chore(diagnostic): MCP_PRO_GRANT_HMAC_SECRET runtime visibility#3653
Conversation
TEMPORARY DIAGNOSTIC. Production reports "MCP authorization is temporarily unavailable" on every Pro authorize click after PR #3646 merged. The mint endpoint is throwing GrantConfigError, which means process.env.MCP_PRO_GRANT_HMAC_SECRET is empty/unset at the apex function — but the dashboard's Shared tab shows the variable linked to Production+Preview, and `vercel env ls production | grep MCP_` returns no match. Two unknowns to disambiguate: (a) Is the variable actually reaching the function process? Or is the Shared link not really applied? (b) If reaching, is the name correct (no typo / wrong key)? This logs the NAMES (not values) of every process.env key starting with `MCP_` next to the GrantConfigError throw so the next failed authorize click in production shows conclusively: - <NONE>: link didn't apply / wrong project / scope mismatch - only MCP_INTERNAL_HMAC_SECRET: typo or partial link - includes MCP_PRO_GRANT_HMAC_SECRET: linked but empty (also surfaced as the existing GrantConfigError) Removed in the immediately-following commit once root cause is confirmed. Names only — no values. After deploy, reproduce the failure once and search Vercel function logs for the literal string `[mcp-grant-hmac] DIAGNOSTIC missing-secret`.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Greptile SummaryAdds a single temporary
Confidence Score: 4/5Safe to merge; the change is a single, well-contained diagnostic warn that cannot alter the error path or expose secret values. The diff touches one small branch inside No files require special attention beyond confirming the diagnostic is removed in the follow-up commit once root cause is confirmed. Important Files Changed
Reviews (1): Last reviewed commit: "chore(diagnostic): log MCP_* env-key nam..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| console.warn( | ||
| `[mcp-grant-hmac] DIAGNOSTIC missing-secret: process.env MCP_* keys = ${ | ||
| mcpKeys.length === 0 ? '<NONE>' : mcpKeys.join(', ') | ||
| }`, | ||
| ); |
There was a problem hiding this comment.
process.env but logs env parameter
The template string reads process.env MCP_* keys = … but the key list is built from the env parameter, which defaults to process.env in production but can be any object passed in tests or callers. If readGrantSecret is ever invoked with a synthetic env in a non-test context, the message will misattribute the source. Consider changing the label to something like runtime env MCP_* keys to avoid a misleading diagnostic trail.
1 participant
Summary
Temporary diagnostic on top of merged PR #3646. Logs the names (not values) of every
process.envkey starting withMCP_at the momentgetGrantSecret()throwsGrantConfigError.Why
After #3646 merged + production deploy, every Pro user authorize click → "MCP authorization is temporarily unavailable" → mint endpoint returning
CONFIGURATION_ERROR500 → which fires only whenprocess.env.MCP_PRO_GRANT_HMAC_SECRETis empty/unset at the apex function.Vercel dashboard shows both
MCP_PRO_GRANT_HMAC_SECRETandMCP_INTERNAL_HMAC_SECRETlinked under Production+Preview as Sensitive, butvercel env ls production | grep MCP_returns no match. Need to confirm whether the running function process actually sees the variable.What this commit does
Adds a single
console.warnatapi/_mcp-grant-hmac.ts:84when the secret is missing, before the throw:If
<list>is<NONE>→ link didn't actually apply.If only
MCP_INTERNAL_HMAC_SECRET→ wrong key linked / typo.If includes
MCP_PRO_GRANT_HMAC_SECRET→ linked but empty (separate bug).Removal
This is temporary. Removed in the immediately-following commit once root cause is confirmed.
Test plan
[mcp-grant-hmac] DIAGNOSTIC missing-secret