Skip to content

fix(connect): extend external MCP tool timeout - #2750

Merged
reachjalil merged 1 commit into
different-ai:devfrom
reachjalil:codex/dev-agent-diagnostics-verify
Jul 14, 2026
Merged

fix(connect): extend external MCP tool timeout#2750
reachjalil merged 1 commit into
different-ai:devfrom
reachjalil:codex/dev-agent-diagnostics-verify

Conversation

@reachjalil

Copy link
Copy Markdown
Collaborator

Summary

  • extend external MCP tool execution requests from 30 seconds to 120 seconds
  • give initialize-plus-tool execution a bounded 150-second lifecycle
  • keep initialization, discovery, SSRF, response-size, and catalog protections unchanged

Root cause

Long-running provider tools, including ServiceNow incident summarization, could exceed OpenWork's 30-second Den-side request limit even after authentication and MCP initialization succeeded.

Impact

External MCP tools can complete longer operations without weakening the existing connection and payload safety limits.

Validation

  • pnpm exec bun test ee/apps/den-api/test/external-mcp-diagnostics.test.ts -t "allows tool execution to use a longer bounded request timeout"
  • result: 1 passed, 0 failed

Full Den API and end-to-end provider suites were not run.

@vercel

vercel Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
openwork-landing Ready Ready Preview, Comment, Open in v0 Jul 14, 2026 5:28pm
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
openwork-diagnostics Skipped Skipped Jul 14, 2026 5:28pm

@vercel
vercel Bot temporarily deployed to Preview – openwork-diagnostics July 14, 2026 17:27 Inactive
@vercel

vercel Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

@reachjalil
reachjalil merged commit 152a0c2 into different-ai:dev Jul 14, 2026
12 of 15 checks passed
@reachjalil
reachjalil deleted the codex/dev-agent-diagnostics-verify branch July 17, 2026 07:06
benjaminshafii added a commit that referenced this pull request Jul 25, 2026
…t path (#3122)

An external MCP capability got 30s for the whole session -- connect, OAuth
refresh, initialize and tools/call shared one budget -- and execute_capability
spent that budget twice, once for schema-digest discovery and once for the
call. Slow providers died at ~31s.

The 120s/150s tool budget from #2750 was never reached. #2810 deleted the
legacy runtime, so callExternalMcpTool resolves to the enterprise client, and
the adapter's tool-call path forwarded no lifecycle deadline -- unlike
listExternalMcpTools beside it -- leaving the package's 30s default in charge.
A Math.min(operationTimeoutMs, ...) clamp meant injecting the longer deadline
would have been clipped back to 30s anyway. The only test asserting 120s
exercised the bypassed file.

Make an injected lifecycle deadline authoritative in both directions and
demote operationTimeoutMs to the fallback default. Forward the deadline on the
tool-call path, and share one deadline between discovery and the call so the
handshake and the budget are paid once. Split the per-request timeout from the
absolute bound and stop cancelling a provider that is still reporting
progress, matching the calling harness instead of being stricter than it; the
SDK only attaches a progressToken when an onprogress handler is present, so
the flag alone was inert.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant