nimmo/nixos-config

Watch

Fork 0

feat(ai): add SynthSeek MCP client #194

Merged

nimmo merged 1 commit from feat/synthseek-mcp into main

2026-08-26 20:55:32 +01:00

nimmo commented

2026-08-26 20:48:14 +01:00

Owner

Summary

Configure the remote SynthSeek MCP server for Codex and OpenCode.
Store the bearer API key in an encrypted SOPS secret shared by AI client hosts.
Remove the redundant OpenCode runtime Codex wrapper, avoiding a Home Manager bin/codex collision.

Validation

nix flake check
Live OpenCode test using ollama-desktop/gemma4:26b: SynthSeek synthseek_get_system_health returned healthy database and queue engine.

No deployment is included in this PR.

## Summary - Configure the remote SynthSeek MCP server for Codex and OpenCode. - Store the bearer API key in an encrypted SOPS secret shared by AI client hosts. - Remove the redundant OpenCode runtime Codex wrapper, avoiding a Home Manager bin/codex collision. ## Validation - nix flake check - Live OpenCode test using ollama-desktop/gemma4:26b: SynthSeek synthseek_get_system_health returned healthy database and queue engine. No deployment is included in this PR.

nimmo added 1 commit

2026-08-26 20:48:17 +01:00

feat(ai): add SynthSeek MCP client

AI pull-request review / review (pull_request) Successful in 1m20s

Details

Build and Push Attic Cache / test (pull_request) Successful in 1m27s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped

Details

0fabb76227

nimmo commented

2026-08-26 20:49:37 +01:00

Author

Owner

Automated code review

Reviewed commit: aa7b1b45a44dc59b253d639548d4a26b8a8880da

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

The PR introduces a new SynthSeek MCP client configuration, adding a SOPS-encrypted secret file (secrets/synthseek-mcp.yaml), updating .sops.yaml for key management, and integrating the credentials into both ai-agents.nix (for Codex) and ai-runtime.nix (for OpenCode). A significant refactoring removes the redundant codexForUser wrapper from ai-runtime.nix, consolidating it into ai-agents.nix. The changes are logically sound, follow existing patterns for secret handling and conditional configuration, and correctly address the separation of concerns between agent profiles and runtime environments.

Blocking findings

None.

Important findings

None.

Suggestions

Verify OpenCode JSON header interpolation syntax (modules/profiles/ai-runtime.nix:396; medium confidence)
"headers.Authorization" = "Bearer {file:${config.sops.secrets.${synthseekMcpApiKeySecretName}.path}}";
Impact: The OpenCode configuration uses {file:...} interpolation for the bearer token. This syntax is specific to OpenCode's MCP client implementation. If OpenCode's version or configuration schema changes, this might break silently or fail to authenticate.
Suggested fix: Verify that the {file:...} syntax is still supported in the version of OpenCode being used. Consider adding a comment referencing the OpenCode documentation for this feature to aid future maintainers.
Consider consolidating MCP configuration logic (modules/profiles/ai-agents.nix:295; medium confidence)
${lib.optionalString synthseekMcpConfigured ''
ensure_http_mcp
synthseek
https://seek.nimmog.uk/api/v1/mcp
${lib.escapeShellArg synthseekMcpApiKeyEnvVar}
''}
Impact: The MCP configuration for SynthSeek is duplicated between ai-agents.nix (for Codex) and ai-runtime.nix (for OpenCode). While this separation aligns with the current module structure, it creates two points of maintenance for the same endpoint URL and authentication method.
Suggested fix: Consider extracting the SynthSeek MCP configuration into a shared helper function or a dedicated small module that both ai-agents.nix and ai-runtime.nix can import. This would ensure consistency if the endpoint URL or auth method changes in the future.

Tests and validation

No configured deterministic checks.

Questions

The PR removes codexForUser from ai-runtime.nix. Is there any other host or profile that imports ai-runtime.nix and relies on the codex binary being available in the PATH via that module's home.packages?
The SynthSeek secret is encrypted for electra, lena, vega, and lyra. Are all these hosts confirmed to be AI client hosts that will actually use the SynthSeek MCP endpoint, or could some of these key groups be unnecessary?

Review limitations

I cannot run nix flake check to validate the Nix configuration syntax.
I cannot verify the actual connectivity or authentication success with the SynthSeek MCP server.
The diff does not show the full content of modules/profiles/ai-agents.nix or modules/profiles/ai-runtime.nix, so I am inferring the context of changes based on the provided snippets.
I cannot verify the SOPS encryption keys or their validity.

Diff coverage

.sops.yaml: reviewed — included in a context-limited batch
modules/profiles/ai-agents.nix: reviewed — included in a context-limited batch
modules/profiles/ai-runtime.nix: reviewed — included in a context-limited batch
secrets/README.md: reviewed — included in a context-limited batch
secrets/synthseek-mcp.yaml: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 1
Previous automated review: updated
Findings: 2

## Automated code review Reviewed commit: `aa7b1b45a44dc59b253d639548d4a26b8a8880da` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment The PR introduces a new SynthSeek MCP client configuration, adding a SOPS-encrypted secret file (`secrets/synthseek-mcp.yaml`), updating `.sops.yaml` for key management, and integrating the credentials into both `ai-agents.nix` (for Codex) and `ai-runtime.nix` (for OpenCode). A significant refactoring removes the redundant `codexForUser` wrapper from `ai-runtime.nix`, consolidating it into `ai-agents.nix`. The changes are logically sound, follow existing patterns for secret handling and conditional configuration, and correctly address the separation of concerns between agent profiles and runtime environments. ### Blocking findings None. ### Important findings None. ### Suggestions - **Verify OpenCode JSON header interpolation syntax** (modules/profiles/ai-runtime.nix:396; medium confidence) "headers.Authorization" = "Bearer {file:${config.sops.secrets.${synthseekMcpApiKeySecretName}.path}}"; Impact: The OpenCode configuration uses `{file:...}` interpolation for the bearer token. This syntax is specific to OpenCode's MCP client implementation. If OpenCode's version or configuration schema changes, this might break silently or fail to authenticate. Suggested fix: Verify that the `{file:...}` syntax is still supported in the version of OpenCode being used. Consider adding a comment referencing the OpenCode documentation for this feature to aid future maintainers. - **Consider consolidating MCP configuration logic** (modules/profiles/ai-agents.nix:295; medium confidence) ${lib.optionalString synthseekMcpConfigured '' ensure_http_mcp \ synthseek \ https://seek.nimmog.uk/api/v1/mcp \ ${lib.escapeShellArg synthseekMcpApiKeyEnvVar} ''} Impact: The MCP configuration for SynthSeek is duplicated between `ai-agents.nix` (for Codex) and `ai-runtime.nix` (for OpenCode). While this separation aligns with the current module structure, it creates two points of maintenance for the same endpoint URL and authentication method. Suggested fix: Consider extracting the SynthSeek MCP configuration into a shared helper function or a dedicated small module that both `ai-agents.nix` and `ai-runtime.nix` can import. This would ensure consistency if the endpoint URL or auth method changes in the future. ### Tests and validation - No configured deterministic checks. ### Questions - The PR removes `codexForUser` from `ai-runtime.nix`. Is there any other host or profile that imports `ai-runtime.nix` and relies on the `codex` binary being available in the PATH via that module's `home.packages`? - The SynthSeek secret is encrypted for `electra`, `lena`, `vega`, and `lyra`. Are all these hosts confirmed to be AI client hosts that will actually use the SynthSeek MCP endpoint, or could some of these key groups be unnecessary? ### Review limitations - I cannot run `nix flake check` to validate the Nix configuration syntax. - I cannot verify the actual connectivity or authentication success with the SynthSeek MCP server. - The diff does not show the full content of `modules/profiles/ai-agents.nix` or `modules/profiles/ai-runtime.nix`, so I am inferring the context of changes based on the provided snippets. - I cannot verify the SOPS encryption keys or their validity. ### Diff coverage - `.sops.yaml`: **reviewed** — included in a context-limited batch - `modules/profiles/ai-agents.nix`: **reviewed** — included in a context-limited batch - `modules/profiles/ai-runtime.nix`: **reviewed** — included in a context-limited batch - `secrets/README.md`: **reviewed** — included in a context-limited batch - `secrets/synthseek-mcp.yaml`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 1 - Previous automated review: updated - Findings: 2 </details>

nimmo force-pushed feat/synthseek-mcp from 0fabb76227

AI pull-request review / review (pull_request) Successful in 1m20s

Details

Build and Push Attic Cache / test (pull_request) Successful in 1m27s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped