Skip to content

[pull] main from danny-avila:main - #268

Merged
pull[bot] merged 1 commit into
innFactory:mainfrom
danny-avila:main
Sep 17, 2026
Merged

pull[bot] merged 1 commit into
innFactory:mainfrom
danny-avila:main

Conversation

@pull

@pull pull Bot commented Sep 17, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

* fix: Resolve live OpenID bearer before the MCP early domain gate

* fix: Drop unread credentials from the MCP early domain gate

The early domain gate resolves the whole server config through
`processMCPEnv`, but decides from the URL alone. A credential placeholder in
any other field therefore raised `OpenIDReauthRequiredError` from a stale
request-time OpenID snapshot, before the connection path could refresh that
bearer, and the tool was dropped from the agent's toolset.

`buildMCPDomainValidationConfig` narrows the config to what the decision reads,
so the gate needs no live credential. A URL placeholder still fails closed, and
the argument is never mutated, so direct-bearer recovery keeps the placeholder
it knows how to refresh.

Replaces the per-tool `upstreamTokenProvider` call the gate would otherwise
make (1 + N per request per server) and covers every credential-bearing field,
not only `Authorization`.

Co-authored-by: Artyom Bogachenko <SpectralOne@users.noreply.github.com>

---------

Co-authored-by: Lia <lia@librechat.ai>
Co-authored-by: Artyom Bogachenko <SpectralOne@users.noreply.github.com>
@pull pull Bot locked and limited conversation to collaborators Sep 17, 2026
@pull pull Bot added the ⤵️ pull label Sep 17, 2026
@pull
pull Bot merged commit 12d7890 into innFactory:main Sep 17, 2026
5 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant