fix: e2e tests

Author: Daanvdplas

.github/workflows/integration-tests.yml

@@ -102,5 +102,6 @@ jobs:
       - name: Run integration tests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PRIVATE_KEY: //Alice
         run: |
           cargo test --locked --features pop-e2e

README.md

@@ -418,6 +418,13 @@ Deploys and instantiates a contract.
 Signing:
 - Set `PRIVATE_KEY` in the environment to a dev key URI (e.g. `//Alice`) when `execute=true`.
 
+MCP client config example (recommended):
+
+```toml
+[mcp_servers.pop-mcp.env]
+PRIVATE_KEY = "//Alice"
+```
+
 #### call_contract
 Calls a method on a deployed contract.
 
@@ -436,6 +443,18 @@ Calls a method on a deployed contract.
 Signing:
 - Set `PRIVATE_KEY` in the environment to a dev key URI (e.g. `//Alice`) when `execute=true`.
 
+MCP client config example (recommended):
+
+```toml
+[mcp_servers.pop-mcp.env]
+PRIVATE_KEY = "//Alice"
+```
+
+Security note:
+- Use dev keys only for local networks.
+- Prefer environment variables set in the MCP client config over CLI arguments.
+- Avoid logging or echoing secrets in tooling output.
+
 ### Network Tools
 
 #### pop_up_parachain

tests/mod.rs

@@ -55,6 +55,19 @@ mod common {
                 previous,
             }
         }
+
+        pub(crate) fn clear() -> Self {
+            let lock = PRIVATE_KEY_LOCK
+                .get_or_init(|| Mutex::new(()))
+                .lock()
+                .expect("Failed to lock PRIVATE_KEY guard");
+            let previous = std::env::var("PRIVATE_KEY").ok();
+            std::env::remove_var("PRIVATE_KEY");
+            Self {
+                _lock: lock,
+                previous,
+            }
+        }
     }
 
     impl Drop for PrivateKeyGuard {
@@ -321,7 +334,6 @@ mod common {
 
         /// Deploy to shared ink-node.
         pub(crate) fn deploy(&mut self, url: &str, constructor: &str, args: &str) -> Result<()> {
-            let _guard = PrivateKeyGuard::set();
             let executor = PopExecutor::new();
 
             let result = deploy_contract(

tests/tools/call/chain.rs

@@ -1,6 +1,7 @@
 use crate::common::{is_error, is_success, text, InkNode, PrivateKeyGuard, TestEnv};
 use anyhow::Result;
 use pop_mcp_server::tools::call::chain::{call_chain, CallChainParams};
+use pop_mcp_server::PopMcpError;
 
 #[test]
 fn call_chain_metadata_lists_pallets() -> Result<()> {
@@ -183,3 +184,28 @@ fn call_chain_transaction_uses_env_suri() -> Result<()> {
     assert!(output.contains("Extrinsic") || output.contains("hash") || output.contains("0x"));
     Ok(())
 }
+
+#[test]
+fn call_chain_execute_requires_private_key() -> Result<()> {
+    let _guard = PrivateKeyGuard::clear();
+
+    let err = call_chain(
+        TestEnv::new()?.executor(),
+        CallChainParams {
+            url: "ws://localhost:9944".to_string(),
+            pallet: Some("System".to_string()),
+            function: Some("remark".to_string()),
+            args: Some(vec!["0x9999".to_string()]),
+            sudo: None,
+            execute: Some(true),
+            metadata: None,
+        },
+    )
+    .unwrap_err();
+
+    let PopMcpError::InvalidInput(message) = err else {
+        panic!("expected InvalidInput error when PRIVATE_KEY is missing");
+    };
+    assert!(message.contains("PRIVATE_KEY"));
+    Ok(())
+}

tests/tools/call/contract.rs

@@ -1,6 +1,7 @@
 use crate::common::{is_error, is_success, text, Contract, InkNode, PrivateKeyGuard, TestEnv};
 use anyhow::Result;
 use pop_mcp_server::tools::call::contract::{call_contract, CallContractParams};
+use pop_mcp_server::PopMcpError;
 
 #[test]
 fn call_contract_nonexistent_path_fails() -> Result<()> {
@@ -80,3 +81,28 @@ fn call_contract_get_and_flip_mutates_state() -> Result<()> {
 
     Ok(())
 }
+
+#[test]
+fn call_contract_execute_requires_private_key() -> Result<()> {
+    let _guard = PrivateKeyGuard::clear();
+
+    let err = call_contract(
+        TestEnv::new()?.executor(),
+        CallContractParams {
+            path: "dummy_contract".to_string(),
+            contract: "0x1234".to_string(),
+            message: "flip".to_string(),
+            args: None,
+            value: None,
+            execute: Some(true),
+            url: Some("ws://localhost:9944".to_string()),
+        },
+    )
+    .unwrap_err();
+
+    let PopMcpError::InvalidInput(message) = err else {
+        panic!("expected InvalidInput error when PRIVATE_KEY is missing");
+    };
+    assert!(message.contains("PRIVATE_KEY"));
+    Ok(())
+}

tests/tools/up/contract.rs

@@ -1,6 +1,7 @@
 use crate::common::{is_error, is_success, text, Contract, InkNode, PrivateKeyGuard, TestEnv};
 use anyhow::Result;
 use pop_mcp_server::tools::up::contract::{deploy_contract, DeployContractParams};
+use pop_mcp_server::PopMcpError;
 
 #[test]
 fn deploy_contract_nonexistent_path_fails() -> Result<()> {
@@ -45,3 +46,28 @@ fn deploy_contract_succeeds_and_returns_address() -> Result<()> {
     assert!(output.contains("0x") || output.contains("5"));
     Ok(())
 }
+
+#[test]
+fn deploy_contract_execute_requires_private_key() -> Result<()> {
+    let _guard = PrivateKeyGuard::clear();
+
+    let err = deploy_contract(
+        TestEnv::new()?.executor(),
+        DeployContractParams {
+            path: "dummy_contract".to_string(),
+            constructor: Some("new".to_string()),
+            args: Some("false".to_string()),
+            value: None,
+            execute: Some(true),
+            url: Some("ws://localhost:9944".to_string()),
+        },
+        None,
+    )
+    .unwrap_err();
+
+    let PopMcpError::InvalidInput(message) = err else {
+        panic!("expected InvalidInput error when PRIVATE_KEY is missing");
+    };
+    assert!(message.contains("PRIVATE_KEY"));
+    Ok(())
+}