Treat missing MCP API-key servers as pending credentials during install - #219
Open
Minitour wants to merge 1 commit into
Open
Treat missing MCP API-key servers as pending credentials during install#219Minitour wants to merge 1 commit into
Minitour wants to merge 1 commit into
Conversation
capa install was failing unattended environment builds because ShareCube
tools validated against an empty Bearer ${ShareCubeApiKey} and were
counted as hard failures. OAuth2 servers were already remapped to
pendingAuth; apply the same skip to servers whose defs still reference
missing ${vars} or unresolved secret sources.
Minitour
marked this pull request as ready for review
September 7, 2026 21:38
PR Summary by QodoTreat missing MCP credentials as pending during install
AI Description
Diagram
High-Level Assessment
Files changed (5)
|
Code Review by Qodo
1. Valid credentials hide broken tools
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
Comment on lines
+249
to
+250
| hasUnresolvedSecretSources(server.def.env) || | ||
| hasUnresolvedSecretSources(server.def.headers) |
There was a problem hiding this comment.
1. Valid credentials hide broken tools 🐞 Bug ≡ Correctness
mcpServerIdsPendingCredentials treats every secret-source object in env or headers as unresolved without checking whether its environment variable, file, or command can resolve. When the source is available but a configured remote tool does not exist, validation finds the real mismatch and then runProjectConfigure overwrites that failure as pending authentication and removes its error.
Agent Prompt
## Issue description
Secret-source objects are classified as pending merely because they remain objects in the authored definition, even when they resolve successfully during validation. This masks real validation errors such as nonexistent remote tools.
## Issue Context
`resolveMcpServerDef` resolves supported external sources before connecting, while the pending classifier currently inspects only their syntax. Preserve genuine validation results whenever credential resolution succeeds.
## Fix Focus Areas
- src/shared/secret-value.ts[237-255]
- src/server/configure-routes.ts[354-375]
- src/server/mcp-proxy.ts[306-328]
- src/server/mcp-validate-tools.ts[105-145]
- src/shared/__tests__/secret-value.test.ts[158-173]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+354
to
+356
| for (const id of mcpServerIdsPendingCredentials( | ||
| capabilitiesToUse.servers ?? [], | ||
| missingVars, |
There was a problem hiding this comment.
2. Plugin tools still fail during install 🐞 Bug ≡ Correctness
runProjectConfigure passes missingVars extracted from authored capabilities into the pending classifier even though it validates servers from plugin-merged capabilitiesToUse. When a plugin server definition contains a missing placeholder, the outer plugin marker excludes that variable from missingVars, so its tools remain failed and no credential setup is offered for it.
Agent Prompt
## Issue description
Pending classification checks effective plugin server definitions against a missing-variable list built only from authored capabilities. Missing placeholders in plugin-contributed MCP servers therefore cannot match that list.
## Issue Context
Variable extraction intentionally skips outer objects carrying `sourcePlugin` to avoid treating plugin prose as credentials. Inspect effective MCP server definitions individually and query their required values without scanning unrelated plugin content.
## Fix Focus Areas
- src/server/configure-routes.ts[318-329]
- src/server/configure-routes.ts[354-359]
- src/shared/secret-value.ts[237-255]
- src/shared/variable-resolver.ts[116-133]
- src/shared/__tests__/secret-value.test.ts[119-173]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Unattended
capa install(including Cursor Cloud Agent environment builds) was exiting 1 because ShareCube MCP tools failed validation when${ShareCubeApiKey}was not set. OAuth2 servers were already treated as pending; API-key servers were not.What changed
${vars}or unresolved secret sources as pending credentialspendingAuththe same way disconnected OAuth2 servers already areScreenshots / logs
Environment build
bld-20260907-5fbb6124-f160-432c-a739-b0ac8a5e782afailed with:Slack/Atlassian on the same run were pending OAuth2 and did not fail the install.
Published capa 2.1.2 already treats install validation errors as warnings (exit 0). This PR is the remaining UX fix so missing API-key MCP servers show as pending credentials instead of 15 failed tools.
Test plan
mcpServerIdsPendingCredentials(missing var, present var, secret-source object)bun test— 1837 passbunx tsc --noEmitbld-20260907-277b47e2-5485-4492-824e-fd50cdf66050succeeded with capa 2.1.2 (capa --headless install --yes, exit 0). Recurring builds still need the dashboard install command saved until this ships in a release.Checklist
bunx tsc --noEmitpassesbun run smellsclean vs base (or CI Qlty Smells job green)