Title: fix(mcp): recover cleanly from OAuth failures by j15z · Pull Request #5595 · simstudioai/sim · GitHub
Open Graph Title: fix(mcp): recover cleanly from OAuth failures by j15z · Pull Request #5595 · simstudioai/sim
X Title: fix(mcp): recover cleanly from OAuth failures by j15z · Pull Request #5595 · simstudioai/sim
Description: Summary This PR makes MCP authentication and refresh failures recover cleanly instead of leaving Workspace Settings in repeated discovery loops or generic error states. Abandoned OAuth servers now wait for an explicit reconnect, failed refreshes expose a retryable Failed state, and persisted connection errors reach the list and detail views. Towards Fixing #5665. Dual-auth servers can now be added with a configured static Authorization: Bearer ... header: the connection test tries that credential before optional OAuth discovery. Supplemental non-auth headers still follow OAuth discovery, preserving OAuth servers that need routing or metadata headers. Connection attempts honor the configured timeout, and diagnostics record timing, phase, outcome, auth type, and header names without header values. Connection-test and refresh failures now use safe categorized messages so an upstream server cannot reflect a configured credential into API responses, persisted status, or logs. OAuth-pending servers remain disconnected without negative caching; rejected static credentials increment the normal failure state and negative cache instead of being mislabeled as OAuth-pending. Failed refreshes cannot report a stale connected row unless a newer successful discovery actually won the race. Merge order Merge this PR before #5596. Once it lands in staging, rebase #5596 onto the updated base and resolve its verification path against these authentication, status-persistence, and negative-cache semantics. Related: #5596 Type of Change Bug fix New feature Breaking change Documentation Other: ___________ Testing The original PR validation passed 25 focused MCP/API test files (375 tests) and the React Query pattern audit. The final post-merge validation passed 13 focused MCP/API/UI/security test files (220 tests), including valid and rejected Bearer credentials, headerless OAuth, OAuth with supplemental headers, post-resolution SSRF blocking, reflected-secret handling, static-401 failure persistence, refresh race handling, and settings refresh states. API validation audit passed with all 949 routes Zod-backed. Biome passed for the changed and conflict-resolved files, and the full TypeScript check passed. Review focus: static Bearer precedence, preservation of OAuth-plus-supplemental-header behavior, safe failure-state persistence, and the credential-reflection boundary. Checklist Code follows project style guidelines Self-reviewed my changes Tests added/updated and passing No new warnings introduced I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA) Post-Deploy Monitoring & Validation Search application logs for McpClient, McpService, authorization_required, timeout, and OAuth authorization pending during the first 24 hours. Healthy signals: abandoned OAuth servers stay disconnected without repeated discovery failures; static Bearer dual-auth servers connect; successful reconnects clear failure counters; no header values appear in MCP diagnostics. Failure signals: renewed discovery loops, static Bearer servers being redirected into OAuth, OAuth servers with supplemental headers failing connection tests, or credential fragments appearing in responses or logs. Roll back if MCP list availability regresses or refresh failures stop exposing a safe actionable error. Owner: MCP/settings team during the first business day after deployment. Screenshots/Videos Not applicable; this changes connection behavior and failure handling without altering layout.
Open Graph Description: Summary This PR makes MCP authentication and refresh failures recover cleanly instead of leaving Workspace Settings in repeated discovery loops or generic error states. Abandoned OAuth servers now ...
X Description: Summary This PR makes MCP authentication and refresh failures recover cleanly instead of leaving Workspace Settings in repeated discovery loops or generic error states. Abandoned OAuth servers now ...
Opengraph URL: https://github.com/simstudioai/sim/pull/5595
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:bd064273-258b-5f3d-fd2f-d655714bb940 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | B64A:1793BD:2E570C1:40A22B3:6A634170 |
| html-safe-nonce | 600cc8277999df294e11c01ce5cb1a51c76ed6de1a39c25213507496aa131a9c |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJCNjRBOjE3OTNCRDoyRTU3MEMxOjQwQTIyQjM6NkE2MzQxNzAiLCJ2aXNpdG9yX2lkIjoiMjgyMjkzODI5NTgzOTk2NTU1MiIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | e3ad2bb3d3bffa444974d42a2eb84d199a4592bb8216d98b271aac64ccdb1c91 |
| hovercard-subject-tag | pull_request:4036380819 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/simstudioai/sim/pull/5595/files |
| twitter:image | https://avatars.githubusercontent.com/u/96924014?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/96924014?s=400&v=4 |
| og:image:alt | Summary This PR makes MCP authentication and refresh failures recover cleanly instead of leaving Workspace Settings in repeated discovery loops or generic error states. Abandoned OAuth servers now ... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 59e55daad7174ca59d63c6974d58276ccb5477442e550bebb3c035e1bef11c94 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/simstudioai/sim git https://github.com/simstudioai/sim.git |
| octolytics-dimension-user_id | 199344406 |
| octolytics-dimension-user_login | simstudioai |
| octolytics-dimension-repository_id | 912559512 |
| octolytics-dimension-repository_nwo | simstudioai/sim |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 912559512 |
| octolytics-dimension-repository_network_root_nwo | simstudioai/sim |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 990295d92a4cc7b63fbbd83a046217cd7d77d49c |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width