Repository navigation
Send MCP bridge tools only the variables their schema declares - #1443
Merged
Merged
Conversation
Every connector variable, credentials included, was added to the arguments of every bridged MCP tool call, so the remote server received the connector's own API key or token as a tool argument. REST, GraphQL and the other engines are unaffected: they only use the variables their mappings reference. An MCP tool now gets a connector variable only when it is a top-level property of the tool's input schema, on real calls and in "Run Test" and the setup check alike.
8 of 10 tasks
helpcodeai
enabled auto-merge (squash)
November 2, 2026 09:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
On every call to a bridged MCP tool, all of the connector's environment variables were added to the tool arguments. Credentials were included.
DynamicMcpTools.injectEnvVarsdoes this for real calls, andConnectorsService.executeConnectorCalldoes it for "Run Test" and the setup check.As a result, the remote MCP server received the connector's own API key or token, and every other variable, as tool arguments on every call. A vendor may log those arguments. A server with a strict schema may also refuse them as unknown.
The variables were already sent to the vendor's own server. Its auth header carries the same key, so the key did not go to a third party. It did end up in a field that is not meant for credentials.
REST, GraphQL, SOAP, database and OData connectors are not affected. They take the merged parameters only as input to their mappings, and a mapping uses only the variables it names (
$name,{{VAR}}). Nothing is forwarded verbatim.On Cloud today, these MCP-type connectors are affected (count only, no values read):
Changes
envVarsForMcpTool(envVars, parameters)inconnectors/mcp-connector-config.util.tskeeps only the variables that are top-level properties of the remote tool's input schema. A variable with the same name as a parameter still fills it, as before, and a value the caller passes still wins.DynamicMcpTools.executeTooluses this filter for MCP connectors. Other connector types still get every variable.ConnectorsService.executeConnectorCalldoes the same, so "Run Test" and the setup check send the same arguments as a real call.docs/connectors/mcp-bridge.mddocuments this, andllms-full.txtis regenerated.Cloud vs self-hosted
Both behave the same. Nothing here depends on
DEPLOYMENT_MODE.Existing connectors pick up the change at their next call. There is no migration and no "Apply update".
Type
Testing
src/mcp-server/dynamic-mcp-tools.mcp-bridge.spec.tsexecuteConnectorCallsends the same arguments for an MCP tool.Commands and results, after
npx prisma generate:npx tsc --noEmit -p tsconfig.jsonnpm run lint:checknpx jest --maxWorkers=4 src/mcp-server/dynamic-mcp-tools src/connectors/connectors.service src/connectors/engines/mcp-client src/adapters/mcp-adapter src/adapters/intlnode scripts/validate-adapters.mjsnode scripts/adapter-count.mjs --checknode scripts/generate-llms-txt.mjs --checkllms-full.txtnode --test scripts/validate-adapters.test.mjs scripts/adapter-new.test.mjs scripts/generate-llms-txt.test.mjsnode --test scripts/satellites/satellites.test.mjsnode --test scripts/check-runtime-deps.test.mjs && node scripts/check-runtime-deps.mjsnode scripts/regenerate-catalog.mjsI ran only the targeted suites above, not the full backend
npm test.Checklist
npm test): only the targeted suites, see aboveRelated Issues
Split out of #1442 so it can ship first. #1442 should merge after this PR and after #1437.
Possible behaviour change: a remote tool that relied on receiving a connector variable under a name its schema does not list would no longer get it. No catalog MCP adapter does this.