feat(mcp): add loopover_list_bounties and loopover_get_bounty_lifecycle tools

[bitfathers94]

feat(mcp): add loopover_list_bounties and loopover_get_bounty_lifecycle tools

Mirror the two remaining public bounty REST routes (GET /v1/bounties and
GET /v1/bounties/:id/lifecycle) as read-only MCP tools, matching the shape of
the existing loopover_get_bounty_advisory. loopover_list_bounties takes no input
and returns every cached bounty; loopover_get_bounty_lifecycle takes a bounty id
and returns its { bountyId, events } history, surfacing the REST 404 as a tool
error. Both are categorized under discovery and carry MCP output schemas.

Closes #9296

Validation

Verified locally on this branch before opening:

• npm run typecheck
• npx turbo run build:tsc build:verify
• npm run test:coverage — patch coverage 100.0% of changed lines

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.82%. Comparing base (7876a05) to head (42f43ea).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9360      +/-   ##
==========================================
+ Coverage   75.38%   75.82%   +0.44%     
==========================================
  Files         275      276       +1     
  Lines       58023    59230    +1207     
  Branches     6181     6418     +237     
==========================================
+ Hits        43739    44911    +1172     
- Misses      14014    14027      +13     
- Partials      270      292      +22     

Flag	Coverage Δ
backend	97.10% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/mcp/server.ts	97.10% <100.00%> (ø)

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-27 14:19:43 UTC}

2 files · 1 AI reviewer · no blockers · readiness 95/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds two thin, read-only MCP tools (loopover_list_bounties, loopover_get_bounty_lifecycle) that call existing repository functions (listBounties, listBountyLifecycleEvents) and shape the output to match the described REST routes, following the same register/toolResult pattern as the neighboring loopover_get_bounty_advisory tool. The lifecycle tool correctly 404s via a thrown Error when getBounty returns null, and the test suite exercises both the happy path and the not-found/empty-input cases with real assertions against the repository functions rather than fabricated data. The main thing worth double-checking is that neither new tool applies the per-bounty canAccessRepo() gate that the sibling getBountyAdvisory applies.

Nits — 5 non-blocking

• src/mcp/server.ts:5583-5596 — getBountyList and getBountyLifecycle skip the `canAccessRepo(bounty.repoFullName)` check that getBountyAdvisory (a few lines above) applies before returning bounty data; confirm this is intentional because the underlying REST routes are genuinely unscoped/public, otherwise this is a quiet broadening of what a caller can read compared to the advisory tool.
• No test asserts that loopover_get_bounty_lifecycle's outputSchema (bountyLifecycleOutputSchema) actually matches the shape returned for a bounty with zero events — worth a quick assertion that `events: []` still validates.
• The `// mcp: add loopover_list_bounties + loopover_get_bounty_lifecycle tools (sibling loopover_get_bounty_advisory already exists) #9296` comments on the two new private methods (src/mcp/server.ts:5583, 5589) duplicate what the tool descriptions already say inline; harmless but slightly redundant given the file's existing comment density.
• Add a one-line note in the PR description or a code comment explaining why loopover_list_bounties/loopover_get_bounty_lifecycle omit the canAccessRepo scoping that loopover_get_bounty_advisory applies, so future readers don't assume it was an oversight.
• Consider a test case for loopover_get_bounty_lifecycle where the bounty exists but has zero lifecycle events, to lock in the `{ bountyId, events: [] }` shape distinctly from the 'unknown bounty' 404 case.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9296
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 45 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bitfathers94; Gittensor profile; 65 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: minor

Linked issue satisfaction

Addressed
The PR adds loopover_list_bounties (backed by listBounties, no input) and loopover_get_bounty_lifecycle (backed by getBounty + listBountyLifecycleEvents, returning {bountyId, events} and throwing on not-found), both registered with the discovery category in MCP_TOOL_CATEGORIES exactly as required, plus dedicated unit tests covering happy paths, empty list, not-found error, and input validation.

Review context

• Author: bitfathers94
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript
• Official Gittensor activity: 65 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.