Fix/on mcp configuration always called

[JonasJesus42]

Problem

Previously, ON_MCP_CONFIGURATION was only called when:

1. configuration_state or configuration_scopes were explicitly passed in the update request
2. AND finalState was truthy
3. AND finalScopes.length > 0

This caused a bug where MCPs with onChange handlers were never notified because:

• The UI doesn't always send configuration_state/configuration_scopes on save
• configuration_scopes were never automatically fetched from the MCP
• So finalScopes.length was always 0 for new connections

Impact

MCPs that depend on onChange to initialize their state (e.g., caching configs, setting up webhooks, validating credentials) would never receive the callback, leaving them in an uninitialized state.

Solution

• Fetch scopes from MCP_CONFIGURATION if not already saved in the connection
• Save fetched scopes to the connection for future updates
• Initialize empty state ({}) if scopes exist but state is null
• Always call ON_MCP_CONFIGURATION when state and scopes are available
• Use single proxy connection for all operations (more efficient)

Changes

Before:
if (
(data.configuration_state !== undefined ||
data.configuration_scopes !== undefined) &&
finalState &&
finalScopes.length > 0
) {
// Call ON_MCP_CONFIGURATION
}After:
// Fetch scopes from MCP if not saved
if (finalScopes.length === 0) {
const mcpConfig = await proxy.callTool({ name: "MCP_CONFIGURATION" });
if (mcpConfig?.scopes?.length > 0) {
finalScopes = mcpConfig.scopes;
await ctx.storage.connections.update(id, { configuration_scopes: finalScopes });
}
}

// Initialize empty state if needed
if (finalScopes.length > 0 && !finalState) {
finalState = {};
}

// Always call if we have state and scopes
if (finalState && finalScopes.length > 0) {
await proxy.callTool({ name: "ON_MCP_CONFIGURATION", arguments: { state, scopes } });
}### Testing

1. Create a new MCP connection with an onChange handler
2. Click "Save" without changing any configuration fields
3. Verify that ON_MCP_CONFIGURATION is called and onChange is triggered
4. Verify that configuration_scopes is saved to the connection

Related

This fix is essential for MCPs like Slack Bot that need to cache configurations for webhook handlers that run outside the MCP context.

Screenshots/Demonstration

Add screenshots or a Loom video if your changes affect the UI.

Review Checklist

• PR title is clear and descriptive
• Changes are tested and working
• Documentation is updated (if needed)
• No breaking changes

---

Summary by cubic

Always calls ON_MCP_CONFIGURATION on connection updates by fetching missing scopes and initializing state. Improves Decopilot API with detailed validation logs and support for agent mode.

• Bug Fixes

  • Fetch and persist scopes from MCP_CONFIGURATION when none are saved.
  • Initialize configuration_state to {} if scopes exist but state is null.
  • Always call ON_MCP_CONFIGURATION when state and scopes are available.
  • Use a single MCP proxy for the entire update flow.

• New Features

  • Add agent.mode to Decopilot stream schema (passthrough, smart_tool_selection, code_execution).
  • Provide default, uniform server capabilities and instructions for virtual MCPs.

^{Written for commit 0266899. Summary will update on new commits.}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Should a new version be published when this PR is merged?

React with an emoji to vote on the release type:

Reaction	Type	Next Version
👍	Prerelease	2.64.2-alpha.1
🎉	Patch	2.64.2
❤️	Minor	2.65.0
🚀	Major	3.0.0

Current version: 2.64.1

Deployment

• Deploy to production (triggers ArgoCD sync after Docker image is published)

[cubic-dev-ai]

No issues found across 2 files

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/mesh/src/api/routes/decopilot/routes.ts">

<violation number="1" location="apps/mesh/src/api/routes/decopilot/routes.ts:47">
P2: Avoid logging the full raw payload on validation errors because it can expose sensitive data in logs. Log only validation errors or redact the payload.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Avoid logging the full raw payload on validation errors because it can expose sensitive data in logs. Log only validation errors or redact the payload.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/src/api/routes/decopilot/routes.ts, line 47:

<comment>Avoid logging the full raw payload on validation errors because it can expose sensitive data in logs. Log only validation errors or redact the payload.</comment>

<file context>
@@ -38,7 +38,18 @@ async function validateRequest(
+      "Validation errors:",
+      JSON.stringify(parseResult.error.format(), null, 2),
+    );
+    console.error("Raw payload:", JSON.stringify(rawPayload, null, 2));
+
+    throw new HTTPException(400, {
</file context>

Suggested change

	console.error("Raw payload:", JSON.stringify(rawPayload, null, 2));
	console.error("Raw payload:", "[redacted]");

[cubic-dev-ai]

5 issues found across 90 files (changes from recent commits).

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/mesh/src/storage/virtual.ts">

<violation number="1" location="apps/mesh/src/storage/virtual.ts:400">
P2: Spreading `metadata` can throw when parseJson returns null. Guard the spread with a fallback object to avoid runtime errors when metadata is null.</violation>
</file>

<file name="apps/mesh/src/api/routes/proxy.ts">

<violation number="1" location="apps/mesh/src/api/routes/proxy.ts:667">
P2: The transport is no longer closed after handling the request, which can leave open streams and leak resources. Reintroduce the try/finally cleanup around `handleRequest` so the transport is always closed.</violation>
</file>

<file name="apps/mesh/src/web/components/details/prompt/index.tsx">

<violation number="1" location="apps/mesh/src/web/components/details/prompt/index.tsx:250">
P3: Align the exported `PromptDetailsViewProps` type with the component’s actual props. Right now `onUpdate` is still required in the interface even though the component omits it, which is a confusing public API mismatch.</violation>
</file>

<file name="packages/mesh-plugin-user-sandbox/server/tools/get.ts">

<violation number="1" location="packages/mesh-plugin-user-sandbox/server/tools/get.ts:14">
P2: The handler can return null when a template ID is not found, but the output schema is now non-nullable. This will cause schema validation failures for valid “not found” responses. Keep the output schema nullable or throw a not-found error instead.</violation>
</file>

<file name="apps/mesh/src/web/components/details/virtual-mcp/index.tsx">

<violation number="1" location="apps/mesh/src/web/components/details/virtual-mcp/index.tsx:254">
P3: The eslint-disable comment uses a misspelled rule name (`react-hooks/exhaustive-depsbun`), which triggers an ESLint error and doesn’t suppress the hook dependency warning. Correct the rule name or remove the comment.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Spreading metadata can throw when parseJson returns null. Guard the spread with a fallback object to avoid runtime errors when metadata is null.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/src/storage/virtual.ts, line 400:

<comment>Spreading `metadata` can throw when parseJson returns null. Guard the spread with a fallback object to avoid runtime errors when metadata is null.</comment>

<file context>
@@ -433,7 +396,10 @@ export class VirtualMCPStorage implements VirtualMCPStoragePort {
       updated_by: undefined, // connections table doesn't have updated_by
-      metadata: this.parseJson<{ instructions?: string }>(row.metadata),
+      metadata: {
+        ...metadata,
+        instructions: metadata?.instructions ?? null,
+      },
</file context>

Suggested change

	...metadata,
	...(metadata ?? {}),

[cubic-dev-ai]

P2: The transport is no longer closed after handling the request, which can leave open streams and leak resources. Reintroduce the try/finally cleanup around handleRequest so the transport is always closed.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/src/api/routes/proxy.ts, line 667:

<comment>The transport is no longer closed after handling the request, which can leave open streams and leak resources. Reintroduce the try/finally cleanup around `handleRequest` so the transport is always closed.</comment>

<file context>
@@ -653,16 +664,7 @@ app.all("/:connectionId", async (c) => {
-          // Ignore close errors - transport may already be closed
-        }
-      }
+      return await transport.handleRequest(c.req.raw);
     } catch (error) {
       // Check if this is an auth error - if so, return appropriate 401
</file context>

Suggested change

	return await transport.handleRequest(c.req.raw);
	try {
	return await transport.handleRequest(c.req.raw);
	} finally {
	try {
	await transport.close?.();
	} catch {
	// Ignore close errors - transport may already be closed
	}
	}

[cubic-dev-ai]

P2: The handler can return null when a template ID is not found, but the output schema is now non-nullable. This will cause schema validation failures for valid “not found” responses. Keep the output schema nullable or throw a not-found error instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/mesh-plugin-user-sandbox/server/tools/get.ts, line 14:

<comment>The handler can return null when a template ID is not found, but the output schema is now non-nullable. This will cause schema validation failures for valid “not found” responses. Keep the output schema nullable or throw a not-found error instead.</comment>

<file context>
@@ -11,7 +11,7 @@ export const USER_SANDBOX_GET: ServerPluginToolDefinition = {
   description: "Get a user sandbox by ID",
   inputSchema: UserSandboxGetInputSchema,
-  outputSchema: UserSandboxEntitySchema.nullable(),
+  outputSchema: UserSandboxEntitySchema,
 
   handler: async (input, ctx) => {
</file context>

Suggested change

	outputSchema: UserSandboxEntitySchema,
	outputSchema: UserSandboxEntitySchema.nullable(),

[cubic-dev-ai]

P3: Align the exported PromptDetailsViewProps type with the component’s actual props. Right now onUpdate is still required in the interface even though the component omits it, which is a confusing public API mismatch.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/src/web/components/details/prompt/index.tsx, line 250:

<comment>Align the exported `PromptDetailsViewProps` type with the component’s actual props. Right now `onUpdate` is still required in the interface even though the component omits it, which is a confusing public API mismatch.</comment>

<file context>
@@ -284,11 +242,12 @@ function PromptDetailContent({
-export function PromptDetailsView({ itemId, onBack }: PromptDetailsViewProps) {
+export function PromptDetailsView({
+  itemId,
+}: Omit<PromptDetailsViewProps, "onUpdate">) {
   const connectionId = getConnectionIdFromPathname();
 
</file context>

[cubic-dev-ai]

P3: The eslint-disable comment uses a misspelled rule name (react-hooks/exhaustive-depsbun), which triggers an ESLint error and doesn’t suppress the hook dependency warning. Correct the rule name or remove the comment.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/src/web/components/details/virtual-mcp/index.tsx, line 254:

<comment>The eslint-disable comment uses a misspelled rule name (`react-hooks/exhaustive-depsbun`), which triggers an ESLint error and doesn’t suppress the hook dependency warning. Correct the rule name or remove the comment.</comment>

<file context>
@@ -1,998 +1,356 @@
+  useEffect(() => {
+    setChatOpen(true);
+    setVirtualMcpId(virtualMcp.id);
+    // eslint-disable-next-line react-hooks/exhaustive-depsbun
+  }, [virtualMcp.id]);
+
</file context>

Suggested change

	// eslint-disable-next-line react-hooks/exhaustive-depsbun
	// eslint-disable-next-line react-hooks/exhaustive-deps