Repository navigation
feat(settings): MCP connected clients and a live tool catalog - #1530
Conversation
…config One section with the server URL, per-client tabs (Claude Code, Cursor, Windsurf, Other) using each client's real config file and URL key, and a single entry to the MCP key fallback that inserts the secret into the snippets.
One connection per refresh-token family, with client name, approving member, scopes, connected, last refreshed and expiry. Members see and revoke their own, admins everyone's; revoking ends the family and its access keys and records mcp_connection.revoked in the audit log. The hourly OAuth access keys are left out of the API key list, since the grant is now managed as a connection.
The AI Worker lists what the public MCP transport serves (name, title, description, read-only and destructive hints); api forwards /internal/mcp/* to it like the chat paths.
Replaces the hardcoded 24-tool list, which named a tool that does not exist. Tools are grouped by topic from their names, searchable, and marked read only or writes.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 48 seconds. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Makisuo
changed the title
Maple review🟢 Confidence 8/10 · likely safe to merge Adds a v2 MCP connections API (list and revoke, admin-or-own scoping, audit entry), drops the hourly OAuth access keys from the API key list, and serves the real tool catalog from the AI worker to a redesigned MCP settings tab. Safe to merge. The generated
Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
What was checked
Observability coverage: 4 of 4 changes observable
|
Maple review🟢 Confidence 8/10 · likely safe to merge Adds
Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
What was checked
Observability coverage: 2 of 2 changes observable
|
Maple review🟢 Confidence 9/10 · safe to merge Rebuilds Settings > MCP: per-client connect snippets, connected OAuth grants with member/admin revoke at a new
Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
What was checked
Observability coverage: 3 of 3 changes observable
|
Maple review🟢 Confidence 8/10 · likely safe to merge Adds a live MCP connected-clients list with admin/member revocation on a new
Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
What was checked
Observability coverage: 3 of 3 changes observable
|
Maple review🟢 Confidence 8/10 · likely safe to merge Adds
Before merge
Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
What was checked
Observability coverage: 3 of 3 changes observable
|
|
Preview test results and traces for the whole stack are on #1531 (all flows passed on the latest deploy). |
Maple reviewNothing to review Nothing left to review: since the last review at fcadd90 the head only advanced by merging the base branch, and the single file that moved, Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
|
# Conflicts: # apps/api/src/routes/v2/v2-test-support.ts
Maple review🟢 Confidence 8/10 · likely safe to merge Redesigns the MCP settings tab around a live tool catalog served by the AI worker, per-client connect snippets, and a
Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
What was checked
Observability coverage: 4 of 4 changes observable
Files not reviewed (1)The review ended before it read these diffs, so nothing above vouches for them.
|
Maple review🟢 Confidence 9/10 · safe to merge Since the previous review the only delta is
Production impactProduction traffic of the changed files (last 7 days)
Telemetry this change adds and removes (3)
What was checked
|
Maple: after this shipped✅ Shipped clean. Nothing this change touches got worse in the hour after it deployed. Deployed to
Maple looks once, an hour after the first deploy that carries the merge. |
MCP tab redesign with connected clients and a live tool catalog.
.mcp.json/claude mcp add, Cursor, Windsurf, Other).GET/DELETE /v2/mcp_connections: one row per OAuth grant (client, user, scopes, connected, last refreshed, expires). Admins see and revoke all, members their own; revoke ends the grant family and writes an audit entry./v2/api_keysno longer lists the hourly OAuth access-key rows./internal/mcp/toolsserved by the AI worker (forwarded by the API) from the real tool registry; the tab lists all public tools grouped and searchable with Read only / Writes badges. The hardcoded list (24 tools, one that does not exist) is gone.Known follow-up: the Keys tab reads keys from the live sync shape, which does not carry the metadata needed to hide those OAuth rows there yet.
Verification
Stack
Settings redesign, bottom to top: #1525 foundation, #1526 general and members, #1527 billing and usage, #1528 keys, ingestion and sampling, #1529 audit log, setup health and data platform, #1530 MCP, #1531 AI and email preferences. Bug fixes from the same audit shipped in #1524. Alerts routing is a later stack.
🤖 Generated with Claude Code