[rupesh-kumar-sah]

Summary

This PR instruments the MCP server (BazaarMcpServer) with Prometheus metrics registered to the central register in src/metrics.ts, exposing tool usage, performance, and failure categorization at /metrics.

Closes #425

Details

1. Tool Calls Counter (mcp_tool_calls_total):

   • Counts tool calls partitioned by tool and outcome (success | failure).
   • Tool names come from the fixed, server-defined closed set (bazaar_search, paid_call, payment_budget, lens_get_price), falling back to unknown for unadvertised tool requests to prevent label cardinality explosions.

2. Tool Duration Histogram (mcp_tool_duration_seconds):

   • Records execution latency in seconds per tool across standard buckets ([0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]).
   • Measures end-to-end execution within CallToolRequestSchema across both success and failure paths.

3. Errors Counter (mcp_errors_total):

   • Counts errors partitioned by code, strictly sourced from the closed MCP_ERROR_CODES vocabulary.
   • Captured in createErrorResponse across all tool error paths, as well as on unauthorized HTTP requests (ERR_UNAUTHORIZED).

4. Prometheus Registry Integration:

   • Defined in src/metrics.ts with registers: [register] so all metrics automatically appear at /metrics.

Verification

• 100% green vitest tests across all MCP test suites (tests/mcp*.test.ts — 190 passing tests).
• Added comprehensive unit tests in tests/mcp.test.ts verifying all 5 acceptance criteria:
  • Tool calls counted by tool and outcome
  • Duration recorded per tool
  • Errors counted by error code
  • Strict closed-set label enforcement
  • Appearance on /metrics exposition output
• Full TypeScript typecheck verified (tsc --noEmit exits 0).

[drips-wave]

Warning

Possible malicious code: please review before merging.

An automated security scan flagged files in this pull request that appear to contain malicious code. Code like this can run automatically when a project is opened in an editor or its dependencies are installed, so it could compromise the machine of anyone who checks out this branch.

Automated scans can be wrong, so this may be a false positive. Maintainers: please review the flagged files carefully before merging, on GitHub in your browser rather than by checking out the branch. The malicious part is often hidden far off to the right of an ordinary-looking line, so scroll sideways through each file.

@rupesh-kumar-sah: this pull request adds or changes these files, possibly without your knowledge. Malware like this spreads by adding itself to repositories on machines it has infected, so your machine might be compromised. Please undo these changes in this pull request, and don't open or run other projects on that machine until you've checked it.

Flagged files at commit df28267:

• .gitignore
• examples/portfolio-nav/init
• examples/portfolio-nav/package.json
• init
• package.json

Only merge once you're confident these files are safe.

ℹ️ Posted automatically by Drips Wave. Questions? Contact support@drips.network.