Skip to content

feat(integrations): add Vercel MCP connection - #763

Open
aivong-openhands wants to merge 1 commit into
mainfrom
av/add-vercel-mcp-integration
Open

aivong-openhands wants to merge 1 commit into
mainfrom
av/add-vercel-mcp-integration

Conversation

@aivong-openhands

@aivong-openhands aivong-openhands commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Adds the official Vercel MCP server as a connection option on the existing Vercel integration in the catalog. Vercel already had a catalog entry with only a REST (http) option, which the MCP library filters out, so the entry was not installable as an MCP server.

Details

  • integrations/catalog/vercel.json:
    • New oauth-mcp connection option: provider: mcp, transport: shttp, URL https://mcp.vercel.com
    • Auth is oauth2 with clientAuthentication: none. The server supports dynamic client registration and PKCE, so no client credentials are needed.
    • The existing REST oauth option is unchanged.
    • docsUrl now points to the Vercel MCP docs, and notes explains the sign-in flow.
  • integrations/catalog-index.js needs no change. It imports the JSON files, and npm run build:integrations produces no diff.

Validation

  • npm run build:integrations leaves catalog-index.js unchanged
  • tests/test_integration_catalog_in_sync.py, tests/test_catalog_schema.py and tests/test_catalogs.py pass
  • https://mcp.vercel.com/.well-known/oauth-authorization-server advertises a registration endpoint and token_endpoint_auth_methods_supported: ["none"]

This PR was created by an AI agent (OpenHands) on behalf of the user.

Jev-Fast-Audit

⚡ Jev fast audit · estimates · 0.19s · commit 1cdae65
Strongest signal: No primary concern selected.
Evidence: No primary concern to locate.
Coverage: complete supplied coverage; 1/1 hunks, 1/1 files.

All estimates and evidence
Estimate Likelihood / value Direct evidence
SQL injection 2.0% No direct hunk selected
Command injection 3.0% No direct hunk selected
Weakened authentication 8.0% F001H001 · integrations/catalog/vercel.json:7–30
Weakened authorization 8.0% No direct hunk selected
Contract regression 9.0% No direct hunk selected
Data loss 3.0% No direct hunk selected
Sensitive data disclosure 4.0% No direct hunk selected
Unexpected data transfer 6.0% No direct hunk selected
Credential misuse 9.0% No direct hunk selected
Untrusted instruction authority 2.0% No direct hunk selected
Package source redirection 3.0% No direct hunk selected
Unverified remote execution 3.0% No direct hunk selected
Privileged environment access 2.0% No direct hunk selected
Security assessment bypass 5.0% No direct hunk selected
Prohibited workload 2.0% No direct hunk selected
Primary concern None selected; confidence 77.0% No primary concern to locate

Co-authored-by: openhands <openhands@all-hands.dev>
@github-actions github-actions Bot added the type: feat A new feature label Oct 9, 2026
@aivong-openhands
aivong-openhands marked this pull request as ready for review October 12, 2026 14:29

@all-hands-bot all-hands-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This review was posted by an AI agent (OpenHands).

Code change

The catalog change is correct and well-scoped. Verified on head 1cdae65:

  • integrations/catalog/vercel.json adds a provider: mcp option with transport.kind: shttp and URL https://mcp.vercel.com - the shape the MCP library requires. It edits exactly one hand-authored JSON file under integrations/catalog/, so it respects the repository's single-source-of-truth rule and introduces no parallel provider/runtime files.
  • npm run build:integrations produces no diff against integrations/catalog-index.js (confirmed locally), so no regeneration is needed.
  • tests/test_integration_catalog_in_sync.py, tests/test_catalog_schema.py, and tests/test_catalogs.py pass on this head (116 passed).
  • https://mcp.vercel.com/.well-known/oauth-authorization-server advertises registration_endpoint and token_endpoint_auth_methods_supported: ["none"], so dynamic client registration with no client secret is supported. The unauthenticated endpoint returns 401, as expected.
  • oauth.clientAuthentication: "none" matches existing MCP entries in the catalog (e.g. atlassian-rovo.json, granola.json, superhuman-mail.json), so it is consistent with current convention.

No inline findings on the changed lines.

Blocking: required "Validate PR description" check is failing

The PR Description Check run for this head (run id 38263311054, pull_request_target) completed with failure, and the PR currently shows mergeable_state: blocked. The job log reports 6 errors against the current body:

  • The first visible line of the PR description must be HUMAN:.
  • Add a short human-written note (at least 20 characters) between HUMAN: and AGENT:.
  • Keep the AGENT: marker from the PR template.
  • Keep the ## Why section from the PR template.
  • Keep the ## How to Test section from the PR template.
  • Link an issue in the ## Issue Number section (e.g. Fixes #123).

The current body has only ## Summary, so the required HUMAN:/AGENT: structure and the ## Why, ## Issue Number, and ## How to Test sections are absent. Repository policy (AGENTS.md, .github/scripts/check_pr_description.py, .github/pull_request_template.md) requires those sections, plus a linked issue carrying ready-for-dev unless it predates the 2026-08-25 rollout. Please restore the template structure and human attestation and link the relevant issue, then re-run the check. The code itself is ready; this gate is the only thing standing between the change and merge.

🔄 CHANGES REQUESTED

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type: feat A new feature

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants