feat(copilot): run_mcp_tool — MCP server discovery and execution in Otto - #12213

Merged

majdyz merged 36 commits into

devfrom

feat/mcp-copilot

Mar 4, 2026

Commits on Mar 3, 2026

feat(copilot): add run_mcp_tool for MCP server discovery and execution
majdyz
committed
91ae792
fix(copilot): add mcp_tools_discovered and mcp_tool_output to openapi.json ResponseType enum
majdyz
committed
93e324a
fix(copilot): address CodeRabbit review — SSRF protection, error sanitization, error card UI
majdyz
committed
5d38185
fix(copilot): escape {key: value} format placeholder in DEFAULT_SYSTEM_PROMPT
majdyz
committed
5514cde
fix(copilot): improve MCP auth retry flow and run_mcp_tool vs web_fetch guidance
majdyz
committed
02e7483
fix(copilot): prevent run_mcp_tool hallucination when explicitly requested
majdyz
committed
e75ed96
fix(copilot): address CodeRabbit review — validation, credential safety, generated types
majdyz
committed
abf400c
fix(copilot): expose MCPToolsDiscoveredResponse and MCPToolOutputResponse in OpenAPI schema
majdyz
committed
7c190b0
test(copilot): add unit tests for run_mcp_tool
majdyz
committed
2995944
test(copilot): add vitest unit tests for RunMCPTool helpers
majdyz
committed
3280435
fix(copilot): address CodeRabbit review — log redaction and input_schema required
majdyz
committed
85b4b4d
fix(copilot): reject credential-bearing server_url before processing
majdyz
committed
29abd90
fix(copilot): redact server_url in _build_setup_requirements logger
majdyz
committed
e71bcf6
feat(copilot): address autogpt-reviewer should-fix items
majdyz
committed
b2ee88a
fix(copilot): MCP local test fixes — OAuth flow, error messages, content types
majdyz
committed
0bcd95a
fix(copilot): replace registry web_fetch with web_search for finding MCP server URLs
majdyz
committed
37db3ea
fix(copilot): add correct registry API endpoint to system prompt
majdyz
committed
44d972c
feat(copilot): show tool argument preview in MCP tool animation + fix finding-servers guidance
majdyz
committed
c39f642
fix(copilot): escape {service} and {query} in system prompt — KeyError crash
majdyz
committed
b01a626
fix(copilot): store manual MCP token as credential, fix image max-height
majdyz
committed
d277e50
fix(copilot): address reviewer should-fix items — token safety, arg preview, a11y
majdyz
committed
6af8781
chore: update openapi.json with POST /v2/mcp/token endpoint
majdyz
committed
4fcc19c
fix(mcp): normalize server_url and return hostname in token endpoint
majdyz
committed
5962131
fix(copilot): address CodeRabbit comments on MCPSetupCard and openapi.json
majdyz
committed
4cc6cd1
fix(copilot): normalize server_url in run_mcp_tool to match stored credentials
majdyz
committed
f0f0758
fix(copilot): reject query/fragment in server_url, loosen 2xx check, add min_length
majdyz
committed
b3867d4
fix(mcp): normalize server_url in OAuth login to match token endpoint
majdyz
committed
b3873c1
chore: fix openapi.json token field ordering to match backend codegen
majdyz
committed
46e8eac
fix(copilot): null-guard setup_info, keep original URL for MCPClient
majdyz
committed
770b13c
refactor(mcp): extract shared helpers, add SSRF validation and tests
majdyz
committed
f059ffe
feat(copilot): use generated API client in MCPSetupCard, add tests
majdyz
committed
641050f
fix(mcp): patch auto_lookup_mcp_credential in route tests
majdyz
committed
6ba41ca
fix(mcp): use >= tiebreaker in credential lookup, fix ReDoS in parse_url
majdyz
committed
4f5c966
fix: replace regex with string check in parse_url to resolve CodeQL ReDoS
majdyz
committed
91403ac
fix(copilot): use 2xx range check for OAuth status codes in MCPSetupCard
majdyz
committed
2fd34c5
fix: resolve merge conflict with dev (keep both MCP + browser models)
Otto-AGPT
committed
5dd0506