Skip to content

fix(den): standardize external MCP OAuth on enterprise client - #2810

Merged
reachjalil merged 10 commits into
different-ai:devfrom
reachjalil:feature/dual-engine-mcp-oauth
Jul 15, 2026
Merged

fix(den): standardize external MCP OAuth on enterprise client#2810
reachjalil merged 10 commits into
different-ai:devfrom
reachjalil:feature/dual-engine-mcp-oauth

Conversation

@reachjalil

@reachjalil reachjalil commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

What changes from dev

dev already has Den-managed external MCP connections, shared and per-connection callback routes, connection editing, and non-destructive Disconnect. This PR makes these specific changes:

  1. One supported runtime: Den always uses @openwork/enterprise-mcp-client for remote MCP discovery, OAuth, refresh, tool listing, and tool calls. It removes the environment flag, organization engine setting, runtime toggle, and legacy runtime selection.
  2. Automatic callback compatibility: new OAuth connections use the deployment-wide shared callback. Existing connections keep their stored callback mode and reconnect with the exact callback already registered at the provider. There is no credential rewrite, migration/revert endpoint, or migration UI.
  3. Standards-compatible OAuth discovery: a protected-resource discovery URL is accepted as a constrained alias only when resource and authorization-server metadata bind it to the canonical issuer. The canonical issuer is still enforced during authorization and callback validation.
  4. Correct scope fallback: provider-advertised scopes are used only when neither the authentication challenge nor saved configuration supplies a narrower scope.
  5. Simpler pre-registered OAuth setup: add/edit forms link to deployment-specific redirect URL documentation before creation. The connection cards and creation flow no longer repeat callback or client-metadata URLs, and administrators can add or replace client credentials through Edit.
  6. Cleaner OAuth completion: successful callbacks show a simple connected confirmation with a Close window action. They no longer trigger the browser prompt to open the OpenWork desktop app.
  7. Focused connection actions: the row keeps Connect and Disconnect as contextual primary actions. For individual accounts, Connect uses the current member status while Disconnect reflects organization-level connected accounts, so both can appear when appropriate. Edit, View tools, and Remove live in the three-dot menu. The Refresh tools action is kept on one line.

New version-two OAuth transactions use the enterprise package. Version-one transactions already in flight can finish through their original verifier only for the existing ten-minute state lifetime.

Review map

  • Runtime selection: ee/apps/den-api/src/capability-sources/external-mcp-client-runtime.ts
  • Callback policy and routes: ee/apps/den-api/src/capability-sources/external-mcp-connections.ts and ee/apps/den-api/src/routes/org/mcp-connections.ts
  • OAuth callback completion: ee/apps/den-api/src/capability-sources/oauth-callback-page.ts
  • OAuth metadata/issuer binding: packages/enterprise-mcp-client/src/oauth-discovery-binding.ts
  • Authorization and scope behavior: packages/enterprise-mcp-client/src/authorization-response.ts, oauth-provider.ts, and requirements-discovery.ts
  • Setup and connection UX: ee/apps/den-web/app/(den)/dashboard/_components/mcp-connections-screen.tsx
  • Redirect documentation: packages/docs/cloud/share-with-your-team/shared-mcp-connections.mdx

Current dev sync

The branch includes upstream/dev through 480dcfbf (feat(den): support non-destructive MCP disconnect). Its admin/member Disconnect behavior, creator attribution, API changes, and tests are retained. At publication, the branch is 0 commits behind upstream/dev.

Validation

  • @openwork/enterprise-mcp-client: 36 tests passed; package build passed.
  • Den API and Den Web typechecks passed.
  • Current focused Den Web OAuth/layout checks: 8 passed.
  • Focused Den API connection/OAuth/edit/disconnect checks: 30 passed.
  • OAuth callback completion page check passed.
  • Manual callback compatibility: both callback modes were exercised without deleting the connection or losing credentials. The final PR preserves the stored mode automatically and contains no migration/revert controls.
  • Manual pre-registered OAuth flow: the shared callback was registered with a live provider and reconnect completed successfully after provider configuration propagated.
  • GitHub checks will rerun for the latest pushed revision.

Scope

This changes only Den-managed OpenWork Connect. Local/direct engine MCP and the engine-to-Den meta-MCP are unchanged. The implementation and tests follow MCP/OAuth metadata contracts and contain no provider-specific runtime branch. Optional Vercel previews can report authorization-required because the fork cannot deploy to the upstream Different AI project; that is not a code-test failure.

@vercel

vercel Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
openwork-landing Ready Ready Preview, Comment, Open in v0 Jul 15, 2026 10:41pm

@vercel

vercel Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

@reachjalil
reachjalil marked this pull request as ready for review July 15, 2026 20:36
@reachjalil reachjalil changed the title fix(den): make enterprise MCP OAuth opt-in and recoverable fix(den): simplify enterprise MCP OAuth with callback compatibility Jul 15, 2026
@reachjalil
Merge remote-tracking branch 'upstream/dev' into feature/dual-engine-…
9f65eda 
…mcp-oauth

# Conflicts:
#	ee/apps/den-api/src/routes/org/mcp-connections.ts
#	ee/apps/den-web/app/(den)/dashboard/_components/mcp-connections-screen.tsx
@reachjalil reachjalil changed the title fix(den): simplify enterprise MCP OAuth with callback compatibility fix(den): standardize external MCP OAuth on enterprise client Jul 15, 2026
@reachjalil
reachjalil merged commit 2b72a99 into different-ai:dev Jul 15, 2026
13 of 17 checks passed
@reachjalil
reachjalil deleted the feature/dual-engine-mcp-oauth branch July 15, 2026 22:56
This was referenced Jul 16, 2026
Merged
Merged
@benjaminshafii benjaminshafii mentioned this pull request Jul 25, 2026
Merged
benjaminshafii added a commit that referenced this pull request Jul 25, 2026
@benjaminshafii
fix(den): restore the external MCP tool-call budget on the live clien…
34cbd65 
…t path (#3122)

An external MCP capability got 30s for the whole session -- connect, OAuth
refresh, initialize and tools/call shared one budget -- and execute_capability
spent that budget twice, once for schema-digest discovery and once for the
call. Slow providers died at ~31s.

The 120s/150s tool budget from #2750 was never reached. #2810 deleted the
legacy runtime, so callExternalMcpTool resolves to the enterprise client, and
the adapter's tool-call path forwarded no lifecycle deadline -- unlike
listExternalMcpTools beside it -- leaving the package's 30s default in charge.
A Math.min(operationTimeoutMs, ...) clamp meant injecting the longer deadline
would have been clipped back to 30s anyway. The only test asserting 120s
exercised the bypassed file.

Make an injected lifecycle deadline authoritative in both directions and
demote operationTimeoutMs to the fallback default. Forward the deadline on the
tool-call path, and share one deadline between discovery and the call so the
handshake and the budget are paid once. Split the per-request timeout from the
absolute bound and stop cancelling a provider that is still reporting
progress, matching the calling harness instead of being stricter than it; the
SDK only attaches a progressToken when an onprogress handler is present, so
the flag alone was inert.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@reachjalil