The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
docs	Skipped		Jan 16, 2026 10:15pm

Greptile Summary

This PR adds public visibility for deployed MCP tools and significantly improves the UX for MCP server management. The implementation includes database schema changes, API route updates to conditionally bypass authentication for public servers, and extensive UI enhancements.

Key Changes

• Public Visibility: Added isPublic boolean field to workflow_mcp_server table, allowing MCP tools to be accessed without authentication
• Security Implementation: Public servers generate short-lived internal JWT tokens (5 min expiry) that execute workflows under the creator's user context, maintaining proper authorization
• API Enhancements:
  • MCP serve endpoint (/api/mcp/serve/[serverId]) conditionally skips auth for public servers
  • Server creation now supports bulk workflow addition with validation (deployed status, start block checks)
  • PATCH endpoint supports updating visibility settings
• UX Improvements:
  • New tabbed interface separating server details from workflow management
  • MCP client configuration snippets for Cursor, Claude Desktop, Claude Code, and VS Code
  • Cursor deep link integration for one-click server installation
  • "Add to Cursor" button and copyable config snippets
  • Parameter descriptions editor for MCP tool schemas
• React Query Migration: Refactored chat and form deployment logic from manual state management to React Query hooks, improving consistency and reducing code duplication

Technical Implementation

The public visibility feature works by:

1. When a public MCP server receives a request, authentication is skipped
2. The system generates a temporary internal JWT token containing the server creator's user ID
3. This token is passed to the workflow execution endpoint via Authorization header
4. The workflow executes under the creator's permissions, ensuring proper access control
5. Tokens expire after 5 minutes to minimize security exposure

The migration to React Query consolidates deployment logic across chat, form, and MCP deployments, creating reusable hooks in apps/sim/hooks/queries/ that handle optimistic updates and cache invalidation consistently.

Confidence Score: 4/5

• This PR is safe to merge with minor considerations
• The implementation is well-structured with proper security controls (short-lived tokens, execution under creator context), comprehensive validation (deployment status, start block checks), and extensive UX improvements. The React Query migration follows established patterns. One minor code duplication issue was identified but doesn't affect functionality.
• No files require special attention - the implementation is solid across all changes

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Client as MCP Client
    participant API as MCP Serve Route
    participant Auth as Authentication
    participant TokenGen as Token Generator
    participant Workflow as Workflow Executor
    participant DB as Database

    Client->>API: POST /api/mcp/serve/{serverId}
    API->>DB: Fetch server (isPublic, createdBy)
    DB-->>API: Server configuration
    
    alt Server is Public
        Note over API,Auth: Skip auth check
        API->>TokenGen: Generate temporary token
        TokenGen-->>API: Internal JWT
        API->>Workflow: Execute with owner context
    else Server is Private
        API->>Auth: Verify request credentials
        Auth-->>API: Validation result
        alt Auth Failed
            API-->>Client: 401 Unauthorized
        else Auth Success
            API->>Workflow: Execute with user context
        end
    end
    
    Workflow->>Auth: Verify credentials
    Auth-->>Workflow: Extract user context
    Workflow->>DB: Execute as workflow owner
    DB-->>Workflow: Execution results
    Workflow-->>API: Response
    API-->>Client: MCP tool output

@greptile