPG/PNG evidence
N/A — no visible UI change

Notes

• Suggested title: feat(mcp): add REST + CLI mirrors for finding and enrichment taxonomies (#6620)
• Changed files: src/api/routes.ts, src/auth/rate-limit.ts, packages/loopover-mcp/bin/loopover-mcp.js, test/unit/mcp-finding-taxonomy-rest.test.ts, test/unit/mcp-enrichment-analyzers-rest.test.ts, test/unit/mcp-discovery.test.ts, test/unit/support/mcp-cli-harness.ts, test/integration/api.test.ts
• CLI resources use apiFetch(..., { auth: false }) (not apiGet) so unauthenticated clients can read taxonomy mirrors without a session token; compatibility resource updated to the same pattern.
• Remote MCP server resources (src/mcp/server.ts) are unchanged — this PR adds HTTP + CLI discovery paths only.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-16 18:03:40 UTC}

8 files · no blockers · CI pending · blocked

⏸️ Suggested Action - Manual Review

Decision drivers

• ✅ Code review — No blockers (No AI review summary)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#6620
Related work	⚠️ 1 scoped overlap	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (draft PR; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 184 registered-repo PR(s), 113 merged, 25 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	andriypolanski; Gittensor profile; 184 PR(s), 25 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Linked issue satisfaction

Addressed
The diff adds both unauthenticated REST routes reusing the existing builder functions, extends requiresApiToken/rate-limit exclusions, registers the two matching CLI resources with the exact required URIs and try/catch fallback mirroring loopover_compatibility, and adds corresponding REST, discovery, and fallback tests.

Review context

• Author: andriypolanski
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 184 PR(s), 25 issue(s).
• Related work: Titles/paths share 10 meaningful terms. (issue #6593, issue #6620)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 3 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[JSONbored]

Just FYI, this afternoon the bot will start pausing/cancelling CI runs and reviews for PRs in draft mode. Draft wastes our CI runs and server resources and slows down the review process for everyone.

[JSONbored]

Failing CI.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.65%. Comparing base (6ac8c1f) to head (6e0aa6c).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6666   +/-   ##
=======================================
  Coverage   93.65%   93.65%           
=======================================
  Files         681      681           
  Lines       68086    68092    +6     
  Branches    18688    18694    +6     
=======================================
+ Hits        63764    63770    +6     
  Misses       3347     3347           
  Partials      975      975           

Flag	Coverage Δ
shard-1	43.99% <50.00%> (+<0.01%)	⬆️
shard-2	36.87% <75.00%> (-0.01%)	⬇️
shard-3	32.48% <50.00%> (+0.05%)	⬆️
shard-4	34.51% <75.00%> (-0.06%)	⬇️
shard-5	30.93% <50.00%> (-0.02%)	⬇️
shard-6	45.70% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/api/routes.ts	94.56% <100.00%> (+<0.01%)	⬆️
src/auth/rate-limit.ts	98.90% <ø> (ø)

... and 1 file with indirect coverage changes