fix: remote mcp

[Akatuoro]

Fixes #48

[hyperspace-pr-bot]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Fix: Authenticate Remote MCP Server Handshake Per-Request

This PR fixes a bug where remote MCP servers protected by @requires authentication would never yield tools because auth headers were not sent during the tools/list handshake — only during tool invocations.

What Changed

Root Cause: The previous implementation used beforeToolCall to inject auth headers, but this callback is only invoked during _callTool(), not during initializeConnections() (where tools/list happens). This meant the discovery handshake went out unauthenticated, silently resulting in zero tools.

Fix: The MCP connection flow is redesigned using a deferred/dynamic approach:

• srv/handlers/mcp-tools.js: buildMcpToolsFromConnection() no longer eagerly connects to the MCP server or fetches tools. Instead, it returns a lightweight placeholder object { _mcpDynamic: true, mcpUrl, resolveHeaders }. The MultiServerMCPClient instantiation, wrapToolsWithErrorHandling, and related code are removed.

• lib/agents/middleware/remote-mcp.js (new file): A new remoteMcpMiddleware is introduced that resolves MCP tools per-request using the current user's auth headers. It:

  • Intercepts model calls (wrapModelCall) to replace placeholder tools with real tools fetched from the MCP server using fresh credentials
  • Caches resolved tools on cds.context.__mcpDynamicTools for the lifetime of the request to avoid redundant tools/list calls in multi-turn loops
  • Handles tool invocations (wrapToolCall) with proper error handling, returning errors as ToolMessage instead of crashing the graph
  • Also fixes the latent Invalid transport type: undefined error by explicitly setting transport: "http" in mcpServers config

• lib/agents/middleware/index.js: Conditionally registers remoteMcpMiddleware when any tool has _mcpDynamic: true, placing it first in the middleware chain.

Category

🐛 Bug Fix

Fixes #48

Have you...

• Added relevant entry to the change log?

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.29.49

• LLM: anthropic--claude-4.6-sonnet
• GithubContextProvider: Remote MCP servers behind @requires never yield tools — auth headers are not sent on the tools/list handshake #48
• Output Template: Repository PR Template
• Correlation ID: 84f30380-a16a-11f1-98f0-137c0685a253
• Event Trigger: pull_request.opened
• Summary Prompt: Default Prompt
• File Content Strategy: Full file content