Skip to content

[sergo] pkg/cli/mcp_registry.go: http.NewRequest missing context — requests not cancellable #30931

@github-actions

Description

@github-actions

Problem

pkg/cli/mcp_registry.go uses http.NewRequest (line 56) in createRegistryRequest, which does not accept a context.Context. This means all HTTP calls to the MCP registry cannot be cancelled by callers and ignore any deadline/cancellation signal propagated from upstream cobra command handlers.

This is inconsistent with the rest of the cli package, where deps_security.go:140 and compile_update_check.go:237,267 already use http.NewRequestWithContext correctly.

Location

  • pkg/cli/mcp_registry.go:55-66createRegistryRequest method
  • pkg/cli/mcp_registry.go:69-90SearchServers callers: mcp_registry_list.go:24, mcp_add.go:45

Impact

  • Severity: Medium
  • Affected code paths: MCP registry list (gh aw mcp list) and MCP add (gh aw mcp add) commands
  • Risk: HTTP requests to the MCP registry cannot be cancelled by the user (Ctrl+C) or by caller context deadlines. The only timeout is the blunt 30-second http.Client.Timeout.

Recommendation

Change the signature of createRegistryRequest to accept context.Context and propagate it via http.NewRequestWithContext:

Before:

func (c *MCPRegistryClient) createRegistryRequest(method, url string) (*http.Request, error) {
    req, err := http.NewRequest(method, url, nil)
    ...
}

After:

func (c *MCPRegistryClient) createRegistryRequest(ctx context.Context, method, url string) (*http.Request, error) {
    req, err := http.NewRequestWithContext(ctx, method, url, nil)
    ...
}

Update SearchServers and GetServerDetails to accept and forward a context.Context. Update callers in mcp_registry_list.go and mcp_add.go to pass cmd.Context().

Validation

  • Run existing CLI tests
  • Verify deps_security.go pattern is followed consistently
  • Confirm no other http.NewRequest calls remain in pkg/

Estimated Effort: Small


Generated by Sergo (Run 3, 2026-05-08) — Run ID: §25537174291

Generated by Sergo - Serena Go Expert · ● 506.4K ·

  • expires on May 15, 2026, 4:52 AM UTC

Metadata

Metadata

Labels

cookieIssue Monster Loves Cookies!sergo

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions