Title: fix(mcp): bound OAuth discovery/DCR/token fetches with a timeout by waleedlatif1 · Pull Request #5776 · simstudioai/sim · GitHub
Open Graph Title: fix(mcp): bound OAuth discovery/DCR/token fetches with a timeout by waleedlatif1 · Pull Request #5776 · simstudioai/sim
X Title: fix(mcp): bound OAuth discovery/DCR/token fetches with a timeout by waleedlatif1 · Pull Request #5776 · simstudioai/sim
Description: Summary MCP OAuth (app.withgauge.com/mcp and others) can leave /oauth/start hanging for minutes, stranding the UI on "Connecting…". Root cause: the MCP SDK issues OAuth discovery / dynamic client registration / token exchange with a bare fetch and no AbortSignal (only the JSON-RPC layer gets the SDK's request timeout), and undici's default headers/body timeouts are 5 minutes. A slow or unresponsive authorization server therefore blocks the request handler — and the browser waiting on it — indefinitely. Fix: bound each guarded OAuth/revocation leg with a 30s AbortSignal.timeout, composed with any caller-provided signal via AbortSignal.any so cancellation still works. Only our own deadline is relabeled to a clear McpError; caller aborts and all other failures propagate unchanged. Scoped to createSsrfGuardedMcpFetch (OAuth discovery, RFC 7009 revocation, auth-type probe). The live MCP transport (createPinnedMcpFetch) is untouched, so tool-execution timeouts are unaffected. Why this design (empirically grounded) The MCP TS SDK applies no timeout to OAuth HTTP legs — it delegates to the injected fetchFn. Well-behaved clients (OpenAI Codex) add an explicit per-leg discovery timeout; local clients (Claude Code/Inspector) run OAuth on the user's machine so a human masks the hang. A hosted, server-side client must bound it itself. SSRF validation and IP-pinning are kept — Sim accepts arbitrary user URLs and must guard egress (unlike local clients). This PR only adds the missing deadline; redirect/retry behavior is deliberately unchanged to avoid regressing auth servers that 302 during discovery. Backwards compatibility / no regressions Existing callers (auth.ts, revoke.ts, probe.ts) call createSsrfGuardedMcpFetch() with no args → default 30s; behavior for healthy servers (each leg completes in well under a second) is unchanged. A caller-supplied AbortSignal is composed, not replaced. 30s mirrors the existing DEFAULT_CONNECTION_TIMEOUT precedent; only pathologically slow (>30s/leg) servers change from "eventually/never" to a fast, actionable error. Type of Change Bug fix Testing Tested manually + unit tests. Added coverage: signal is always attached, deadline surfaces an McpError, and a caller abort propagates unchanged (composed with the deadline). Full lib/mcp + app/api/mcp suite: 429 passing. Lint + typecheck clean. Checklist Code follows project style guidelines Self-reviewed my changes Tests added/updated and passing No new warnings introduced I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)
Open Graph Description: Summary MCP OAuth (app.withgauge.com/mcp and others) can leave /oauth/start hanging for minutes, stranding the UI on "Connecting…". Root cause: the MCP SDK issues OAuth discovery / dynam...
X Description: Summary MCP OAuth (app.withgauge.com/mcp and others) can leave /oauth/start hanging for minutes, stranding the UI on "Connecting…". Root cause: the MCP SDK issues OAuth discovery...
Opengraph URL: https://github.com/simstudioai/sim/pull/5776
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:1f50b303-b74b-4e91-5e36-86009d4a14d1 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 8632:F27A1:C3EB0D:1189B1F:6A632B38 |
| html-safe-nonce | 0ea0ccc4507bc5cfd5a6c1a3d1a944afe185ff410f9cea23f00618c39c9f0412 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI4NjMyOkYyN0ExOkMzRUIwRDoxMTg5QjFGOjZBNjMyQjM4IiwidmlzaXRvcl9pZCI6IjYyNTMxMDAyMTcyNTQ3NTEwMzMiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | beac87ad16c5e94c61afd135ed29e5a2407ead9f42bff54dcf7b895aedd4e5eb |
| hovercard-subject-tag | pull_request:4094511465 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/simstudioai/sim/pull/5776/files |
| twitter:image | https://avatars.githubusercontent.com/u/40672544?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/40672544?s=400&v=4 |
| og:image:alt | Summary MCP OAuth (app.withgauge.com/mcp and others) can leave /oauth/start hanging for minutes, stranding the UI on "Connecting…". Root cause: the MCP SDK issues OAuth discovery / dynam... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 30c644d502bce6cd2e59f9000b4744f2b64819abea8e8f959b18e3ad793125aa |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/simstudioai/sim git https://github.com/simstudioai/sim.git |
| octolytics-dimension-user_id | 199344406 |
| octolytics-dimension-user_login | simstudioai |
| octolytics-dimension-repository_id | 912559512 |
| octolytics-dimension-repository_nwo | simstudioai/sim |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 912559512 |
| octolytics-dimension-repository_network_root_nwo | simstudioai/sim |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 331492a48ebd91d66ef2de38e1901bb911c9fe9b |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width