@opengeni/core 0.2.1 → 0.3.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Settings } from '@opengeni/config';
-import { ScheduledTask, Document, Permission, AccessContext, AccessGrant, LimitAction, LimitDecision, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, CapabilityCatalogItem, CapabilityInstallation, EnableCapabilityRequest, WorkspaceEnvironment, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, ReasoningEffort, SessionEvent, SessionTurn, GoalSpec, Session, WorkspaceMember } from '@opengeni/contracts';
+import { ScheduledTask, Document, Permission, AccessContext, AccessGrant, LimitAction, LimitDecision, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, CapabilityCatalogItem, CapabilityInstallation, EnableCapabilityRequest, WorkspaceEnvironment, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, GoalSpec, SessionMcpServerMetadata, Session, WorkspaceMember } from '@opengeni/contracts';
 export { mergeToolRefs, stableJson } from '@opengeni/contracts';
-import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput } from '@opengeni/db';
+import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput } from '@opengeni/db';
 import { DocumentServices } from '@opengeni/documents';
 import { EventBus } from '@opengeni/events';
 import { Observability } from '@opengeni/observability';
@@ -534,6 +534,7 @@ declare function manualScheduledTaskTriggerWorkflowId(taskId: string, triggerTok
  */
 declare function manualScheduledTaskTriggerUsageKey(workspaceId: string, taskId: string, triggerToken: string): string;
 
+declare function settingsWithSessionMcpServerMetadata(settings: Settings, servers: SessionMcpServerMetadata[]): Settings;
 declare function createAndStartSession(input: {
     db: Database;
     bus: EventBus;
@@ -554,6 +555,8 @@ declare function createAndStartSession(input: {
     } | null;
     goal?: GoalSpec | null;
     firstPartyMcpPermissions?: Permission[] | null;
+    mcpServers?: CreateSessionMcpServerInput[];
+    sessionMcpServers?: SessionMcpServerMetadata[];
     parentSessionId?: string | null;
     createIdempotencyKey?: string | null;
     sandboxGroupId?: string | null;
@@ -597,7 +600,14 @@ declare function createAndStartSession(input: {
     activeSandboxId: string | null;
     activeEpoch: number;
     environmentId: string | null;
-    firstPartyMcpPermissions: ("account:read" | "account:admin" | "members:manage" | "workspace:create" | "billing:read" | "billing:manage" | "workspace:read" | "workspace:admin" | "sessions:create" | "sessions:read" | "sessions:control" | "stream:view" | "stream:control" | "stream:acknowledge" | "files:upload" | "files:read" | "files:write" | "terminal:attach" | "documents:manage" | "documents:search" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "github:manage" | "github:use" | "api_keys:manage" | "environments:manage" | "environments:use" | "goals:manage" | "enrollments:read" | "enrollments:manage")[] | null;
+    firstPartyMcpPermissions: ("account:read" | "account:admin" | "members:manage" | "workspace:create" | "billing:read" | "billing:manage" | "workspace:read" | "workspace:admin" | "sessions:create" | "sessions:read" | "sessions:control" | "stream:view" | "stream:control" | "stream:acknowledge" | "files:upload" | "files:read" | "files:write" | "terminal:attach" | "documents:manage" | "documents:search" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "github:manage" | "github:use" | "api_keys:manage" | "environments:manage" | "environments:use" | "mcp_servers:attach" | "goals:manage" | "enrollments:read" | "enrollments:manage")[] | null;
+    mcpServers: {
+        id: string;
+        name: string | null;
+        url: string;
+        headerNames: string[];
+        credentialVersion: number;
+    }[];
     parentSessionId: string | null;
     createIdempotencyKey: string | null;
     temporalWorkflowId: string | null;
@@ -650,6 +660,7 @@ declare function postUserMessageTurn(input: {
     model?: string | null;
     reasoningEffort?: Settings["openaiReasoningEffort"] | null;
     clientEventId?: string;
+    mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
 }): Promise<{
     accepted: SessionEvent;
     turn: SessionTurn;
@@ -677,6 +688,7 @@ declare function acceptSessionUserMessage(deps: ApiRouteDeps, grant: AccessGrant
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     clientEventId?: string;
+    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
 }): Promise<{
     accepted: SessionEvent;
     turn: SessionTurn;
@@ -732,4 +744,4 @@ declare function assertWorkspaceDeletable(input: {
     activeSessionCount: number;
 }): void;
 
-export { type AccessDeps, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type LimitCheckInput, MARKETING_SOCIAL_PACK_ID, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResumeBoxByIdInput, type ResumedSandboxSession, type RunOnOp, type RunOnResult, type SessionWorkflowClient, acceptSessionUserMessage, assertAllowedEnvironmentVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, checkLimit, createAndStartSession, createCatalogItem, createSessionForRequest, createValidatedScheduledTask, disableCapability, discoverMcpRegistryCapabilities, enableCapability, enabledCapabilityMcpToolRefs, getCapabilityPack, hasPermission, isBuiltInCapabilityPack, isUserMember, listCapabilityPacks, listFleet, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, normalizeResources, officialMcpRegistryUrl, postUserMessageTurn, provisionSandbox, reasoningEffortForSession, recordEnvironmentAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireEnvironmentForApi, requireLimit, requirePermission, requireQueuedTurnForApi, requireScheduledTaskForApi, resolveCapabilityPack, resolveMemberSubjectId, restoreScheduledTask, routingEnabled, runOnSandbox, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateSessionTitle, validateEnvironmentAttachment, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateMcpCapabilityConnection, validateToolRefs, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, wrapChannelABoxWithRouting };
+export { type AccessDeps, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type LimitCheckInput, MARKETING_SOCIAL_PACK_ID, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResumeBoxByIdInput, type ResumedSandboxSession, type RunOnOp, type RunOnResult, type SessionWorkflowClient, acceptSessionUserMessage, assertAllowedEnvironmentVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, checkLimit, createAndStartSession, createCatalogItem, createSessionForRequest, createValidatedScheduledTask, disableCapability, discoverMcpRegistryCapabilities, enableCapability, enabledCapabilityMcpToolRefs, getCapabilityPack, hasPermission, isBuiltInCapabilityPack, isUserMember, listCapabilityPacks, listFleet, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, normalizeResources, officialMcpRegistryUrl, postUserMessageTurn, provisionSandbox, reasoningEffortForSession, recordEnvironmentAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireEnvironmentForApi, requireLimit, requirePermission, requireQueuedTurnForApi, requireScheduledTaskForApi, resolveCapabilityPack, resolveMemberSubjectId, restoreScheduledTask, routingEnabled, runOnSandbox, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateSessionTitle, validateEnvironmentAttachment, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateMcpCapabilityConnection, validateToolRefs, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, wrapChannelABoxWithRouting };

package/dist/index.js

@@ -1664,22 +1664,21 @@ import {
 import { HTTPException as HTTPException7 } from "hono/http-exception";
 function validateToolRefs(tools, settings) {
   const mcpServerIds = new Set(settings.mcpServers.map((server) => server.id));
-  const selected = /* @__PURE__ */ new Set();
   const out = [];
   for (const tool of tools) {
     if (tool.kind !== "mcp") {
       throw new HTTPException7(422, { message: `unsupported tool kind: ${tool.kind}` });
     }
+    const optional = tool.optional === true;
     if (!mcpServerIds.has(tool.id)) {
+      if (optional) {
+        continue;
+      }
       throw new HTTPException7(422, { message: `unknown MCP server id: ${tool.id}` });
     }
-    if (selected.has(tool.id)) {
-      continue;
-    }
-    selected.add(tool.id);
-    out.push({ kind: "mcp", id: tool.id });
+    out.push(optional ? { kind: "mcp", id: tool.id, optional: true } : { kind: "mcp", id: tool.id });
   }
-  return out;
+  return mergeToolRefs([], out);
 }
 function enabledCapabilityMcpToolRefs(settings, runtimeSettings) {
   const configuredIds = new Set(settings.mcpServers.map((server) => server.id));
@@ -1865,6 +1864,7 @@ import {
   createSessionGoal,
   createSessionWithIdempotencyKey,
   enqueueSessionTurn,
+  encryptEnvironmentValue as encryptEnvironmentValue2,
   getAnySessionInGroup,
   getEnrollment as getEnrollment2,
   listDistinctEnvironmentIdsInGroup,
@@ -1878,6 +1878,140 @@ import {
 } from "@opengeni/db";
 import { appendAndPublishEvents } from "@opengeni/events";
 import { HTTPException as HTTPException8 } from "hono/http-exception";
+var reservedSessionMcpServerIds = /* @__PURE__ */ new Set(["opengeni", "files", "docs", "codex_apps"]);
+var maxSessionMcpCredentialHeaders = 16;
+var maxSessionMcpCredentialHeaderValueLength = 4096;
+var sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+function normalizedSessionMcpCredentialHeaders(headers) {
+  if (!headers) {
+    return {};
+  }
+  const entries = Object.entries(headers).map(([name, value]) => [name.trim(), value]).filter(([name]) => name.length > 0);
+  if (entries.length > maxSessionMcpCredentialHeaders) {
+    throw new HTTPException8(422, { message: `a session MCP server supports at most ${maxSessionMcpCredentialHeaders} credential headers` });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [name, value] of entries) {
+    if (!sessionMcpCredentialHeaderName.test(name)) {
+      throw new HTTPException8(422, { message: `invalid credential header name: ${name}` });
+    }
+    const lower = name.toLowerCase();
+    if (seen.has(lower)) {
+      throw new HTTPException8(422, { message: `duplicate credential header name: ${name}` });
+    }
+    seen.add(lower);
+    if (value.length === 0 || value.length > maxSessionMcpCredentialHeaderValueLength) {
+      throw new HTTPException8(422, { message: `credential header ${name} must be 1-${maxSessionMcpCredentialHeaderValueLength} characters` });
+    }
+    if (/[\u0000-\u0008\u000A-\u001F\u007F]/.test(value)) {
+      throw new HTTPException8(422, { message: `credential header ${name} contains forbidden control characters` });
+    }
+  }
+  return Object.fromEntries(entries);
+}
+function mcpServerConfigFromInput(server) {
+  return {
+    id: server.id,
+    ...server.name ? { name: server.name } : {},
+    url: server.url,
+    ...server.allowedTools ? { allowedTools: server.allowedTools } : {},
+    ...server.timeoutMs ? { timeoutMs: server.timeoutMs } : {},
+    cacheToolsList: server.cacheToolsList ?? false
+  };
+}
+function mcpServerConfigFromMetadata(server) {
+  return {
+    id: server.id,
+    ...server.name ? { name: server.name } : {},
+    url: server.url,
+    cacheToolsList: false
+  };
+}
+function settingsWithSessionMcpServerConfigs(settings, servers) {
+  if (servers.length === 0) {
+    return settings;
+  }
+  const sessionIds = new Set(servers.map((server) => server.id));
+  return {
+    ...settings,
+    mcpServers: [
+      ...settings.mcpServers.filter((server) => !sessionIds.has(server.id)),
+      ...servers
+    ]
+  };
+}
+function settingsWithSessionMcpServerMetadata(settings, servers) {
+  return settingsWithSessionMcpServerConfigs(settings, servers.map(mcpServerConfigFromMetadata));
+}
+function validateSessionMcpServersForCreate(settings, grant, servers) {
+  if (servers.length === 0) {
+    return { runtimeServers: [], dbServers: [], metadata: [] };
+  }
+  requirePermission(grant, "mcp_servers:attach");
+  const encryptionKey = requireEnvironmentEncryption(settings);
+  const existingIds = new Set(settings.mcpServers.map((server) => server.id));
+  const seenIds = /* @__PURE__ */ new Set();
+  const runtimeServers = [];
+  const dbServers = [];
+  const metadata = [];
+  for (const server of servers) {
+    if (seenIds.has(server.id)) {
+      throw new HTTPException8(422, { message: `duplicate session MCP server id: ${server.id}` });
+    }
+    seenIds.add(server.id);
+    if (reservedSessionMcpServerIds.has(server.id) || existingIds.has(server.id)) {
+      throw new HTTPException8(422, { message: `MCP server id already exists: ${server.id}` });
+    }
+    const headers = normalizedSessionMcpCredentialHeaders(server.headers);
+    const headersEncrypted = Object.fromEntries(
+      Object.entries(headers).map(([name, value]) => [name, encryptEnvironmentValue2(encryptionKey, value)])
+    );
+    runtimeServers.push(mcpServerConfigFromInput(server));
+    dbServers.push({
+      id: server.id,
+      name: server.name ?? null,
+      url: server.url,
+      allowedTools: server.allowedTools ?? null,
+      timeoutMs: server.timeoutMs ?? null,
+      cacheToolsList: server.cacheToolsList ?? false,
+      headersEncrypted
+    });
+    metadata.push({
+      id: server.id,
+      name: server.name ?? null,
+      url: server.url,
+      headerNames: Object.keys(headersEncrypted).sort(),
+      credentialVersion: 1
+    });
+  }
+  return { runtimeServers, dbServers, metadata };
+}
+function validateSessionMcpCredentialUpdates(input) {
+  if (input.updates.length === 0) {
+    return [];
+  }
+  requirePermission(input.grant, "mcp_servers:attach");
+  const encryptionKey = requireEnvironmentEncryption(input.settings);
+  const knownIds = new Set(input.session.mcpServers.map((server) => server.id));
+  const seenIds = /* @__PURE__ */ new Set();
+  const encryptedUpdates = input.updates.map((update) => {
+    if (seenIds.has(update.id)) {
+      throw new HTTPException8(422, { message: `duplicate session MCP credential update id: ${update.id}` });
+    }
+    seenIds.add(update.id);
+    if (!knownIds.has(update.id)) {
+      throw new HTTPException8(422, { message: `unknown session MCP server id: ${update.id}` });
+    }
+    const headers = normalizedSessionMcpCredentialHeaders(update.headers);
+    return {
+      id: update.id,
+      headersEncrypted: Object.fromEntries(
+        Object.entries(headers).map(([name, value]) => [name, encryptEnvironmentValue2(encryptionKey, value)])
+      )
+    };
+  });
+  return encryptedUpdates;
+}
 async function createAndStartSession(input) {
   const sessionMetadata = {
     ...input.metadata,
@@ -1903,7 +2037,8 @@ async function createAndStartSession(input) {
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
       sandboxGroupId: input.sandboxGroupId ?? null,
-      ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}
+      ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
+      mcpServers: input.mcpServers ?? []
     });
     if (!created) {
       return keyed;
@@ -1923,7 +2058,8 @@ async function createAndStartSession(input) {
     firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
     parentSessionId: input.parentSessionId ?? null,
     sandboxGroupId: input.sandboxGroupId ?? null,
-    ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}
+    ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
+    mcpServers: input.mcpServers ?? []
   });
   return await finishStartSession(input, session);
 }
@@ -1947,7 +2083,8 @@ async function finishStartSession(input, session) {
       type: "session.created",
       payload: {
         status: "queued",
-        ...input.environment ? { environmentId: input.environment.id, environmentName: input.environment.name } : {}
+        ...input.environment ? { environmentId: input.environment.id, environmentName: input.environment.name } : {},
+        ...input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}
       }
     },
     ...goal ? [{
@@ -2057,10 +2194,14 @@ async function postUserMessageTurn(input) {
   const requestedModel = input.model ?? null;
   const requestedReasoningEffort = input.reasoningEffort ?? null;
   assertConfiguredModel(settings, requestedModel);
-  const appended = await appendSessionEventsWithLockedSessionUpdate(db, workspaceId, sessionId, (lockedSession) => {
+  const appended = await appendSessionEventsWithLockedSessionUpdate(db, workspaceId, sessionId, async (lockedSession, lockedUpdate) => {
     if (lockedSession.status === "cancelled") {
       throw new HTTPException8(409, { message: `session is ${lockedSession.status}; cannot accept a new user message` });
     }
+    const mcpCredentialUpdates = input.mcpCredentialUpdates?.length ? await lockedUpdate.updateSessionMcpServerCredentials(input.mcpCredentialUpdates) : { servers: [], missingIds: [] };
+    if (mcpCredentialUpdates.missingIds.length > 0) {
+      throw new HTTPException8(422, { message: `unknown session MCP server id: ${mcpCredentialUpdates.missingIds[0]}` });
+    }
     const nextResources = mergeResourceRefs(lockedSession.resources, input.resources);
     const nextTools = mergeToolRefs(lockedSession.tools, input.tools);
     const shouldQueueSession = lockedSession.status === "idle" || lockedSession.status === "failed";
@@ -2073,7 +2214,8 @@ async function postUserMessageTurn(input) {
             ...input.resources.length ? { resources: input.resources } : {},
             ...input.tools.length ? { tools: input.tools } : {},
             ...requestedModel ? { model: requestedModel } : {},
-            ...requestedReasoningEffort ? { reasoningEffort: requestedReasoningEffort } : {}
+            ...requestedReasoningEffort ? { reasoningEffort: requestedReasoningEffort } : {},
+            ...mcpCredentialUpdates.servers.length ? { mcpCredentialUpdates: mcpCredentialUpdates.servers } : {}
           },
           ...input.clientEventId ? { clientEventId: input.clientEventId } : {}
         },
@@ -2121,10 +2263,12 @@ async function postUserMessageTurn(input) {
 async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   const payload = CreateSessionRequest.parse(rawPayload);
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  const sessionMcpServers = validateSessionMcpServersForCreate(capabilityRuntimeSettings, grant, payload.mcpServers);
+  const runtimeSettings = settingsWithSessionMcpServerConfigs(capabilityRuntimeSettings, sessionMcpServers.runtimeServers);
   const resources = normalizeResources(payload.resources);
   const requestedTools = validateToolRefs(payload.tools, runtimeSettings);
-  const defaultedTools = hasOwnProperty(rawPayload, "tools") ? requestedTools : withDefaultEnabledCapabilityMcpTools(requestedTools, settings, runtimeSettings);
+  const defaultedTools = hasOwnProperty(rawPayload, "tools") ? requestedTools : withDefaultEnabledCapabilityMcpTools(requestedTools, settings, capabilityRuntimeSettings);
   const tools = withFirstPartyTools(defaultedTools, runtimeSettings);
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
@@ -2228,6 +2372,8 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     environment: environment ? { id: environment.id, name: environment.name } : null,
     goal: payload.goal ?? null,
     firstPartyMcpPermissions,
+    mcpServers: sessionMcpServers.dbServers,
+    sessionMcpServers: sessionMcpServers.metadata,
     parentSessionId,
     createIdempotencyKey: payload.idempotencyKey ?? null,
     // Create-time machine targeting (A-2a): when a target sandbox is named, the
@@ -2251,11 +2397,12 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
 }
 async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, input) {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  const existingSession = await requireSession2(db, workspaceId, sessionId);
+  const runtimeSettings = settingsWithSessionMcpServerMetadata(capabilityRuntimeSettings, existingSession.mcpServers);
   const requestedResources = normalizeResources(input.resources ?? []);
   const validatedTools = validateToolRefs(input.tools ?? [], runtimeSettings);
-  const requestedTools = input.toolsProvided ? validatedTools : withDefaultEnabledCapabilityMcpTools(validatedTools, settings, runtimeSettings);
-  const existingSession = await requireSession2(db, workspaceId, sessionId);
+  const requestedTools = input.toolsProvided ? validatedTools : withDefaultEnabledCapabilityMcpTools(validatedTools, settings, capabilityRuntimeSettings);
   await requireLimit(deps, {
     accountId: grant.accountId,
     workspaceId,
@@ -2268,6 +2415,12 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
   }
   await validateFileResources(db, workspaceId, requestedResources);
   await validateGitHubRepositorySelection(db, workspaceId, [...existingSession.resources, ...requestedResources]);
+  const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({
+    settings,
+    grant,
+    session: existingSession,
+    updates: input.mcpCredentialUpdates ?? []
+  });
   const { accepted, turn } = await postUserMessageTurn({
     db,
     bus,
@@ -2281,6 +2434,7 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     tools: requestedTools,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
+    mcpCredentialUpdates,
     ...input.clientEventId ? { clientEventId: input.clientEventId } : {}
   });
   await recordWorkspaceUsage(deps, {
@@ -2608,6 +2762,7 @@ export {
   scheduledTaskTriggerToken,
   settingsWithEnabledCapabilityMcpServers,
   settingsWithMcpCapabilityServers,
+  settingsWithSessionMcpServerMetadata,
   stableJson,
   swapActiveSandbox,
   syncCreatedScheduledTask,