Repository navigation
feat: choose the shared credential an agent key uses per server - #8040
Merged
danielkov merged 90 commits intoOct 29, 2026
Merged
Conversation
Administrators can create remote_session, service_account, static_credential and pass_through auth clients, offer an existing client on another server, and replace an administrator-created client's headers. The typed resolver treats administrator-created clients and associations as authoritative instead of checking them against the server settings that backfilled copies mirror.
Server settings add a credential another server already offers or create a new one, and a credential's sheet edits and rotates its headers. The static Authorization identity choice is renamed to a shared credential. Agent pages edit credential blocks for managers and connection owners.
…o daniel/aim-596-feat-dashboard-auth-client-setup
Where typed auth client resolution is enforced, consent offers each server's permitted auth clients, preselects the remembered choice or the fixed order, and records the picked client and its own registration on the new credential. Gateways offer the choice per member and capture tools through it.
A member added after a credential was issued gets no-auth or its single ready permitted client recorded atomically the first time it is used, where typed auth client resolution is enforced. Otherwise it stays unavailable until the person reconnects to choose.
Agent key creation records an auth client choice per server under a new api_key credential kind, rotation copies it, and under enforcement the key is served through those choices on direct servers and agent gateway members. The key wizard asks for a credential on servers offering several.
🦋 Changeset detectedLatest commit: fcc00dd The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed
This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.
View guided diff | Turn on auto-fix | Re-trigger cubic
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 55 files
Requires human review: Auto-approval blocked because this review re-detected 7 unresolved issues already reported by Cubic.
View guided diff | Turn on auto-fix | Re-trigger cubic
Bind a registration's issuer to the client's project, refuse empty header entries, keep stored secrets across '_'/'-' spellings, report members' choice among several credentials in get_my_mcp_connection_status, map the post-offer read failure, and cover admin clients and cross-server offers.
…o daniel/aim-596-feat-dashboard-auth-client-setup
…aniel/aim-596-feat-consent-auth-client-picker
Let an agent approval proceed when only the person lacks access, offer connect and reconnect for identity-provider clients, record no client for a no-auth server, and let a later no-auth approval clear the remembered client.
…niel/aim-596-feat-gateway-new-member-choices # Conflicts: # server/internal/mcpservers/upstreamclients/queries.sql
…niel/aim-596-feat-agent-key-auth-client-choices
…ctions UI Keep the full agent policy as the permission editor's baseline so a credential restriction no longer makes every save report a conflict. Load every page of credentials, connections and connection blocks; show connection-owner blocks read-only; reset the block dialogs on close; refresh the agent policy after a connection block changes. Keep stored non-secret header values by name when is_secret is unchanged, keep header descriptions on save, ask for a new value when a stored header is renamed, and refuse reserved headers while editing. Say when sign-ins fail to load, describe both shared credential formats, and point the Platform MCP setup skill at Static credential for API key and Basic upstreams.
Fail closed when a key's choices cannot be read or name a legacy choice, decide gateway key choices before the token path, apply the self-held credential exception to reconnect checks, block issuing when a server's credentials cannot be loaded, and clear stale picks.
…reate-and-attach-auth-clients
…niel/aim-596-feat-gateway-new-member-choices
…niel/aim-596-feat-agent-key-auth-client-choices # Conflicts: # client/dashboard/src/pages/agents/credentials/CredentialsWizard.tsx # server/internal/mcp/serve_meta.go
…o daniel/aim-596-feat-dashboard-auth-client-setup
…aniel/aim-596-feat-consent-auth-client-picker
…niel/aim-596-feat-gateway-new-member-choices
…niel/aim-596-feat-agent-key-auth-client-choices
This comment has been minimized.
This comment has been minimized.
daviddanialy
approved these changes
Oct 26, 2026
Drops the "New:" prefix, names the reuse option "Existing credential" and leaves it out when no other server has a credential to share. The upstream sign-in row now says what probing a remote upstream found.
…aniel/aim-596-feat-consent-auth-client-picker
…niel/aim-596-feat-gateway-new-member-choices
…niel/aim-596-feat-agent-key-auth-client-choices
Base automatically changed from
daniel/aim-596-feat-gateway-new-member-choices
to
main
October 29, 2026 16:49
Contributor
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
This comment has been minimized.
This comment has been minimized.
Contributor
There was a problem hiding this comment.
Review completed against the latest diff
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 7 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
danielkov
deleted the
daniel/aim-596-feat-agent-key-auth-client-choices
branch
October 29, 2026 22:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AIM-596 (5 of 5)
Stacked on #8039.
Summary
keys.createtakesauth_client_choicesfor agent keys: one{mcp_server_id, auth_client_id?}per server.api_keycredential kind keyed by the key's row id. Ordinary keys refuse choices.keys.rotatecopies the rotated key's choices to its replacement.upstream_auth_enforcedis on):mcp:authcheck, client headers, and service-account tokens. This includes private servers without a sign-in issuer, where the key is resolved after it authenticates.memberChoices.onlyChosen).ResolveAuthClientAccessTokens: a self-owned (service-account) registration is resolved without attachments for any caller, since its token belongs to nobody. People's connections still go through attachments.authClients.listMcpServerChoices: a server's enabled shared credentials (names and types only), for callers who can connect to the server. Legacy keys are refused.Motivation
RFC section 7.7: agent key creation is the interactive moment that establishes a key's choices, so later key use needs no browser consent, and several ready shared credentials need an explicit choice rather than a silent default.
Gutternote review steps
upstream_auth_enforcedfor the organization to see the chosen one served./<org>/projects/<project>/identities/agent:<id>/credentials?credential=new).