@kya-os/mcp-i-core 1.3.0 → 1.3.1

package/src/services/provider-resolver.ts

@@ -17,7 +17,7 @@ import type { OAuthConfigService } from "./oauth-config.service.js";
  * Priority order:
  * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
  * 2. Scope prefix inference (fallback)
- * 3. First configured provider (Phase 1 compatibility fallback)
+ * 3. Project-configured provider from AgentShield dashboard
  * 4. Error if no provider can be resolved
  */
 export class ProviderResolver {
@@ -70,25 +70,27 @@ export class ProviderResolver {
       }
     }
 
-    // Priority 3: First configured provider (Phase 1 compatibility fallback)
-    // Ensure registry is loaded
+    // Priority 3: Use explicitly configured provider from AgentShield dashboard
+    // This is the provider the user has actually configured, not just any available provider
     await this.registry.loadFromAgentShield(projectId);
-    const providers = this.registry.getAllProviders();
-    if (providers.length > 0) {
-      // Log deprecation warning for Phase 1 tools
-      const firstProviderName = this.registry.getProviderNames()[0];
+    const configuredProvider = this.registry.getConfiguredProvider();
+
+    if (configuredProvider && this.registry.hasProvider(configuredProvider)) {
       console.warn(
         `[ProviderResolver] Tool does not specify oauthProvider. ` +
-          `Using first configured provider "${firstProviderName}" as fallback. ` +
-          `This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.`
+          `Using project-configured provider "${configuredProvider}" as fallback. ` +
+          `Consider explicitly setting oauthProvider in tool protection config.`
       );
-      return firstProviderName;
+      return configuredProvider;
     }
 
-    // Priority 4: Error if no provider can be resolved
+    // Priority 4: Error if no provider is configured
+    // NOTE: We intentionally do NOT fall back to "first available provider" anymore
+    // because AgentShield returns ALL providers (even unconfigured ones).
+    // Only use providers explicitly configured by the user.
     throw new Error(
-      `Tool requires OAuth but no provider could be resolved. ` +
-        `Either specify oauthProvider in tool protection config, or configure at least one provider for project "${projectId}".`
+      `Tool requires OAuth but no provider is configured for project "${projectId}". ` +
+        `Configure an OAuth provider in AgentShield dashboard.`
     );
   }