fix(mcp): bound and tear down one-shot OAuth fetches so auth can't hang

[waleedlatif1]

Summary

• Root-caused the Gauge MCP OAuth "Connecting… forever" hang on staging: the SSRF-guarded fetch used for all one-shot OAuth legs (discovery, dynamic client registration, token exchange/refresh, RFC 7009 revocation) created a fresh pinned undici Agent per request and never destroyed it, and returned the live response so the MCP SDK read the body outside any deadline. The SDK sets no timeout on OAuth legs, so a stalled body read or an accumulating leaked keep-alive socket could leave the callback (and the browser waiting on it) pending indefinitely.
• Empirically confirmed via a staging diagnostic + DB: the callback burned its state, completed discovery, then hung before the token POST — no token exchange, no error, tokens never persisted. An isolated repro proved the SDK/flow itself reaches the token POST in <1s; the guard's lifecycle was the fault.

What changed

• Buffer the (always-small) OAuth JSON body inside the guard, under the composed deadline/caller AbortSignal, then return a detached in-memory Response. undici's bodyTimeout only measures idle gaps between chunks and cannot bound a slow-drip/stalled body — the AbortSignal is the only true wall-clock deadline over the body read, so the read now lives inside it.
• destroy() (not close()) the per-request pinned Agent on every path so a one-shot leg can't strand its keep-alive socket, and teardown itself can't hang on an in-flight request.
• Fixed the same per-request Agent leak in the auth-type probe (tears the Agent down after best-effort session cleanup settles).
• Returning a normalized global Response also makes provider token-endpoint errors surface cleanly instead of the SDK's opaque "[object Response]" parse failure.

Aligned with the official MCP TypeScript SDK's contract (all lifecycle/deadline enforcement lives in the injected fetch) and undici best practice (per-request pinned Agent → buffer body → destroy(); AbortSignal as the authoritative deadline).

Type of Change

• Bug fix

Testing

• Unit: 14 guard tests (pinning, teardown on success/failure, detached-body readability, deadline over a stalled body read, DNS/abort composition) + updated probe/revoke suites — full lib/mcp suite green (366 tests).
• Integration against live Gauge: drove the real SDK auth() with the new guard behavior — reaches the token POST, returns in ~1.9s, 0 leaked Agents (8 created / 8 destroyed), and surfaces a clean invalid_grant message.
• tsc clean; biome clean.
• Not yet re-run through the full staging OAuth flow end-to-end (the temporary McpHttpDiag logging from diag(mcp): comprehensive HTTP logging for OAuth + streamable-HTTP transport #5782 is still live and will confirm the token POST now fires; a follow-up removes it once verified).

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 21, 2026 1:52am

[cursor]

PR Summary

Medium Risk
Touches security-sensitive MCP OAuth/SSRF fetch paths and connection lifecycle; behavior changes are well-tested but affect all OAuth discovery/token/revocation legs.

Overview
Fixes MCP OAuth flows that could hang indefinitely (“Connecting… forever”) because one-shot legs used a per-request pinned undici Agent that was never destroyed and returned live responses so the MCP SDK read bodies outside any deadline.

createSsrfGuardedMcpFetch now buffers small OAuth JSON under the composed timeout/caller AbortSignal and returns a detached in-memory Response, so SSRF validation, the HTTP request, and the body read all respect the wall-clock deadline. Per-request pinned Agents are destroy()ed on every path (with a 1 MB maxResponseSize DoS cap via createPinnedFetchWithDispatcher). text/event-stream probe replies stay streaming (tee + drain) so auth classification from headers still works.

detectMcpAuthType switches to createPinnedFetchWithDispatcher when a pre-validated IP is supplied and tears down the Agent after best-effort session DELETE completes.

Tests expand coverage for teardown, buffered bodies, stalled body reads, oversized responses, and SSE vs JSON handling.

^{Reviewed by Cursor Bugbot for commit 66c6f33. Configure here.}

[greptile-apps]

Greptile Summary

This PR prevents one-shot MCP OAuth requests from hanging indefinitely. The main changes are:

• Buffers OAuth response bodies within the request deadline.
• Returns detached in-memory responses to SDK callers.
• Destroys per-request pinned Agents after requests and probes.
• Adds a response-size limit for pinned OAuth fetches.
• Expands tests for timeouts, teardown, streaming responses, and revocation.

Confidence Score: 5/5

The latest changes appear safe to merge.

• No additional blocking issue qualifies for this follow-up review.

Important Files Changed

Filename	Overview
apps/sim/lib/mcp/pinned-fetch.ts	Adds deadline-bound body handling, detached responses, streaming cleanup, response limits, and Agent teardown.
apps/sim/lib/core/security/input-validation.server.ts	Adds optional response-size limits to pinned undici Agents.
apps/sim/lib/mcp/oauth/probe.ts	Keeps the pinned Agent alive through session cleanup and then destroys it.

_{Reviews (3): Last reviewed commit: "fix(mcp): bound and tear down one-shot O..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 66c6f33. Configure here.}