Agent plugin review walkthrough

What this page shows#

This page is the review recording for the Impact Gate agent plugin submission. Every step below was executed against the live production deployment on October 16, 2026, and every screen and output shown is the real result captured at that time. No mockups or staging data are used.

The plugin connects an AI coding host to Impact Gate over MCP (Model Context Protocol). It exposes six read-only tools that return tenant-scoped API impact evidence: workspace status, change analysis, consumer lookup, API flow detail, function usage, and fix verification.

1. Install and configure#

The plugin ships in the Impact Gate repository under plugins/impact-gate-agent. Configuration points the host at the production MCP endpoint; no API keys are created or stored by the user, because authorization uses OAuth with dynamic client registration.

https://mcp.impactgate.in/

https://mcp.impactgate.in/.well-known/oauth-authorization-server

The discovery document advertises the issuer, authorization endpoint, token endpoint, and dynamic registration endpoint, so a compliant host configures itself. The only scope is impact:read.

2. OAuth authorization#

On first use the host opens the authorization endpoint. The reviewer registered a client through the dynamic registration endpoint, then opened the authorize URL with a PKCE S256 challenge. The hosted page asks for a Google sign-in:

Enlarge

After sign-in the server redirected to the registered redirect URI with an authorization code and the original state value; the state matched the value sent. The code was exchanged at the token endpoint with the PKCE verifier, and the server returned an access token. An invalid code is rejected with invalid_grant.

3. MCP connection and tools#

With the token as a Bearer credential, the MCP initialize handshake succeeded:

{
  "protocolVersion": "2025-03-26",
  "capabilities": { "tools": {} },
  "serverInfo": { "name": "impact-gate", "version": "1" },
  "instructions": "Read-only tenant-scoped Impact Gate evidence. Results state indexed commit, freshness, and uncertainty."
}

tools/list returned exactly six tools, all annotated readOnlyHint: true and destructiveHint: false:

• impactgate_workspace_status - authorized workspace and indexed repository status.
• impactgate_analyze_change - persisted deterministic impact findings for a bounded change.
• impactgate_find_consumers - which consumers call an API endpoint or field.
• impactgate_get_api_flow - handler and function flow for one API.
• impactgate_get_function_usage - callers and callees for one function.
• impactgate_verify_fix - check a proposed fix against persisted findings.

4. Tenant and workspace scoping#

Calls without a workspace selection do not guess. The server answered with an error that lists only the workspaces this account is authorized for:

{
  "code": -32003,
  "message": "Select a workspace before continuing.",
  "data": [
    { "workspaceId": "3fb27312-fc17-42c2-a71c-52b31af510fd", "name": "impact-gate" }
  ]
}

Requests for data outside the authorized set are refused: asking for an endpoint the selected workspace does not contain returned "No authorized workspace contains this data." Each response carries the workspace id, snapshot id, and the indexed commit it was computed from.

5. Representative output#

impactgate_workspace_status on the demo workspace returned the indexed repositories with their exact commits and freshness:

{
  "workspaceId": "3fb27312-fc17-42c2-a71c-52b31af510fd",
  "snapshotId": "3fb27312-fc17-42c2-a71c-52b31af510fd:689",
  "indexedAt": "2026-10-15T05:57:24.206Z",
  "indexedRepositories": [
    { "fullName": "impact-gate/ig-lab-catalog-api", "sha": "ad3dfeb7e6ced1f70164a09c8fac927593aec793", "status": "indexed" },
    { "fullName": "impact-gate/ig-lab-consumer-java-1", "sha": "8c5485bcc497bfed49462e23bd5bfc145fb03975", "status": "indexed" }
  ]
}

Every tool result includes a request id, generation time, coverage status, and limitation notes, so a reviewer can see exactly what evidence was available when the answer was computed. Analysis is deterministic and coverage-bound: what the index cannot see is reported as unknown, never as safe.