Skip to content

fix: show all env vars for basic auth in mcp details and install page#1337

Merged
simplesagar merged 6 commits intomainfrom
fix/basic-auth-display-names
Jan 23, 2026
Merged

fix: show all env vars for basic auth in mcp details and install page#1337
simplesagar merged 6 commits intomainfrom
fix/basic-auth-display-names

Conversation

@simplesagar
Copy link
Member

@simplesagar simplesagar commented Jan 22, 2026

Summary

  • Fixes the MCP details page to show separate editable entries for each environment variable in a security scheme (e.g., username and password for basic auth)
  • Fixes the install page to use per-env-var display names from the headerDisplayNames map

Changes

Frontend (client/dashboard/src/pages/mcp/MCPDetails.tsx)

  • The AuthorizationHeadersSection now flattens security variables to create one row per environment variable
  • This handles cases like basic auth where one securityVariable has multiple envVariables (username + password)
  • Each env var can now have its own custom display name

Backend (server/internal/mcpmetadata/impl.go)

  • collectEnvironmentVariables now accepts a headerDisplayNames map parameter
  • Display names are looked up per-env-var from the metadata, not from the security variable level
  • This ensures the install page shows the correct custom display names for each credential

Test plan

  • Create an MCP server with basic auth (username + password)
  • Verify the MCP details page shows two separate entries: one for username, one for password
  • Edit each display name and verify they save independently
  • Verify the install page shows the correct display names for both username and password

🤖 Generated with Claude Code


Open with Devin

Fixes two issues with basic auth security variables that have multiple
environment variables (e.g., username and password):

1. Frontend (MCPDetails.tsx): The Authorization Headers section now
   iterates over each environment variable instead of each security
   variable. This shows separate editable entries for username and
   password.

2. Backend (mcpmetadata/impl.go): The install page now uses the
   headerDisplayNames map from MCP metadata to get per-env-var display
   names, fixing the issue where both username and password showed
   the same display name.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@vercel
Copy link

vercel bot commented Jan 22, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
gram Ready Ready Preview, Comment Jan 23, 2026 0:15am
gram-docs-redirect Ready Ready Preview, Comment Jan 23, 2026 0:15am

Request Review

@changeset-bot
Copy link

changeset-bot bot commented Jan 22, 2026

🦋 Changeset detected

Latest commit: d90e6e0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
dashboard Patch
server Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link
Contributor

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

View issue and 5 additional flags in Devin Review.

Open in Devin Review

@github-actions github-actions bot added the preview Spawn a preview environment label Jan 22, 2026
@speakeasybot
Copy link
Collaborator

speakeasybot commented Jan 22, 2026

🚀 Preview Environment (PR #1337)

Preview URL: https://pr-1337.test.getgram.ai

Component Status Details Updated (UTC)
✅ Database Ready Existing database reused 2026-01-23 00:18:42.
✅ Images Available Container images ready 2026-01-23 00:18:25.

Gram Preview Bot

…ersSection

The component was setting displayName: undefined for all entries instead of
fetching and using the saved headerDisplayNames from mcpMetadata. Now we:

1. Use useGetMcpMetadata hook to fetch saved display names
2. Look up display names from headerDisplayNames map for each env var
3. Invalidate metadata cache after successful display name update

Addresses Devin's pre-review feedback on PR #1337.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@simplesagar simplesagar changed the title fix: show all env vars for basic auth in MCP details and install page fix: show all env vars for basic auth in mcp details and install page Jan 22, 2026
Copy link
Contributor

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 new potential issue.

🔴 1 issue in files not directly in the diff

🔴 Key mismatch between frontend saving display names and backend reading them for toolset security variables (server/internal/mv/toolset.go:1011)

There is an inconsistency in how header display names are keyed when saving vs. reading:

  1. Frontend saves (MCPDetails.tsx:698, 707): Uses entry.envVar (environment variable name like X_API_KEY) as the securityKey when calling handleEditSave(entry.envVar)

  2. Server mcpmetadata/impl.go:656 correctly looks up display names by envVar:

if customName, ok := headerDisplayNames[envVar]; ok && customName != "" {
  1. Server mv/toolset.go:1011 incorrectly looks up display names by entry.Name.String (the header name, NOT the env var):
if dn, ok := headerDisplayNames[entry.Name.String]; ok && dn != "" {

The mv/toolset.go code populates securityVariables in the toolset API response, which is used by useMcpConfigs (MCPDetails.tsx:845) to generate MCP config JSON via secVar.displayName. Since the lookup uses the wrong key, custom display names will NOT appear in the generated MCP configuration JSON that users copy to set up their MCP clients.

Impact: Custom display names work correctly on the hosted install page (which uses collectEnvironmentVariables), but fail to appear in the MCP JSON configuration shown in the dashboard and used by useMcpConfigs.

Recommendation: Change line 1011 in mv/toolset.go to look up display names by environment variable names instead of entry.Name.String. Iterate through entry.EnvVariables to find matching display names, similar to how collectEnvironmentVariables in mcpmetadata/impl.go does it.

View issue and 10 additional flags in Devin Review.

Open in Devin Review

…matting

The invalidateGetMcpMetadata function expects a tuple [{ params }] as the
second argument, not just the params object directly. Also fixed prettier
formatting.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The headerDisplayNames map is keyed by environment variable names (e.g.,
X_API_KEY, USERNAME), not header names (e.g., Authorization). Updated
the lookup to iterate through entry.EnvVariables to find matching
display names.

Addresses Devin's review feedback about key mismatch between frontend
saving and backend reading display names.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ction

Add throwOnError: false to useGetMcpMetadata hook since metadata may not
exist for all toolsets. This prevents 404 responses from crashing the
component via React Query's error boundary propagation.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@simplesagar simplesagar enabled auto-merge (squash) January 23, 2026 00:16
@simplesagar simplesagar merged commit f8a3eae into main Jan 23, 2026
27 checks passed
@simplesagar simplesagar deleted the fix/basic-auth-display-names branch January 23, 2026 00:18
@github-actions github-actions bot locked and limited conversation to collaborators Jan 23, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

preview Spawn a preview environment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants