feat(mcp-tools): DecideskToolProvider — first per-app IMcpToolProvider

[rubenvdlinde]

Summary

First per-app implementation of OCA\OpenRegister\Mcp\IMcpToolProvider (interface defined in openregister PR #1466, currently open). Exposes 5 governance tools to the AI chat companion that the widget surface (nc-vue) sends through OR's chat backend:

Reads

• decidesk.listOpenActionItems — open action items, optionally scoped to the current user
• decidesk.listRecentMeetings — last N meetings, optional status filter
• decidesk.getMeetingDetails — single meeting with agenda + decisions + action items inlined

Actions (lifecycle + mutation)

• decidesk.startMeeting — transitions a scheduled meeting to in-progress; chair/admin auth enforced
• decidesk.addActionItem — creates an action item linked to a meeting; participant/admin auth

Architecture

Single DecideskToolProvider class at lib/Mcp/DecideskToolProvider.php delegates to existing services (MeetingService, TaskService, OR ObjectService) via DI. Tool IDs namespaced decidesk.{toolName}; OR's McpToolsService enforces the namespace mechanically.

Visibility model: every tool always exposed to the LLM; per-object auth check happens in invokeTool() returning {isError: true, error: 'forbidden'} so the LLM can explain to the user. Six error codes total: forbidden, not_found, invalid_state, invalid_input, unknown_tool, internal_error.

Source citations: every successful tool result includes a sources array of deep links (capped at 20). The widget's CnAiMessageList renders these as inline [view meeting] etc. links.

Service container registration in Application.php:

$context->registerServiceAlias(
    'OCA\\OpenRegister\\Mcp\\IMcpToolProvider::decidesk',
    DecideskToolProvider::class,
);

No composer dep on openregister — OR autoloads at runtime via NC's app manager, same as the existing OCA\OpenRegister\Service\ObjectService usage in MeetingController / MinutesController.

Tests

• 26 unit tests in tests/Unit/Mcp/DecideskToolProviderTest.php covering tool list shape, namespace enforcement, all 5 tools' happy paths + every error-code path + sources-array truncation.
• Self-skipping integration tests in tests/Integration/Mcp/ for live DI + service round-trips (require Nextcloud + OpenRegister installed).
• Interface stub in tests/Stubs/Mcp/IMcpToolProvider.php loaded by bootstrap-unit.php when the real OR interface isn't on the autoloader.
• composer check:strict: ALL CHECKS PASSED (183 tests, 950 assertions, 37 skipped integration tests).

Static analysis

• phpmd.baseline.xml: 12 entries for DecideskToolProvider complexity (single-class design per design D1; mitigation: 26 unit tests).
• phpstan.neon, psalm.xml: suppress Undefined class for IMcpToolProvider (ships in openregister PR #1466, not merged yet). Remove once openregister is bumped to a tag that publishes the interface.

Dependencies

Soft runtime dep on ConductionNL/openregister#1466. The provider is registered unconditionally; if OR isn't installed at runtime, McpToolsService simply doesn't exist to enumerate it (the widget's health probe handles the no-op case).

Spec

Full spec + design + tasks archived at openspec/changes/archive/2026-05-11-decidesk-mcp-tools/ and the capability spec promoted to openspec/specs/mcp-tools/spec.md. 10 requirements (REQ-DMCP-001…010), 5 architectural decisions, 7 risks, 3 deferred questions resolved in-place during apply.

Test plan

• openspec validate decidesk-mcp-tools --strict passes
• composer check:strict ALL CHECKS PASSED
• All 5 tools have happy-path + every-error-code unit tests
• Tool ids namespaced decidesk.*
• Live end-to-end smoke test against an LLM via the AI chat widget (blocked on openregister#1466 merging + Ollama health)

Pre-prod app per the standing memory rule (pre-production apps: decidesk, mydash, ..., auto-merge OK), so this PR is admin-mergeable once you eyeball it.

[github-actions]

Quality Report — ConductionNL/decidesk @ 178050e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 469/469
PHPUnit					✅
Newman					✅
Playwright					⏭️

Coverage: 0% (0/115 statements)

---

Quality workflow — 2026-05-11 15:52 UTC

Download the full PDF report from the workflow artifacts.