🗝️ feat: User Provided Credentials for MCP Servers

[danny-avila]

Originally #7824

Summary

This PR adds support for user-specific credentials for MCP servers. It allows LibreChat administrators to define custom user variables in the configuration that can be set individually by each user and then referenced in MCP server headers.

Currently, when teams use MCP servers that require authentication, they often use shared/generic credentials for the entire team, which is not ideal from a security and accountability perspective. While LibreChat does support passing the {{LIBRECHAT_USER_ID}} variable in headers, this only works for MCP servers specifically designed to handle LibreChat user IDs.

This enhancement allows users to provide their own credentials for third-party MCPs.

Change Type

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Testing

• Edit MCP variables from Panel
• Edit MCP variables from MCPSelect
• Test revoke from side panel
• Test revoke from MCPSelect
• Header variables fill to SSE/streamable
• Do not show MCP Settings in the right panel when no servers with custom variables are defined
• Headers/connected are/is refreshed after editing the MCP settings
• Retest web search install/uninstall of variables
• Retest web search using assistant chat
• Add new MCP tool to an agent with dialog (variables are not required for MCP in this case)
• Add new non-MCP tool to an agent with dialog with API Key - tested with OpenWeather and API Key form popup

Test Configuration:

Any MCP server that supports SSE/Streamable HTTP and requires some headers.

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• [] My changes do not introduce new warnings
• I have tested the feature with multiple MCP server configurations
• Local unit tests pass with my changes

Implementation Details

The implementation adds:

1. A new customUserVars section in the MCP server configuration:

mcpServers:
  redmine:
    url: https://example.com/sse
    headers:
      REDMINE-URL: https://example.com
      REDMINE-API-KEY: "{{REDMINE_API_KEY}}"
    customUserVars:
      REDMINE_API_KEY:
        title: "Redmine API Key"
        description: "Go to https://example.com/my/api_key to get your API key"

Variables can be used in headers as shown in the example.

2. UI components for configuring user variables:
   • Users can configure their specific values for these variables in two ways:
     • From Assistant Chat Input: A new settings icon appears next to MCP servers in the MCPSelect.tsx dropdown (used when selecting MCPs for an assistant). Clicking this icon opens the configuration modal.
     • From User Settings Panel: A dedicated "MCP Settings" section in the user settings side panel (client/src/components/SidePanel/MCP/MCPPanel.tsx) lists all MCP servers that have customUserVars defined by the admin. Clicking a server name here also opens the configuration modal.
   • Configuration Modal (MCPConfigDialog.tsx): Both access points trigger the same reusable modal dialog. This dialog dynamically renders input fields based on the customUserVars schema defined by the administrator for the selected MCP server. It allows users to input and save their specific values. Features include:
     • Displaying titles and descriptions for each variable as defined in librechat.yaml.
     • Secure input fields (e.g., password type) with an option to reveal/hide the value.
   • Secure Storage: User-provided variables are sent to the backend via an API call and stored securely (uses existing pluginauths), associated with the user and the specific MCP plugin key (e.g., mcp_serverName).

[ksg97031]

@danny-avila
You might already be aware, but I'm seeing the following error on the latest librechat-dev image when docker compose starts.
This appears to be caused by your recent PR, so I wanted to bring it to your attention.

{"level":"error","message":"Error in startup config Cannot read properties of null (reading 'mcpServers')",
"stack":"TypeError: Cannot read properties of null (reading 'mcpServers')\n    
at /app/api/server/routes/config.js:105:16\n    at process.processTicksAndRejections 
(node:internal/process/task_queues:95:5)"}

[danny-avila]

@danny-avila You might already be aware, but I'm seeing the following error on the latest librechat-dev image when docker compose starts. This appears to be caused by your recent PR, so I wanted to bring it to your attention.

{"level":"error","message":"Error in startup config Cannot read properties of null (reading 'mcpServers')",
"stack":"TypeError: Cannot read properties of null (reading 'mcpServers')\n    
at /app/api/server/routes/config.js:105:16\n    at process.processTicksAndRejections 
(node:internal/process/task_queues:95:5)"}

Thanks, the image was just built, but not able to reproduce the issue. I can patch based on your error message, though.