refactor: Update MCP composer auth to just api and oauth #9487
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughBackend and frontend remove support for Basic, Bearer, and IAM authentication, narrowing to apikey and oauth schemas/UI, while MCP runtime paths drop feature-flag branching and OAuth env propagation. MCP invocation is unified to mcp-proxy with SSE URL. Frontend MCP server JSON and header generation now only handle apikey. Changes
Sequence Diagram(s)sequenceDiagram
participant UI as Frontend UI
participant BE as Backend API
participant MCP as mcp-proxy
Note over UI,BE: Install MCP config (unified flow)
UI->>BE: POST /mcp/install (project, sse_url, auth_settings)
BE->>BE: Build args: ["mcp-proxy", "--sse-url", sse_url]
BE-->>MCP: Invoke process with args (no OAuth env)
MCP-->>BE: Response/status
BE-->>UI: Installation result
sequenceDiagram
participant UI as MCP Server Tab
participant Util as getAuthHeaders
Note over UI,Util: Auth header generation
UI->>Util: getAuthHeaders(currentAuthSettings)
alt auth_type == "apikey"
Util-->>UI: { "x-api-key": api_key }
else
Util-->>UI: {}
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
github-actions
bot
added
refactor
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/backend/base/langflow/api/v1/mcp_projects.py (1)
368-406: WSL path leaves args undefined — runtime error when building MCP configWhen is_wsl is True, args is never set; later server_config references args, causing an UnboundLocalError. Set args after the WSL URL adjustment so it’s always initialized.
Apply:
os_type = platform.system() command = "uvx" # Check if running on WSL (will appear as Linux but with Microsoft in release info) is_wsl = os_type == "Linux" and "microsoft" in platform.uname().release.lower() if is_wsl: logger.debug("WSL detected, using Windows-specific configuration") @@ except OSError as e: logger.warning("Failed to get WSL IP address: %s. Using default URL.", str(e)) - else: - args = ["mcp-proxy", sse_url] + # Initialize args after potential WSL sse_url adjustment + args = ["mcp-proxy", sse_url] if os_type == "Windows": command = "cmd" args = ["/c", "uvx", *args] logger.debug("Windows detected, using cmd command")
🧹 Nitpick comments (3)
src/backend/base/langflow/api/v1/schemas.py (1)
447-459: Add lightweight validation to enforce required fields for each auth typeTo prevent misconfiguration getting persisted (e.g., auth_type="apikey" without api_key, or incomplete OAuth config), add a model-level validator.
Apply within class AuthSettings:
class AuthSettings(BaseModel): """Model representing authentication settings for MCP.""" auth_type: Literal["none", "apikey", "oauth"] = "none" api_key: SecretStr | None = None @@ oauth_mcp_scope: str | None = None oauth_provider_scope: str | None = None + + @model_validator(mode="after") + def _validate_auth(self): + if self.auth_type == "apikey": + if not self.api_key or not self.api_key.get_secret_value().strip(): + raise ValueError("api_key is required when auth_type is 'apikey'.") + if self.auth_type == "oauth": + required = ["oauth_client_id", "oauth_client_secret", "oauth_auth_url", "oauth_token_url"] + missing = [f for f in required if not getattr(self, f)] + if missing: + raise ValueError(f"Missing OAuth fields: {', '.join(missing)}") + return selfAnd ensure the import is available:
from pydantic import model_validatorsrc/backend/base/langflow/api/v1/mcp_projects.py (1)
346-349: Use 403 Forbidden for non-local install attemptsReturning 500 (server error) hides the access semantics and confuses clients. 403 better reflects “you’re not allowed from this origin.”
- if not is_local_ip(client_ip): - raise HTTPException(status_code=500, detail="MCP configuration can only be installed from a local connection") + if not is_local_ip(client_ip): + raise HTTPException(status_code=403, detail="MCP configuration can only be installed from a local connection")src/frontend/src/pages/MainPage/pages/homePage/components/McpServerTab.tsx (1)
253-283: Prefer building the config as an object and JSON.stringify itString interpolation for JSON is brittle (e.g., commas, quoting). Construct the object and call JSON.stringify to remove this entire class of issues.
Example sketch:
const serverName = `lf-${parseString(folderName ?? "project", [ "snake_case", "no_blank", "lowercase", ]).slice(0, MAX_MCP_SERVER_NAME_LENGTH - 4)}`; const args = [ ...(selectedPlatform === "windows" ? ["/c", "uvx"] : selectedPlatform === "wsl" ? ["uvx"] : []), "mcp-proxy", ...(ENABLE_MCP_COMPOSER ? currentAuthSettings?.auth_type === "apikey" && (currentAuthSettings.api_key || "YOUR_API_KEY") ? ["--headers", "x-api-key", String(currentAuthSettings.api_key || "YOUR_API_KEY")] : [] : isAutoLogin ? [] : ["--headers", "x-api-key", String(apiKey || "YOUR_API_KEY")] ), apiUrl, ]; const mcpConfig = { mcpServers: { [serverName]: { command: selectedPlatform === "windows" ? "cmd" : selectedPlatform === "wsl" ? "wsl" : "uvx", args, }, }, }; const MCP_SERVER_JSON = JSON.stringify(mcpConfig, null, 2);
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (5)
src/backend/base/langflow/api/v1/mcp_projects.py(1 hunks)src/backend/base/langflow/api/v1/schemas.py(1 hunks)src/frontend/src/modals/authModal/index.tsx(0 hunks)src/frontend/src/pages/MainPage/pages/homePage/components/McpServerTab.tsx(2 hunks)src/frontend/src/utils/mcpUtils.ts(0 hunks)
💤 Files with no reviewable changes (2)
- src/frontend/src/utils/mcpUtils.ts
- src/frontend/src/modals/authModal/index.tsx
🧰 Additional context used
📓 Path-based instructions (2)
{src/backend/**/*.py,tests/**/*.py,Makefile}
📄 CodeRabbit inference engine (.cursor/rules/backend_development.mdc)
{src/backend/**/*.py,tests/**/*.py,Makefile}: Run make format_backend to format Python code before linting or committing changes
Run make lint to perform linting checks on backend Python code
Files:
src/backend/base/langflow/api/v1/mcp_projects.pysrc/backend/base/langflow/api/v1/schemas.py
src/frontend/src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.cursor/rules/frontend_development.mdc)
src/frontend/src/**/*.{ts,tsx,js,jsx}: All frontend TypeScript and JavaScript code should be located under src/frontend/src/ and organized into components, pages, icons, stores, types, utils, hooks, services, and assets directories as per the specified directory layout.
Use React 18 with TypeScript for all UI components in the frontend.
Format all TypeScript and JavaScript code using the make format_frontend command.
Lint all TypeScript and JavaScript code using the make lint command.
Files:
src/frontend/src/pages/MainPage/pages/homePage/components/McpServerTab.tsx
🧠 Learnings (1)
📚 Learning: 2025-07-23T21:19:22.567Z
Learnt from: deon-sanchez
PR: langflow-ai/langflow#9158
File: src/backend/base/langflow/api/v1/mcp_projects.py:404-404
Timestamp: 2025-07-23T21:19:22.567Z
Learning: In langflow MCP projects configuration, prefer using dynamically computed URLs (like the `sse_url` variable) over hardcoded localhost URLs to ensure compatibility across different deployment environments.
Applied to files:
src/backend/base/langflow/api/v1/mcp_projects.py
🧬 Code graph analysis (1)
src/frontend/src/pages/MainPage/pages/homePage/components/McpServerTab.tsx (1)
src/frontend/src/customization/feature-flags.ts (1)
ENABLE_MCP_COMPOSER(20-21)
🔇 Additional comments (3)
src/backend/base/langflow/api/v1/schemas.py (1)
447-447: Auth types correctly narrowed; no legacy auth types detectedI ran the suggested ripgrep sweep across the repository for the removed auth types (“basic”, “bearer”, “iam”) and fields (“username”, “password”, “bearer_token”, “iam_endpoint”) and found only non-auth usages (e.g. “Basic Prompting” in tests, AWS CDK IAM constructs, and standard
Authorization: Bearerheaders). There are no stale references in the API schemas or auth logic.• Patterns searched:
•\b(basic|bearer|iam)\b
•\b(username|password|bearer_token|iam_endpoint)\b• No matches in
src/backend/base/langflow/api/v1/schemas.pyor related auth modules.
• Remaining occurrences are unrelated to Composer’s auth surface (tutorial markdown, testing fixtures, AWS infra).All set to merge.
src/backend/base/langflow/api/v1/mcp_projects.py (1)
360-366: Good: dynamic SSE URL with host/port (consistent with past guidance)Constructing sse_url from runtime settings avoids hardcoded localhost pitfalls and works across deployments.
src/frontend/src/pages/MainPage/pages/homePage/components/McpServerTab.tsx (1)
243-248: AuthSettingsType.api_key is a plain string
Verified that insrc/frontend/src/types/mcp/index.ts,api_key?: stringis defined (not a wrapped/SecretStr type), so it will render correctly. No further changes needed—LGTM.
src/frontend/src/pages/MainPage/pages/homePage/components/McpServerTab.tsx
Show resolved
Hide resolved
jordanrfrazier
left a comment
jordanrfrazier
left a comment
There was a problem hiding this comment.
bot comment seems valid
github-actions
bot
added
refactor
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
Codecov Report❌ Patch coverage is
❌ Your patch status has failed because the patch coverage (25.00%) is below the target coverage (40.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #9487 +/- ##
==========================================
+ Coverage 33.96% 33.98% +0.02%
==========================================
Files 1195 1195
Lines 55823 55753 -70
Branches 5370 5332 -38
==========================================
- Hits 18960 18949 -11
+ Misses 36793 36734 -59
Partials 70 70
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
github-actions
bot
added
refactor
|
* Update auth to just api and oauth * schema push * pr comment fix
* Update auth to just api and oauth * schema push * pr comment fix
Updates MCP Composer auth to be limited to oauth and api key
Feature flag is set by setting env
LANGFLOW_FEATURE_MCP_COMPOSER = trueSummary by CodeRabbit
Refactor
Chores