MCP add flow consumes registry auth facts

The probe stays authoritative when it lands: its OAuth and open-server verdicts are unchanged, but the registry's declared header pattern now replaces the generic Bearer guess on a bare 401, rides alongside detected OAuth (GitHub's MCP takes a PAT bearer in clients without OAuth support), and stands in entirely when there is no probe result — an authless server is a fact the registry already knew.

Rhys Sullivan committed 2 months ago

Commit 5d8aadd1 parent 97c4ef45 files · +47 −11Browse files

Unified · Split

5 files

packages/core/sdk/src/client.ts +5 −0
packages/plugins/mcp/src/react/AddMcpIntegration.tsx +34 −9
packages/react/src/pages/integration-add.tsx +3 −1
packages/react/src/pages/integration-browse.tsx +2 −0
packages/react/src/routes/integrations.add.$pluginKey.tsx +3 −1

packages/core/sdk/src/client.ts+5−0

      *  seed their auth-method editor from it. */
     readonly initialAuthHeader?: string;
     readonly initialAuthNote?: string;
+    /** Registry-declared credential kind ("none", "oauth", "api_key", …).
+     *  Lets a flow whose live probe fails, or whose surface can't be probed,
+     *  still declare the right method — an authless MCP server is a fact the
+     *  registry already knows. */
+    readonly initialAuthKind?: string;
   }>;
   /** Legacy full-page edit surface. No host renders this anymore — plugin
    *  configuration lives in the integration Edit sheet via `editSheet`. */

packages/plugins/mcp/src/react/AddMcpIntegration.tsx+34−9

 import { integrationWriteKeys } from "@executor-js/react/api/reactivity-keys";
 import type { McpAuthMethodInput } from "../sdk/types";
 import { probeMcpEndpoint, addMcpServer } from "./atoms";
+import { placementFromHeaderPattern } from "@executor-js/react/lib/auth-placements";
 import { McpRemoteIntegrationFields } from "./McpRemoteIntegrationFields";
 import { mcpAuthMethodInputFromEditorValue, mcpWireAuthInput } from "./auth-method-config";
 import { cloudflareNeedsCodemodeOptOut } from "../sdk/cloudflare-codemode";
   onCancel: () => void;
   initialUrl?: string;
   initialPreset?: string;
+  initialAuthHeader?: string;
+  initialAuthNote?: string;
+  initialAuthKind?: string;
   /** Whether the stdio transport is enabled on the server. */
   allowStdio?: boolean;
 }) {
   // without OAuth metadata → a bearer-header row; an open server → a no-auth
   // row. The user can edit any row or add alternate methods alongside.
   const authMethodSeeds: readonly AuthMethodSeed[] = useMemo(() => {
-    if (!probe) return [];
+    const registryPlacement = props.initialAuthHeader
+      ? placementFromHeaderPattern(props.initialAuthHeader)
+      : null;
+    if (!probe) {
+      // No probe result (pending, or the server was unreachable from here).
+      // The registry's declared facts still stand: an authless server or a
+      // known header pattern seeds the list the probe would have produced.
+      if (registryPlacement)
+        return [{ value: { kind: "apikey", placements: [registryPlacement] } }];
+      if (props.initialAuthKind === "none") return [{ value: { kind: "none" } }];
+      return [];
+    }
     if (probe.requiresOAuth) {
-      return [
+      const oauth: AuthMethodSeed = {
-        {
+        value: { kind: "oauth", authorizationUrl: "", tokenUrl: "", scopes: [] },
-          value: { kind: "oauth", authorizationUrl: "", tokenUrl: "", scopes: [] },
+        label: "Detected",
-          label: "Detected",
+      };
-        },
+      // GitHub's MCP server takes a PAT bearer header in clients without
-      ];
+      // OAuth; when the registry declared that placement, offer it alongside.
+      return registryPlacement
+        ? [oauth, { value: { kind: "apikey", placements: [registryPlacement] } }]
+        : [oauth];
     }
     if (probe.requiresAuthentication) {
+      // The registry's exact placement beats the generic Bearer guess.
       return [
         {
           value: {
             kind: "apikey",
-            placements: [{ carrier: "header", name: "Authorization", prefix: "Bearer " }],
+            placements: [
+              registryPlacement ?? { carrier: "header", name: "Authorization", prefix: "Bearer " },
+            ],
           },
           label: "Detected",
         },
       ];
     }
     return [{ value: { kind: "none" }, label: "Detected" }];
-  }, [probe]);
+  }, [probe, props.initialAuthHeader, props.initialAuthKind]);
   const authMethodList = useAuthMethodList(authMethodSeeds);
   const remoteIdentity = useIntegrationIdentity({
             />
           )}
+          {probe && props.initialAuthNote ? (
+            <p className="text-xs leading-relaxed text-muted-foreground">{props.initialAuthNote}</p>
+          ) : null}
           {/* Error (add server). Probe errors show inline on the field. */}
           {otherError && (
             <div className="space-y-2">

packages/react/src/pages/integration-add.tsx+3−1

   namespace?: string;
   authHeader?: string;
   authNote?: string;
+  authKind?: string;
 }) {
   useExecutorDocumentTitle("Add integration");
-  const { pluginKey, url, preset, namespace, authHeader, authNote } = props;
+  const { pluginKey, url, preset, namespace, authHeader, authNote, authKind } = props;
   const navigate = useNavigate();
   const integrationPlugins = useIntegrationPlugins();
   const refreshIntegrations = useAtomRefresh(integrationsOptimisticAtom);
             initialNamespace={namespace}
             initialAuthHeader={authHeader}
             initialAuthNote={authNote}
+            initialAuthKind={authKind}
             onComplete={(slug?: string) => {
               trackEvent("integration_added", {
                 plugin_key: pluginKey,

packages/react/src/pages/integration-browse.tsx+2−0

           ...(input.slug ? { namespace: input.slug } : {}),
           ...(input.auth?.header ? { authHeader: input.auth.header } : {}),
           ...(input.auth?.note ? { authNote: input.auth.note } : {}),
+          ...(input.auth?.kind ? { authKind: input.auth.kind } : {}),
         },
       });
     },
       // header pattern.
       if (auth?.header) search.authHeader = auth.header;
       if (auth?.note) search.authNote = auth.note;
+      if (auth?.kind) search.authKind = auth.kind;
       void navigate({
         to: "/{-$orgSlug}/integrations/add/$pluginKey",
         params: { pluginKey: entry.pluginKey },

packages/react/src/routes/integrations.add.$pluginKey.tsx+3−1

     // (GraphQL endpoints have no spec document).
     authHeader: Schema.optional(Schema.String),
     authNote: Schema.optional(Schema.String),
+    authKind: Schema.optional(Schema.String),
   }),
 );
   validateSearch: SearchParams,
   component: () => {
     const { pluginKey } = Route.useParams();
-    const { url, preset, namespace, authHeader, authNote } = Route.useSearch();
+    const { url, preset, namespace, authHeader, authNote, authKind } = Route.useSearch();
     return (
       <AddIntegrationPage
         pluginKey={pluginKey}
         namespace={namespace}
         authHeader={authHeader}
         authNote={authNote}
+        authKind={authKind}
       />
     );
   },

MCP add flow consumes registry auth facts

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code