[northdpole]

Summary

• Share PromptHandler.retrieve_nearest_standard_for_prompt between chatbot and MCP ask so security facts use the same embedding similarity path instead of text_search REST.
• Stacked on feat/oie-rq-fanout (feat(oie): RQ A→B→C fan-out and Admin OIE queue tab #1142), which includes the lint fix restoring validate_cron_line and exempting admin /rest/v1/api-keys from OpenAPI coverage.

Test plan

• make lint (openapi-guardrail OK)
• python -m unittest application.tests.mcp_ask_test (14 tests)

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 1

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: OWASP/OpenCRE
• Branch: fix/ask-embedding-retrieval
• File: .coderabbit.yml
• Commit: 2f9187c
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5964b962-fb3a-464c-ba9e-e18da6812588

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ShaanGS]

ask reports setup failures as "no match". On this branch (d2416dc, same on the stack tip), with the stdio server pointed at opencre.org and no local DB, every security prompt returns ok: false with "No CRE/standard embedding match above similarity threshold." The real error only shows up in stderr at INFO: no such table: embeddings, or Missing Gemini API key with the make e2e-db fixture DB.

_retrieve_nearest_standard catches it and returns None, the same as a real miss, and the tests mock that function, so this path isn't covered. Could it return a distinct message or raise (and log at WARNING), or fall back to REST text_search like #1142 did when local retrieval can't run?

Also, the "Security fact pack" section in docs/api/mcp.md still says step 1 is text_search. Happy to help once the stack lands.