fix(mcp): recover rotated credentials on discovery via shared fetchServerTools auth-retry

Author: waleedlatif1

apps/sim/lib/mcp/service.test.ts

@@ -341,7 +341,7 @@ describe('McpService.discoverTools per-server caching', () => {
         statusConfig: { consecutiveFailures: 0, lastSuccessfulDiscovery: null },
       }),
     ])
-    mockListTools.mockRejectedValueOnce(
+    mockListTools.mockRejectedValue(
       new UnauthorizedError(`Rejected Authorization: ${reflectedCredential}`)
     )
 
@@ -491,7 +491,7 @@ describe('McpService.discoverTools per-server caching', () => {
         statusConfig: { consecutiveFailures: 0, lastSuccessfulDiscovery: null },
       }),
     ])
-    mockListTools.mockRejectedValueOnce(
+    mockListTools.mockRejectedValue(
       new UnauthorizedError(`Rejected Authorization: ${reflectedCredential}`)
     )
 
@@ -517,6 +517,19 @@ describe('McpService.discoverTools per-server caching', () => {
     expect(mockListTools).not.toHaveBeenCalled()
   })
 
+  it('recovers a rotated headers-auth credential via a single discovery retry', async () => {
+    mockGetWorkspaceServersRows.mockResolvedValue([dbRow('mcp-a', 'A')])
+    // Stale key 401s once, then the retry re-resolves and succeeds.
+    mockListTools
+      .mockRejectedValueOnce(new UnauthorizedError('stale key'))
+      .mockResolvedValueOnce([tool('a1', 'mcp-a')])
+
+    const tools = await mcpService.discoverServerTools(USER_ID, 'mcp-a', WORKSPACE_ID)
+
+    expect(tools).toHaveLength(1)
+    expect(mockListTools).toHaveBeenCalledTimes(2)
+  })
+
   it('keeps per-server UnauthorizedError soft-pending for OAuth auth', async () => {
     mockGetWorkspaceServersRows.mockResolvedValue([dbRow('mcp-a', 'A', { authType: 'oauth' })])
     mockResolveEnvVars.mockRejectedValue(new UnauthorizedError('OAuth token rejected'))

apps/sim/lib/mcp/service.ts

@@ -372,6 +372,36 @@ class McpService {
     }
   }
 
+  /**
+   * Pooled `tools/list` for one server, with a single retry on a non-OAuth auth
+   * failure: a rotated header key throws 401, which retires the pooled connection,
+   * so the retry re-acquires a fresh one that re-resolves the credential. (OAuth
+   * 401s are left to the caller's oauth-pending handling.) `listTools` is
+   * idempotent, so the retry is always safe.
+   */
+  private async fetchServerTools(
+    config: McpServerConfig,
+    userId: string,
+    workspaceId: string
+  ): Promise<McpTool[]> {
+    for (let attempt = 0; ; attempt++) {
+      try {
+        return await this.withServerClient(
+          {
+            key: this.poolKey(config.id, workspaceId, userId),
+            serverId: config.id,
+            allowPool: true,
+          },
+          this.buildClient(config, userId, workspaceId),
+          (client) => client.listTools()
+        )
+      } catch (error) {
+        if (attempt === 0 && isAuthError(error) && config.authType !== 'oauth') continue
+        throw error
+      }
+    }
+  }
+
   /**
    * Run `fn` against a connected client. When `allowPool`, borrow from the warm
    * pool (`create` runs only on a miss, so a hit skips env resolution + DNS); a
@@ -676,15 +706,7 @@ class McpService {
           }
 
           try {
-            const tools = await this.withServerClient(
-              {
-                key: this.poolKey(config.id, workspaceId, userId),
-                serverId: config.id,
-                allowPool: true,
-              },
-              this.buildClient(config, userId, workspaceId),
-              (client) => client.listTools()
-            )
+            const tools = await this.fetchServerTools(config, userId, workspaceId)
             logger.debug(
               `[${requestId}] Discovered ${tools.length} tools from server ${config.name}`
             )
@@ -889,15 +911,7 @@ class McpService {
         }
         authType = config.authType
 
-        const tools = await this.withServerClient(
-          {
-            key: this.poolKey(serverId, workspaceId, userId),
-            serverId,
-            allowPool: true,
-          },
-          this.buildClient(config, userId, workspaceId),
-          (client) => client.listTools()
-        )
+        const tools = await this.fetchServerTools(config, userId, workspaceId)
         logger.info(`[${requestId}] Discovered ${tools.length} tools from server ${config.name}`)
         await Promise.allSettled([
           this.cacheAdapter
@@ -957,15 +971,7 @@ class McpService {
 
       for (const config of servers) {
         try {
-          const tools = await this.withServerClient(
-            {
-              key: this.poolKey(config.id, workspaceId, userId),
-              serverId: config.id,
-              allowPool: true,
-            },
-            this.buildClient(config, userId, workspaceId),
-            (client) => client.listTools()
-          )
+          const tools = await this.fetchServerTools(config, userId, workspaceId)
 
           summaries.push({
             id: config.id,