# MCP file upload for case inputs: patch ready, no PR link

You were right. Before this change, the Every Checks MCP could create a task or a case, but it couldn't give either one its files. `add_task` told the agent to "upload inputs on the app", and the app has no form for that. That's why the Slack DM and the draft ended up pasted into the prompt for task 13.

**There's no PR link.** This environment had no GitHub login and no network, so I couldn't push. Instead there's a patch against `EveryInc/checks@18df437` to hand to your eng team.

## Files

| File | What it is |
|---|---|
| `0001-upload-case-input-files-over-mcp.patch` | The change as one `git am`-ready commit: 17 files, +251 −13 |
| `PR_DESCRIPTION.md` | The PR body to paste in: why, what, tests, and what to look at in review |
| `code/` | The starting tree with the patch applied |

## What it adds

- **`upload_input` MCP tool.** It puts a file into a case at a path, such as `slack-dm.md` or `data/sales.csv`, and that path is exactly where the model finds the file in its working directory.
  - Text goes in as `content` and binary files as `content_base64`, up to 10 MB.
  - Uploading to the same path again replaces the file.
  - Files on the default case reach every case of the task.
- **`remove_input` MCP tool.** It takes a file off a case.
- **HTTP endpoint for big files.** `POST …/tasks/:task/cases/:case/inputs` takes files up to 500 MB, sent with curl and the same token. If `upload_input` is called with no content, it returns the exact curl command.
- **Listing.** `get_case` and `get_task` now list each case's inputs, so the agent can read them back and confirm.
- **Guidance.** The manual that agents read first now says to upload files as inputs and not paste them into the brief.
- **Path checks.** Paths the model would never see are refused: `prompt.md`, `eval/`, `cases/`, `skill/`, and anything with `..` or an absolute path.
- **Permissions.** These are the same as for the other editing tools: owners and editors can upload, reviewers can't, and a token only reaches its own benchmark.

## How your team applies it

```bash
git checkout -b mcp-upload-inputs 18df437
git am 0001-upload-case-input-files-over-mcp.patch
bin/rails test && bin/rubocop
gh pr create --title "Upload case input files over MCP" --body-file PR_DESCRIPTION.md
```

## Before you send it

- **The Rails tests haven't been run.** I couldn't install gems without a network connection. What I did check:
  - every changed file passes a Ruby syntax check
  - the path rules and base64 handling pass a standalone test
  - the patch applies cleanly to a fresh copy of `18df437`

  I wrote new tests, but the team should run the suite first.
- **Commit identity.** The commit is authored as "Mike Taylor <mjt145@gmail.com>" and has no Claude trailer, per the repo's CLAUDE.md. Re-author it if your team prefers.
- **Binary files from a chat app.** In Claude desktop or web, text files like a Slack DM or a draft work fine. A PDF or spreadsheet has to be base64 inside the tool call, which only works for small files. Bigger ones need the curl route from a machine with a terminal.
- **Existing task 13.** It still has its files pasted into the instructions. Once this is deployed, an agent can upload the DM and the draft as inputs and trim the brief back to what you'd actually say.