fix: dedupe function env vars (#772)

fixes AGE-828

fixes potentially duplicate env vars from functions in the UX and MCP
config

- Ensures we don't return duplicated env vars more the same function.
- If there happened to be an env var for http tools and functions in the
same toolset ensures we don't duplicate the UX on it. We will still
return the data so both fields are accurate.

Author: ryan-timothy-albert

.changeset/sad-flies-clap.md

@@ -0,0 +1,6 @@
+---
+"dashboard": patch
+"server": patch
+---
+
+fixes potentially duplicate env vars from functions in the UX and MCP config

client/dashboard/src/hooks/useToolsetEnvVars.ts

@@ -0,0 +1,31 @@
+import { useMemo } from "react";
+
+import { Toolset } from "@/lib/toolTypes";
+import { ToolsetEntry } from "@gram/client/models/components";
+
+type ToolsetLike = (Toolset | ToolsetEntry) | undefined;
+
+export function useToolsetEnvVars(
+  toolset: ToolsetLike,
+  requiresServerURL: boolean,
+): string[] {
+  return useMemo(() => {
+    if (!toolset) return [];
+
+    const securityVars =
+      toolset.securityVariables?.flatMap((secVar) => secVar.envVariables) ?? [];
+
+    const functionEnvVars =
+      toolset.functionEnvironmentVariables?.map((fnVar) => fnVar.name) ?? [];
+
+    const serverVars =
+      toolset.serverVariables?.flatMap((serverVar) =>
+        serverVar.envVariables.filter((envVar) => {
+          if (requiresServerURL) return true;
+          return !envVar.toLowerCase().includes("server_url");
+        }),
+      ) ?? [];
+
+    return [...new Set([...securityVars, ...serverVars, ...functionEnvVars])];
+  }, [toolset, requiresServerURL]);
+}

client/dashboard/src/pages/mcp/MCPDetails.tsx

@@ -19,6 +19,7 @@ import { useProject, useSession } from "@/contexts/Auth";
 import { useSdkClient } from "@/contexts/Sdk";
 import { useTelemetry } from "@/contexts/Telemetry";
 import { useListTools, useToolset } from "@/hooks/toolTypes";
+import { useToolsetEnvVars } from "@/hooks/useToolsetEnvVars";
 import { isHttpTool, Toolset } from "@/lib/toolTypes";
 import { cn, getServerURL } from "@/lib/utils";
 import { useRoutes } from "@/routes";
@@ -668,31 +669,19 @@ export const useMcpConfigs = (toolset: ToolsetEntry | undefined) => {
   const { url: mcpUrl } = useMcpUrl(toolset);
   const { data: tools } = useListTools();
 
-  if (!toolset) return { public: "", internal: "" };
+  const toolsetTools = toolset
+    ? tools?.tools.filter((tool) => toolset.tools.some((t) => t.id === tool.id))
+    : undefined;
 
-  const toolsetTools = tools?.tools.filter((tool) =>
-    toolset.tools.some((t) => t.id === tool.id),
-  );
-  const requiresServerURL = toolsetTools?.some(
-    (tool) => isHttpTool(tool) && !tool.defaultServerUrl,
+  const requiresServerURL =
+    toolsetTools?.some((tool) => isHttpTool(tool) && !tool.defaultServerUrl) ??
+    false;
+
+  const envHeaders = useToolsetEnvVars(toolset, requiresServerURL).filter(
+    (header) => !header.toLowerCase().includes("token_url"),
   );
 
-  const envHeaders: string[] = [
-    // Security variables (exclude token_url)
-    ...(toolset.securityVariables?.flatMap((secVar) =>
-      secVar.envVariables.filter(
-        (v) => !v.toLowerCase().includes("token_url"), // direct token url is always a hidden option right now
-      ),
-    ) ?? []),
-    // Function environment variables
-    ...(toolset.functionEnvironmentVariables?.map((fnVar) => fnVar.name) ?? []),
-    // Server variables (filter server_url unless required)
-    ...(toolset.serverVariables?.flatMap((serverVar) =>
-      serverVar.envVariables.filter(
-        (v) => !v.toLowerCase().includes("server_url") || requiresServerURL,
-      ),
-    ) ?? []),
-  ];
+  if (!toolset) return { public: "", internal: "" };
 
   // Build the args array for public MCP config
   const mcpJsonPublicArgs = [

client/dashboard/src/pages/toolsets/ToolsetAuth.tsx

@@ -13,6 +13,7 @@ import { AlertCircle, Plus } from "lucide-react";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useEnvironments } from "../environments/Environments";
 import { EnvironmentSelector } from "./EnvironmentSelector";
+import { useToolsetEnvVars } from "@/hooks/useToolsetEnvVars";
 
 const PASSWORD_MASK = "••••••••";
 const SECRET_FIELD_INDICATORS = ["SECRET", "KEY"] as const;
@@ -143,30 +144,11 @@ export function ToolsetAuth({
     setSaveError(null);
   }, []);
 
-  const requiresServerURL = toolset.tools?.some(
-    (tool) => isHttpTool(tool) && !tool.defaultServerUrl,
-  );
-
-  const relevantEnvVars = useMemo(() => {
-    const securityVars =
-      toolset?.securityVariables?.flatMap((secVar) => secVar.envVariables) ??
-      [];
-    const serverVars =
-      toolset?.serverVariables?.flatMap((serverVar) =>
-        serverVar.envVariables.filter(
-          (v) => !v.toLowerCase().includes("server_url") || requiresServerURL,
-        ),
-      ) ?? [];
-    const functionEnvVars =
-      toolset?.functionEnvironmentVariables?.map((fnVar) => fnVar.name) ?? [];
+  const requiresServerURL =
+    toolset.tools?.some((tool) => isHttpTool(tool) && !tool.defaultServerUrl) ??
+    false;
 
-    return [...securityVars, ...serverVars, ...functionEnvVars];
-  }, [
-    toolset?.securityVariables,
-    toolset?.serverVariables,
-    toolset.functionEnvironmentVariables,
-    requiresServerURL,
-  ]);
+  const relevantEnvVars = useToolsetEnvVars(toolset, requiresServerURL);
 
   const environmentVariableInputs = useMemo(() => {
     return relevantEnvVars.map((varName) => {

client/dashboard/src/pages/toolsets/ToolsetAuthAlert.tsx

@@ -2,28 +2,7 @@ import { useMemo } from "react";
 import { Alert } from "@speakeasy-api/moonshine";
 import { useEnvironments } from "../environments/Environments";
 import { Toolset } from "@/lib/toolTypes";
-
-function useRelevantEnvVars(toolset: Toolset) {
-  return useMemo(() => {
-    const requiresServerURL = toolset.tools?.some(
-      (tool) => tool.type === "http" && !tool.defaultServerUrl,
-    );
-
-    const securityVars =
-      toolset?.securityVariables?.flatMap((secVar) => secVar.envVariables) ??
-      [];
-    const functionEnvironmentVariables =
-      toolset?.functionEnvironmentVariables?.map((fnVar) => fnVar.name) ?? [];
-    const serverVars =
-      toolset?.serverVariables?.flatMap((serverVar) =>
-        serverVar.envVariables.filter(
-          (v) => !v.toLowerCase().includes("server_url") || requiresServerURL,
-        ),
-      ) ?? [];
-
-    return [...securityVars, ...serverVars, ...functionEnvironmentVariables];
-  }, [toolset]);
-}
+import { useToolsetEnvVars } from "@/hooks/useToolsetEnvVars";
 
 // Types
 interface EnvironmentEntry {
@@ -89,7 +68,12 @@ function PlaygroundAuthAlert({
   onConfigureClick,
 }: PlaygroundAuthAlertProps) {
   const environments = useEnvironments();
-  const relevantEnvVars = useRelevantEnvVars(toolset);
+  const requiresServerURL =
+    toolset.tools?.some(
+      (tool) => tool.type === "http" && !tool.defaultServerUrl,
+    ) ?? false;
+
+  const relevantEnvVars = useToolsetEnvVars(toolset, requiresServerURL);
 
   const envSlug = environmentSlug ?? toolset.defaultEnvironmentSlug;
   const environment = environments.find((env) => env.slug === envSlug);
@@ -131,7 +115,12 @@ function ToolsetPageAuthAlert({
   onConfigureClick,
 }: ToolsetPageAuthAlertProps) {
   const environments = useEnvironments();
-  const relevantEnvVars = useRelevantEnvVars(toolset);
+  const requiresServerURL =
+    toolset.tools?.some(
+      (tool) => tool.type === "http" && !tool.defaultServerUrl,
+    ) ?? false;
+
+  const relevantEnvVars = useToolsetEnvVars(toolset, requiresServerURL);
 
   const hasAllRequiredVars = useMemo(() => {
     if (relevantEnvVars.length === 0) return true;

client/dashboard/src/pages/toolsets/ToolsetEnvironmentBadge.tsx

@@ -15,6 +15,7 @@ import { Check } from "lucide-react";
 import { useEnvironments } from "../environments/Environments";
 import { useState } from "react";
 import { isHttpTool, Toolset } from "@/lib/toolTypes";
+import { useToolsetEnvVars } from "@/hooks/useToolsetEnvVars";
 
 export const ToolsetEnvironmentBadge = ({
   toolset,
@@ -35,6 +36,13 @@ export const ToolsetEnvironmentBadge = ({
   const [envVarsDialogOpen, setEnvVarsDialogOpen] = useState(false);
   const [envVars, setEnvVars] = useState<Record<string, string>>({});
 
+  const requiresServerURL =
+    toolset?.tools?.some(
+      (tool) => isHttpTool(tool) && !tool.defaultServerUrl,
+    ) ?? false;
+
+  const relevantEnvVars = useToolsetEnvVars(toolset, requiresServerURL);
+
   const updateEnvironmentMutation = useUpdateEnvironmentMutation({
     onSuccess: () => {
       telemetry.capture("environment_event", { action: "environment_updated" });
@@ -52,24 +60,6 @@ export const ToolsetEnvironmentBadge = ({
 
   const environment = environments.find((env) => env.slug === envSlug);
 
-  const requiresServerURL = toolset.tools?.some(
-    (tool) => isHttpTool(tool) && !tool.defaultServerUrl,
-  );
-
-  const relevantEnvVars: string[] = [
-    // Security variables (no filtering)
-    ...(toolset.securityVariables?.flatMap((secVar) => secVar.envVariables) ??
-      []),
-    // Function environment variables
-    ...(toolset.functionEnvironmentVariables?.map((fnVar) => fnVar.name) ?? []),
-    // Server variables (filter server_url unless required)
-    ...(toolset.serverVariables?.flatMap((serverVar) =>
-      serverVar.envVariables.filter(
-        (v) => !v.toLowerCase().includes("server_url") || requiresServerURL,
-      ),
-    ) ?? []),
-  ];
-
   const missingEnvVars =
     relevantEnvVars?.filter(
       (varName) =>

server/internal/mcpmetadata/impl.go

@@ -483,6 +483,7 @@ func (s *Service) collectEnvironmentVariables(mode securityMode, toolsetDetails
 	case securityModePublic, securityModeOAuth:
 		var inputs []securityInput
 		isOAuthEnabled := mode == securityModeOAuth
+		seen := make(map[string]bool)
 
 		for _, secVar := range toolsetDetails.SecurityVariables {
 			for _, envVar := range secVar.EnvVariables {
@@ -495,20 +496,26 @@ func (s *Service) collectEnvironmentVariables(mode securityMode, toolsetDetails
 					continue
 				}
 
-				inputs = append(inputs, securityInput{
-					SystemName:  fmt.Sprintf("MCP-%s", envVar),
-					DisplayName: fmt.Sprintf("MCP-%s", strings.ReplaceAll(envVar, "_", "-")),
-					Sensitive:   true,
-				})
+				if !seen[envVar] {
+					seen[envVar] = true
+					inputs = append(inputs, securityInput{
+						SystemName:  fmt.Sprintf("MCP-%s", envVar),
+						DisplayName: fmt.Sprintf("MCP-%s", strings.ReplaceAll(envVar, "_", "-")),
+						Sensitive:   true,
+					})
+				}
 			}
 		}
 
 		for _, functionEnvVar := range toolsetDetails.FunctionEnvironmentVariables {
-			inputs = append(inputs, securityInput{
-				SystemName:  fmt.Sprintf("MCP-%s", functionEnvVar.Name),
-				DisplayName: fmt.Sprintf("MCP-%s", strings.ReplaceAll(functionEnvVar.Name, "_", "-")),
-				Sensitive:   true,
-			})
+			if !seen[functionEnvVar.Name] {
+				seen[functionEnvVar.Name] = true
+				inputs = append(inputs, securityInput{
+					SystemName:  fmt.Sprintf("MCP-%s", functionEnvVar.Name),
+					DisplayName: fmt.Sprintf("MCP-%s", strings.ReplaceAll(functionEnvVar.Name, "_", "-")),
+					Sensitive:   true,
+				})
+			}
 		}
 
 		return inputs

server/internal/mv/toolset.go

@@ -241,7 +241,7 @@ func DescribeToolsetEntry(
 		DefaultEnvironmentSlug:       conv.FromPGText[types.Slug](toolset.DefaultEnvironmentSlug),
 		SecurityVariables:            securityVars,
 		ServerVariables:              serverVars,
-		FunctionEnvironmentVariables: functionEnvVars,
+		FunctionEnvironmentVariables: dedupeFunctionEnvVars(functionEnvVars),
 		Description:                  conv.FromPGText[string](toolset.Description),
 		McpSlug:                      conv.FromPGText[types.Slug](toolset.McpSlug),
 		McpEnabled:                   &toolset.McpEnabled,
@@ -446,7 +446,7 @@ func DescribeToolset(
 		DefaultEnvironmentSlug:       conv.FromPGText[types.Slug](toolset.DefaultEnvironmentSlug),
 		SecurityVariables:            toolsetTools.SecurityVars,
 		ServerVariables:              toolsetTools.ServerVars,
-		FunctionEnvironmentVariables: toolsetTools.FunctionEnvVars,
+		FunctionEnvironmentVariables: dedupeFunctionEnvVars(toolsetTools.FunctionEnvVars),
 		Description:                  conv.FromPGText[string](toolset.Description),
 		Tools:                        toolsetTools.Tools,
 		Resources:                    toolsetTools.Resources,
@@ -898,6 +898,28 @@ func environmentVariablesForTools(ctx context.Context, tx DBTX, tools []toolEnvL
 	return slices.Collect(maps.Values(securityVarsMap)), serverVars, nil
 }
 
+// dedupeFunctionEnvVars returns function environment variables deduplicated by name.
+func dedupeFunctionEnvVars(vars []*types.FunctionEnvironmentVariable) []*types.FunctionEnvironmentVariable {
+	if len(vars) == 0 {
+		return vars
+	}
+
+	seen := make(map[string]bool, len(vars))
+	var deduped []*types.FunctionEnvironmentVariable
+	for _, envVar := range vars {
+		if envVar == nil {
+			continue
+		}
+		if _, exists := seen[envVar.Name]; exists {
+			continue
+		}
+		seen[envVar.Name] = true
+		deduped = append(deduped, envVar)
+	}
+
+	return deduped
+}
+
 const defaultPromptTemplateKind = "prompt"
 
 func parseKind(pt tsr.GetPromptTemplatesForToolsetRow) string {