feat(mcp): add Tool Registry Service for agent tool credentials #208
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f8251468d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| try { | ||
| const encryptionMaterial = JSON.parse(tool.encryptedCredentials); | ||
| const decrypted = await this.encryption.decrypt(encryptionMaterial); | ||
| return JSON.parse(decrypted); |
There was a problem hiding this comment.
registerRemoteMcp encrypts a raw authToken string, but getToolCredentials always JSON.parses the decrypted payload. When the tool is a remote MCP (auth token is a plain string, not JSON), JSON.parse(decrypted) throws and the method returns null, so any consumer trying to fetch credentials for remote MCPs will never receive the token. This breaks authenticated remote MCP calls whenever authToken is not JSON-encoded.
Useful? React with 👍 / 👎.
betterclever
force-pushed
the
eng-95/component-sdk-tool-mode
branch
from
7e4d294 to
e49f0c8
Compare
betterclever
force-pushed
the
eng-96/tool-registry
branch
3 times, most recently
from
b69e898 to
15d7d28
Compare
betterclever
force-pushed
the
eng-95/component-sdk-tool-mode
branch
from
4f4cee6 to
f09bb4d
Compare
betterclever
force-pushed
the
eng-96/tool-registry
branch
from
15d7d28 to
3670de1
Compare
betterclever
force-pushed
the
eng-95/component-sdk-tool-mode
branch
3 times, most recently
from
f3da236 to
0660362
Compare
betterclever
force-pushed
the
eng-96/tool-registry
branch
2 times, most recently
from
d7263bb to
908d508
Compare
ENG-96
- Create ToolRegistryService with Redis-backed storage
- Implement registerComponentTool, registerRemoteMcp, registerLocalMcp
- Implement getToolsForRun, getTool, getToolByName, getToolCredentials
- Implement areAllToolsReady for agent readiness check
- Implement cleanupRun for workflow completion cleanup
- Encrypt credentials using existing SecretsEncryptionService
- Redis key pattern: mcp:run:{runId}:tools (Hash, TTL 1hr)
- Add McpModule to app imports
- Add comprehensive tests (8 tests passing)
Note: Temporal activities (registerToolActivity, waitForToolsActivity, etc.)
will be added in a follow-up as they reside in the worker package.
Signed-off-by: betterclever <paliwal.pranjal83@gmail.com>
Signed-off-by: betterclever <paliwal.pranjal83@gmail.com>
- Update registerRemoteMcp to store authToken as JSON object for consistency - Add fallback in getToolCredentials to handle legacy raw string tokens - Add test case for remote MCP credentials Signed-off-by: betterclever <paliwal.pranjal83@gmail.com>
Signed-off-by: betterclever <paliwal.pranjal83@gmail.com>
betterclever
force-pushed
the
eng-96/tool-registry
branch
from
908d508 to
f82a05d
Compare
Summary
Redis-backed registry for storing tool metadata and credentials during workflow runs. This bridges the gap between Temporal workflows (where credentials are resolved) and the MCP gateway (where agents call tools).
Stacked PR
Changes
New: `backend/src/mcp/` module
ToolRegistryService:
Redis Key Pattern
```
mcp:run:{runId}:tools (Hash, TTL 1hr)
```
Security
Tests
Note
Temporal activities (`registerToolActivity`, `waitForToolsActivity`, etc.) will be added in a follow-up as they reside in the worker package.
Linear Issue
Closes ENG-96