feat(platform): support static API-key/bearer-token auth for MCP servers by Abhi1992002 · Pull Request #13683 · Significant-Gravitas/AutoGPT

Abhi1992002 · 2026-07-27T08:22:48Z

Why / What / How

Why: Some MCP servers (e.g. DataFast) authenticate with a static bearer token / API key issued in the vendor's own dashboard, not a full OAuth2 authorize/token exchange. The MCP tool block only advertised oauth2 credentials, and — critically — the graph builder's "Connect to MCP Server" dialog used a manually-entered token only for tool discovery and never persisted it. The placed block therefore ran with no credentials and failed with a 401 at execution time. (Linear: REQ-115)

What: Make static API-key / bearer-token a first-class credential type for MCP server connections, entered via the builder's secure credential dialog, and stored as a proper api_key credential the block uses at runtime.

How:

MCPToolBlock now advertises both oauth2 and api_key credential types and accepts either at runtime — the bearer token is pulled from access_token (OAuth2) or api_key (API key) via a single shared mcp_auth_token() helper.
POST /api/v2/mcp/token now stores the token as a first-class APIKeyCredentials (type api_key) instead of masquerading it as an OAuth2Credentials.
Backward compatible: credential lookup, cleanup, and get_host now match both oauth2 and api_key MCP credentials by server URL, so tokens already stored under the old (OAuth2-masquerade) shape keep working.
The builder MCP dialog now offers proactive "Use an API key / bearer token instead" entry (no failed-OAuth round-trip required), persists the token via /mcp/token, and attaches the returned credential to the block node.
The frontend credential classifier matches api_key MCP credentials by host, same as OAuth2.

The copilot (run_mcp_tool + MCPSetupCard) bearer-token flow already worked; this PR reuses the same /token endpoint and brings the builder to parity.

Changes 🏗️

Backend

blocks/mcp/block.py — widen MCPCredentials to Literal["oauth2", "api_key"]; run() accepts OAuth2Credentials | APIKeyCredentials; token extracted via mcp_auth_token().
blocks/mcp/helpers.py — add mcp_auth_token(), is_mcp_credential_for_server(), MCPCredential union; auto_lookup_mcp_credential() matches both credential types (OAuth2-only refresh_if_needed still guarded).
api/features/mcp/routes.py — /token stores APIKeyCredentials; discovery token extraction and old-credential cleanup (both /token and OAuth callback) cover both types.
api/features/integrations/router.py — get_host() returns the MCP server URL for APIKeyCredentials too.
copilot/tools/run_mcp_tool.py — token extraction via the shared helper.

Frontend

build/components/MCPToolDialog.tsx — proactive API-key entry; persist the token via /mcp/token on successful discovery and attach the credential to the node.
hooks/useCredentials.ts — classifyCredentials matches api_key MCP credentials by host.

Tests — backend: helper token extraction + both-type matching, block run() with APIKeyCredentials, /token stores api_key + cleans up legacy OAuth2 and api_key rows. Frontend: dialog persists+attaches the token (and does not for public servers), classifier matches api_key MCP creds.

Checklist 📋

For code changes:

I have clearly listed my changes in the PR description
I have made a test plan
I have tested my changes according to the test plan:
- poetry run pytest backend/blocks/mcp backend/api/features/mcp/test_routes.py backend/copilot/tools/test_run_mcp_tool.py — all pass
- pnpm test:unit for MCPToolDialog.test.tsx and classifyCredentials.test.ts — all pass
- poetry run format, poetry run lint, pnpm lint, pnpm types — clean
- Manual: in the builder, add the MCP Tool block, enter a bearer-token-only server URL, choose "Use an API key / bearer token instead", paste a token, add the block, and run it — the tool executes (no 401)

Some MCP servers (e.g. DataFast) authenticate with a static bearer token issued in the vendor's dashboard rather than a full OAuth2 flow. The MCP tool block only advertised `oauth2` credentials, and the builder dialog used a manually-entered token for tool discovery but never persisted it — so the placed block ran with no credentials and 401'd at runtime. - MCPToolBlock now advertises both `oauth2` and `api_key` credential types and accepts either at runtime (token pulled from access_token or api_key). - The /mcp/token endpoint stores the token as a first-class APIKeyCredentials instead of masquerading it as an OAuth2 token; lookup, cleanup and get_host handle both types so existing OAuth-typed tokens keep working. - The builder MCP dialog offers proactive API-key entry and persists the token via /mcp/token, attaching the credential to the block node. - Frontend credential classifier matches api_key MCP credentials by host.

…o-fill _credential_is_for_mcp_server only matched OAuth2Credentials, so MCP tokens now stored as APIKeyCredentials would be reported missing when copilot auto-fills a graph's required credentials. Match both credential types. Also improve the builder MCP dialog: a rejected manual token now shows a clear "authentication failed — check your token" message instead of bouncing the user into an OAuth flow that will fail again.

Abhi1992002 · 2026-07-27T08:23:00Z

/review

autogpt-pr-reviewer · 2026-07-27T08:23:09Z

Queued a review for PR #13683 at e49151e.

coderabbitai · 2026-07-27T08:23:20Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

MCP credential handling now supports OAuth2 and API-key bearer credentials across backend storage, lookup, tool execution, copilot utilities, and frontend discovery. Manual tokens are persisted as API-key credentials and matched by normalized MCP server URL.

Changes

MCP credential abstraction

Layer / File(s)	Summary
Shared credential abstraction `autogpt_platform/backend/backend/blocks/mcp/`, `autogpt_platform/backend/backend/copilot/tools/`	MCP helpers and consumers extract tokens, match servers, select credentials, and execute tools with OAuth2 or API-key credentials.
Credential matching and behavior validation `autogpt_platform/backend/backend/blocks/mcp/test_`, `autogpt_platform/backend/backend/copilot/tools/_test.py`, `autogpt_platform/frontend/src/hooks/*`, `autogpt_platform/frontend/src/components/contextual/...`	Tests cover token extraction, URL normalization, API-key execution, credential classification, and host-specific lookup.

Backend credential storage

Layer / File(s)	Summary
Backend storage and replacement `autogpt_platform/backend/backend/api/features/mcp/*`, `autogpt_platform/backend/backend/api/features/integrations/router.py`	MCP routes store manual tokens as `APIKeyCredentials`, replace matching credentials, and return standardized metadata.

Frontend manual-token flow

Layer / File(s)	Summary
Frontend manual-token flow `autogpt_platform/frontend/src/app/(platform)/build/components/*`	The dialog supports manual bearer tokens during discovery, persists accepted tokens, reports rejected tokens without OAuth escalation, and validates token-storage failures.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPToolDialog
  participant mcp_store_token
  participant CredentialsStore
  participant MCPToolBlock
  MCPToolDialog->>mcp_store_token: submit bearer token and server URL
  mcp_store_token->>CredentialsStore: store APIKeyCredentials
  CredentialsStore-->>mcp_store_token: return credential metadata
  MCPToolDialog->>MCPToolBlock: confirm tool with credential metadata
  MCPToolBlock->>CredentialsStore: resolve MCP credential
  CredentialsStore-->>MCPToolBlock: return API-key or OAuth2 credential

Suggested reviewers: 0ubbe, kcze

Poem

A rabbit hops with tokens bright,
OAuth and keys now share the night.
Servers match by URL’s trail,
Tools receive the proper hail.
“Connect!” the carrot banners say.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding static API-key/bearer-token auth support for MCP servers.
Description check	✅ Passed	The description is directly related to the changeset and accurately explains the feature, implementation, and test plan.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch req-115

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

autogpt_platform/frontend/src/hooks/useCredentials.ts (1)
30-36: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Normalize MCP URLs before matching credentials.

mcp_store_token persists a normalized URL, while the block discriminator can retain a trailing slash. Exact comparison then hides a valid saved credential for https://server/mcp/. Normalize both values before comparing and add a trailing-slash test.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@autogpt_platform/frontend/src/hooks/useCredentials.ts` around lines 30 - 36,
Update the MCP credential matching logic in the credentials hook to normalize
both c.host and discriminatorValue before comparison, removing trailing slashes
so equivalent URLs match. Preserve the existing null guard and credential
collection behavior, and add a test covering a discriminator URL with a trailing
slash matching the normalized saved URL.
autogpt_platform/frontend/src/app/(platform)/build/components/MCPToolDialog.tsx (1)
143-164: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use unknown for the caught error.

Replace catch (e: any) with catch (e: unknown) and narrow before reading status, message, or detail; any disables type checking and conflicts with the frontend guideline to avoid any.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@autogpt_platform/frontend/src/app/`(platform)/build/components/MCPToolDialog.tsx
around lines 143 - 164, Update the catch block in the MCP tool connection flow
to use catch (e: unknown) instead of any. Narrow e before accessing status,
message, or detail, while preserving the existing 401/403 authentication
handling and fallback error message behavior.
Source: Coding guidelines

🧹 Nitpick comments (1)

autogpt_platform/frontend/src/app/(platform)/build/components/MCPToolDialog.tsx (1)
340-345: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the manual dark-mode overrides.

These controls use dark: classes even though the design system owns dark-mode styling. Use semantic design-system styling instead.

As per coding guidelines, “No dark: Tailwind classes — the design system handles dark mode.”

Also applies to: 355-363
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@autogpt_platform/frontend/src/app/`(platform)/build/components/MCPToolDialog.tsx
around lines 340 - 345, Remove the dark: Tailwind classes from the manual token
toggle button and the related controls near it, including dark:text-gray-400 and
dark:hover:text-gray-300. Preserve the existing semantic text, underline, hover,
and layout styling while relying on the design system for dark-mode behavior.
Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@autogpt_platform/backend/backend/api/features/mcp/routes.py`:
- Around line 369-377: Make MCP credential replacement atomic in routes.py at
lines 369-377 and 443-473: update both OAuth and static-token flows to use the
same store-level atomic replace/create operation, passing the server-matching
criteria and new credential together. Remove the separate read/delete or
ID-collection steps so concurrent submissions cannot retain duplicate
credentials.

In `@autogpt_platform/backend/backend/blocks/mcp/helpers.py`:
- Around line 163-177: Update the credential selection loop around
_mcp_credential_expiry so expired credentials cannot outrank valid non-expiring
credentials. Rank matching credentials by not-expired status first, then use the
existing iteration-order recency tiebreaker; preserve the subsequent
refresh_if_needed handling for the selected OAuth2Credentials.

---

Outside diff comments:
In
`@autogpt_platform/frontend/src/app/`(platform)/build/components/MCPToolDialog.tsx:
- Around line 143-164: Update the catch block in the MCP tool connection flow to
use catch (e: unknown) instead of any. Narrow e before accessing status,
message, or detail, while preserving the existing 401/403 authentication
handling and fallback error message behavior.

In `@autogpt_platform/frontend/src/hooks/useCredentials.ts`:
- Around line 30-36: Update the MCP credential matching logic in the credentials
hook to normalize both c.host and discriminatorValue before comparison, removing
trailing slashes so equivalent URLs match. Preserve the existing null guard and
credential collection behavior, and add a test covering a discriminator URL with
a trailing slash matching the normalized saved URL.

---

Nitpick comments:
In
`@autogpt_platform/frontend/src/app/`(platform)/build/components/MCPToolDialog.tsx:
- Around line 340-345: Remove the dark: Tailwind classes from the manual token
toggle button and the related controls near it, including dark:text-gray-400 and
dark:hover:text-gray-300. Preserve the existing semantic text, underline, hover,
and layout styling while relying on the design system for dark-mode behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 46c793da-9a65-4d8b-886d-4c79fa2b85f4

📥 Commits

Reviewing files that changed from the base of the PR and between 6ccfa17 and e49151e.

📒 Files selected for processing (14)

autogpt_platform/backend/backend/api/features/integrations/router.py
autogpt_platform/backend/backend/api/features/mcp/routes.py
autogpt_platform/backend/backend/api/features/mcp/test_routes.py
autogpt_platform/backend/backend/blocks/mcp/block.py
autogpt_platform/backend/backend/blocks/mcp/helpers.py
autogpt_platform/backend/backend/blocks/mcp/test_helpers.py
autogpt_platform/backend/backend/blocks/mcp/test_mcp.py
autogpt_platform/backend/backend/copilot/tools/run_mcp_tool.py
autogpt_platform/backend/backend/copilot/tools/utils.py
autogpt_platform/backend/backend/copilot/tools/utils_test.py
autogpt_platform/frontend/src/app/(platform)/build/components/MCPToolDialog.tsx
autogpt_platform/frontend/src/app/(platform)/build/components/__tests__/MCPToolDialog.test.tsx
autogpt_platform/frontend/src/hooks/__tests__/classifyCredentials.test.ts
autogpt_platform/frontend/src/hooks/useCredentials.ts

codecov · 2026-07-27T08:31:37Z

Codecov Report

❌ Patch coverage is 94.25837% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.73%. Comparing base (bdc2b5f) to head (c3940db).
⚠️ Report is 31 commits behind head on dev.

❌ Your patch check has failed because the patch coverage (66.66%) is below the target coverage (70.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev   #13683      +/-   ##
==========================================
+ Coverage   76.64%   76.73%   +0.08%     
==========================================
  Files        2715     2715              
  Lines      207923   208100     +177     
  Branches    19947    19953       +6     
==========================================
+ Hits       159370   159680     +310     
+ Misses      44153    43996     -157     
- Partials     4400     4424      +24

Flag	Coverage Δ
platform-backend	`83.26% <99.43%> (+0.01%)`	⬆️
platform-frontend	`48.20% <68.75%> (+0.57%)`	⬆️
platform-frontend-e2e	`30.90% <6.66%> (-0.34%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Platform Backend	`83.26% <99.43%> (+0.01%)`	⬆️
Platform Frontend	`51.81% <66.66%> (+0.42%)`	⬆️
AutoGPT Libs	`∅ <ø> (∅)`
Classic AutoGPT	`28.43% <ø> (ø)`

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ht narrowing

…paths

…r msg - CredentialsGroupedView matchesDiscriminatorValues now filters api_key MCP credentials by host (like classifyCredentials); previously an api_key cred for one server matched every server, risking wrong auto-assignment + 401. - auto_lookup ranking prefers non-expiring credentials so a valid static bearer token is not shadowed by a stale row that once had an expiry. - MCPToolDialog shows a clear "saving your API token failed" message on a non-2xx /token response instead of throwing the raw body.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/__tests__/helpers.test.ts`:
- Around line 8-10: Rename the apiKeyCred helper to APIKeyCred and update every
call site in helpers.test.ts to use the capitalized acronym, preserving its
implementation and behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a03ee85b-0483-4cfe-b964-1bf022b87663

📥 Commits

Reviewing files that changed from the base of the PR and between 38f99ac and 28d2394.

📒 Files selected for processing (5)

autogpt_platform/backend/backend/blocks/mcp/helpers.py
autogpt_platform/frontend/src/app/(platform)/build/components/MCPToolDialog.tsx
autogpt_platform/frontend/src/app/(platform)/build/components/__tests__/MCPToolDialog.test.tsx
autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/__tests__/helpers.test.ts
autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/helpers.ts

🚧 Files skipped from review as they are similar to previous changes (3)

autogpt_platform/frontend/src/app/(platform)/build/components/tests/MCPToolDialog.test.tsx
autogpt_platform/backend/backend/blocks/mcp/helpers.py
autogpt_platform/frontend/src/app/(platform)/build/components/MCPToolDialog.tsx

📜 Review details

⏰ Context from checks skipped due to timeout. (18)

GitHub Check: integration_test
GitHub Check: lint
GitHub Check: check API types
GitHub Check: Seer Code Review
GitHub Check: lint
GitHub Check: types
GitHub Check: test (3.12)
GitHub Check: type-check (3.13)
GitHub Check: test (3.13)
GitHub Check: type-check (3.12)
GitHub Check: type-check (3.11)
GitHub Check: test (3.11)
GitHub Check: lint
GitHub Check: end-to-end tests
GitHub Check: Analyze (python)
GitHub Check: Check PR Status
GitHub Check: check-docs-sync
GitHub Check: Analyze (typescript)

🧰 Additional context used

📓 Path-based instructions (13)

autogpt_platform/frontend/**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

autogpt_platform/frontend/**/*.{ts,tsx,js,jsx}: Use Node.js 21+ with pnpm package manager for frontend development
Always run 'pnpm format' for formatting and linting code in frontend development

Format frontend code using pnpm format

autogpt_platform/frontend/**/*.{ts,tsx,js,jsx}: Fully capitalize acronyms in symbols, e.g. graphID, useBackendAPI
No linter suppressors (// @ts-ignore``, // eslint-disable) — fix the actual issue

Files:

autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/__tests__/helpers.test.ts
autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/helpers.ts

autogpt_platform/frontend/**/*.{tsx,ts}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

autogpt_platform/frontend/**/*.{tsx,ts}: Use function declarations for components and handlers (not arrow functions) in React components
Only use arrow functions for small inline lambdas (map, filter, etc.) in React components
Use PascalCase for component names and camelCase with 'use' prefix for hook names in React
Use Tailwind CSS utilities only for styling in frontend components
Use design system components from 'src/components/' (atoms, molecules, organisms) in frontend development
Never use 'src/components/legacy/' in frontend code
Only use Phosphor Icons (@phosphor-icons/react) for icons in frontend components
Use generated API hooks from '@/app/api/__generated__/endpoints/' instead of deprecated 'BackendAPI' or 'src/lib/autogpt-server-api/'
Use React Query for server state (via generated hooks) in frontend development
Default to client components ('use client') in Next.js; only use server components for SEO or extreme TTFB needs
Use '' component for rendering errors in frontend UI; use toast notifications for mutation errors; use 'Sentry.captureException()' for manual exceptions
Separate render logic from data/behavior in React components; keep comments minimal (code should be self-documenting)

Files:

autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/__tests__/helpers.test.ts
autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/helpers.ts

autogpt_platform/frontend/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

autogpt_platform/frontend/**/*.{ts,tsx}: No barrel files or 'index.ts' re-exports in frontend code
Regenerate API hooks with 'pnpm generate:api' after backend OpenAPI spec changes in frontend development

autogpt_platform/frontend/**/*.{ts,tsx}: Use function declarations (not arrow functions) for components/handlers
No any types unless the value genuinely can be anything
Keep render functions and hooks under ~50 lines; extract named helpers or sub-components when they grow longer

Files:

autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/__tests__/helpers.test.ts
autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/helpers.ts

autogpt_platform/frontend/src/components/**/*.{tsx,ts}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Structure React components as: ComponentName/ComponentName.tsx + useComponentName.ts + helpers.ts (exception: small 3-4 line components can be inline; render-only components can be direct files)

Files:

autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/__tests__/helpers.test.ts
autogpt_platform/frontend/src/components/contextual/CredentialsInput/components/CredentialsGroupedView/helpers.ts

autogpt_platform/frontend/src/components/**/*.{ts,tsx}