[nquinquenel]

MCP-673 https://sonarsource.atlassian.net/browse/MCP-673

Human description

Organization identity lookups had no cache capacity or expiry limit. Bound the cache to 128 entries with a ten-minute lifetime. Successful lookups stay reusable within each stdio session or HTTP request. Failed lookups remain retryable.

Agent description

The merged MCP-677 change already reuses session identity and captures organization and agent metadata before asynchronous analytics dispatch. This change preserves that behavior and adds the remaining cache bounds with the existing Guava dependency. It adds no authentication changes or telemetry dropping policy.

Assumption: 128 entries and ten-minute expiry after insertion balance memory use, identity freshness and lookup frequency. Reads and repeated priming do not extend the lifetime. Reviewers can adjust these internal limits.

Acceptance coverage: deterministic tests cover expiry, capacity eviction, retry after failed or missing lookups, and isolation after session/request replacement. Existing analytics, executor and entitlement regression suites cover invocation metadata, disabled telemetry and caller isolation. No latency or throughput gain was measured.

Independent review: clean, round 1, gpt-6.1-sol, zero blocking findings.

Vortex: bound project SonarSource_sonarqube-mcp-server, entitlement enabled. Compass supplied no directives; project guidelines and Java resource, concurrency and testing rules guided cache ownership and deterministic tests. DEEP analysis found no touched-line issues. It reports the existing ServerApi class-level java:S6539 finding: 31 dependencies versus a maximum of 20; the declaration is unchanged and class restructuring is outside scope.

Validation gaps: Docker is unavailable, so StdioTransportITest and HttpTransportITest require CI. Independent review could not rerun regression tests or Spotless because its offline environment lacked the Gradle distribution. Host preparation was not validated because repository guidance supplies no preparation plan. The host focused suite passed 165 tests and Spotless; the full build has not completed under this workspace’s 4 GiB memory limit and remains running. CI must establish the full-suite result.

Repository guidance warning: no ADR directory exists. This bounded change adds no decision record; separate guidance work is outside scope. Dependency analysis found eight existing LOW risks; dependencies are unchanged. Attachments used: none. Secrets scan: clean; no report-only findings.

Usage: 19532044 tokens; gpt-6.1-sol (last measured before publication). Independent review accounts for 600154 tokens across one session.

Opened as a draft by autonomous Fabrik. Readiness requires all mechanical gates. Human approval and merge remain required.

---

_{🤖 Co-authored by Fabrik}

[hashicorp-vault-sonar-prod]

MCP-673

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
95.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 🟡 Medium risk

Bounding organization UUID caching to 128 entries and ten minutes may cause extra lookups and change which cached identity is reused.

Bounds the organization identity cache to 128 entries with a ten-minute expiry after insertion, keeping successful lookups reusable per session or request while failed lookups remain retryable. No issues found.

Verification Rules 2/2 met PRs 1 inspected

Functional validation No results

Rules 2 passed 2 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 705: SONARCH-3492 Prerequisite: Read project settings and pull request ids Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}