Fix: validate Xquik MCP sample

Author: kriptoburak

functionality/xquik_mcp_discovery/README.md

@@ -6,8 +6,10 @@ This sample shows how to connect AgentScope's MCP client to Xquik's remote MCP s
 
 ```
 .
+├── __init__.py               # Enables package-based test discovery
 ├── README.md                 # Documentation
 ├── main.py                   # Entry point
+├── test_main.py              # Offline configuration and query tests
 └── requirements.txt          # Dependencies
 ```
 
@@ -17,7 +19,7 @@ The sample demonstrates a minimal AgentScope MCP integration for a hosted, authe
 
 - Connects to `https://xquik.com/mcp` with an `Authorization: Bearer <token>` header.
 - Enables only the read-only `explore` MCP tool.
-- Searches the Xquik API catalog for endpoint categories or summaries that match a query.
+- Searches the Xquik API catalogue for methods, paths, categories, or summaries that match a query.
 - Prints the matching endpoint method, path, category, summary, and free/paid status.
 
 No write or publish operations are executed. The sample does not call Xquik's live `xquik` execution tool.
@@ -41,11 +43,7 @@ pip install -r requirements.txt
 export XQUIK_API_KEY="your-api-key"
 ```
 
-Optional: override the MCP URL when testing a compatible endpoint.
-
-```bash
-export XQUIK_MCP_URL="https://xquik.com/mcp"
-```
+The sample fixes the remote URL to `https://xquik.com/mcp` so the API key is never sent to a configurable origin.
 
 ### Usage
 
@@ -63,9 +61,19 @@ python main.py monitors
 
 If no query is provided, the sample searches for `radar`.
 
+### Tests
+
+Run the offline tests from the repository root:
+
+```bash
+python -m unittest -v functionality.xquik_mcp_discovery.test_main
+```
+
 ## Features
 
 - Uses AgentScope's `MCPClient` and `HttpMCPConfig`.
 - Keeps the MCP connection stateless.
 - Restricts the remote server to the read-only `explore` tool.
 - Reads configuration only from environment variables.
+
+Xquik is an independent third-party service. It is not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

functionality/xquik_mcp_discovery/__init__.py

@@ -0,0 +1,2 @@
+# -*- coding: utf-8 -*-
+"""Xquik MCP discovery sample."""

functionality/xquik_mcp_discovery/main.py

@@ -43,7 +43,12 @@ def _explore_code(query: str) -> str:
     return f"""
 async () => spec.endpoints
   .filter((endpoint) => {{
-    const haystack = `${{endpoint.method}} ${{endpoint.path}} ${{endpoint.category}} ${{endpoint.summary}}`.toLowerCase();
+    const haystack = [
+      endpoint.method,
+      endpoint.path,
+      endpoint.category,
+      endpoint.summary
+    ].join(" ").toLowerCase();
     return haystack.includes({query_literal});
   }})
   .slice(0, 10)
@@ -57,18 +62,21 @@ def _explore_code(query: str) -> str:
 """
 
 
-async def main() -> None:
-    client = MCPClient(
+def _mcp_client(api_key: str) -> MCPClient:
+    return MCPClient(
         name="xquik",
         is_stateful=False,
         enable_tools=["explore"],
         mcp_config=HttpMCPConfig(
             type="http_mcp",
-            url=os.environ.get("XQUIK_MCP_URL", DEFAULT_MCP_URL),
-            headers={"Authorization": f"Bearer {_required_api_key()}"},
+            url=DEFAULT_MCP_URL,
+            headers={"Authorization": f"Bearer {api_key}"},
         ),
     )
 
+
+async def main() -> None:
+    client = _mcp_client(_required_api_key())
     explore = await client.get_tool("explore")
     result = await explore(code=_explore_code(_query_from_args()))
     print(_extract_text(result))

functionality/xquik_mcp_discovery/test_main.py

@@ -0,0 +1,68 @@
+# -*- coding: utf-8 -*-
+"""Offline tests for the Xquik MCP discovery sample."""
+
+import json
+import os
+import sys
+import unittest
+from unittest.mock import patch
+
+from .main import (
+    DEFAULT_MCP_URL,
+    DEFAULT_QUERY,
+    _explore_code,
+    _extract_text,
+    _mcp_client,
+    _query_from_args,
+    _required_api_key,
+)
+
+
+class XquikMCPDiscoveryTest(unittest.TestCase):
+    def test_required_api_key_is_trimmed(self) -> None:
+        with patch.dict(
+            os.environ,
+            {"XQUIK_API_KEY": "  test-key  "},
+            clear=False,
+        ):
+            self.assertEqual(_required_api_key(), "test-key")
+
+    def test_required_api_key_rejects_empty_value(self) -> None:
+        with patch.dict(os.environ, {"XQUIK_API_KEY": ""}, clear=False):
+            with self.assertRaisesRegex(SystemExit, "Set XQUIK_API_KEY"):
+                _required_api_key()
+
+    def test_query_uses_arguments_or_default(self) -> None:
+        with patch.object(sys, "argv", ["main.py", "Twitter", "Trends"]):
+            self.assertEqual(_query_from_args(), "twitter trends")
+        with patch.object(sys, "argv", ["main.py"]):
+            self.assertEqual(_query_from_args(), DEFAULT_QUERY)
+
+    def test_explore_code_escapes_query_and_bounds_results(self) -> None:
+        query = 'trends"); throw new Error("unexpected")'
+        code = _explore_code(query)
+        self.assertIn(json.dumps(query), code)
+        self.assertIn(".slice(0, 10)", code)
+
+    def test_client_uses_fixed_origin_and_read_only_tool(self) -> None:
+        client = _mcp_client("test-key")
+        self.assertEqual(client.mcp_config.url, DEFAULT_MCP_URL)
+        self.assertEqual(
+            client.mcp_config.headers,
+            {"Authorization": "Bearer test-key"},
+        )
+        self.assertEqual(client.enable_tools, ["explore"])
+        self.assertFalse(client.is_stateful)
+
+    def test_extract_text_joins_text_and_fallback_content(self) -> None:
+        text_item = type("TextItem", (), {"text": "first"})()
+        fallback = type("Fallback", (), {"text": None})()
+        result = type("Result", (), {"content": [text_item, fallback]})()
+        self.assertEqual(
+            _extract_text(result),
+            f"first\n{fallback}",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()