COD-1178: expose app APIs and Hotlist through CLI and MCP

[Sagar-CodeAnt]

Summary

• expose the authenticated application API surface through codeant api request <method> <path> without adding a CLI command for every backend route
• resolve one exact saved organization/provider/base-URL connection and send a non-overridable tenant context so the backend can run the same authorization flow as the web app
• add first-class codeant hotlist list and codeant hotlist get <stable-id> commands with UI-compatible filters, cursor pagination, tenant discovery, and snapshot polling
• expose Hotlist list/get and generic API access to MCP agents; non-GET generic calls remain gated by CODEANT_READ_ONLY=0
• revoke the server key on CLI/MCP logout before clearing local authentication
• add the complete cli-api.md manual and update README/MCP documentation

Command flow

codeant login
codeant scans orgs

codeant hotlist list --org CodeAnt-AI --service github --severity critical,high
codeant hotlist get <stable-id> --org CodeAnt-AI --service github

codeant api request POST /some/app/endpoint \
  --org CodeAnt-AI --service github \
  --body '{"repo":"CodeAnt-AI/example"}'

The generic command covers current and future authenticated app endpoints through a relative path. POST/PUT/PATCH/DELETE payloads must be JSON objects; the CLI adds canonical tenant fields and the backend rejects conflicts.

Security contract

• absolute and protocol-relative API URLs are rejected
• Authorization, Cookie, Host, Content-Length, and all X-CodeAnt-CLI-* headers cannot be overridden
• organization, service, and provider base URL must exactly match one connection returned by the authenticated login
• backend organization membership, RBAC, repository access, request guards, and audit attribution remain authoritative
• older keys must run codeant logout then codeant login once to gain verified app-API identity metadata

Manual

See cli-api.md for login, tenant selection, all Hotlist filters, stable-ID lookup, pagination, self-hosted providers, generic requests, MCP safety, logout/revocation, and troubleshooting.

Validation

• npm test -- --run tests/apiRequest.test.js tests/hotlist.test.js tests/fetchApi.test.js tests/logout.test.js — 15 passed
• CLI help smoke tests for api request and hotlist
• frontend command generator companion test — 3 passed
• git diff --check

The repository-wide suite also reaches configured online CodeAnt endpoints; those cases failed here with ENOTFOUND. Two unrelated existing secret-classification expectations and the existing --include-dismissed mismatch also failed. COD-1178 focused tests pass.

Dependencies and tracking

• Backend: https://github.com/CodeAnt-AI/codeant-ci-backend-2/pull/3233
• Frontend: https://github.com/CodeAnt-AI/codeant-ci-app-2/pull/1461
• COD-1178
• Addresses Anthropic MCP Directory Review — CodeAnt AI #25

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	b437ce7	Aug 26, 2026 · 13:54	13:55
✅ Reviewed your PR	6af8c0e	Aug 26, 2026 · 06:14	06:17

[codeant-ai]

CodeAnt Nitpicks

1 code suggestion

1. Polling can exceed the configured maximum wait by an entire retry interval.

Logic error · src/hotlist/client.js:79-83

[codeant-ai]

CodeAnt Confidence score 4/5

• The PR appears safe to merge; no confirmed high-impact regression remains.
• Hotlist commands can exceed the configured maximum wait by a full retry interval when the server requests a long delay.
• The current API command confines endpoints to relative paths, preventing bearer tokens from reaching arbitrary hosts through the reachable path.
• No inline suggestions were posted because the confirmed polling issue was assessed as low impact.