Update stdio preflight to detect required stdio_env vars and preflight with those stored values

Author: Griffin Evans

packages/core/sdk/src/executor.ts

@@ -3308,6 +3308,7 @@ export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = rea
           remove: (ref) => connectionsRemove(ref),
           refresh: (ref) => connectionsRefresh(ref),
           resolveValue: (ref) => resolveConnectionValueByRef(ref),
+          resolveValues: (ref) => resolveConnectionValuesByRef(ref),
         },
         providers: {
           list: () => providersList(),

packages/core/sdk/src/plugin.ts

@@ -219,9 +219,13 @@ export interface PluginCtx<TStore = unknown> {
       readonly Tool[],
       ConnectionNotFoundError | IntegrationNotFoundError | StorageFailure
     >;
-    /** Resolve a connection's value through its provider (and OAuth refresh).
+    /** Resolve a connection's primary value through its provider (and OAuth refresh).
      *  null if the provider can't produce one. */
     readonly resolveValue: (ref: ConnectionRef) => Effect.Effect<string | null, StorageFailure>;
+    /** Resolve every named input for a connection through its provider. */
+    readonly resolveValues: (
+      ref: ConnectionRef,
+    ) => Effect.Effect<Record<string, string | null>, StorageFailure>;
   };
 
   /** Registered credential backends — for discovery (browse a backend's items). */

packages/plugins/mcp/src/sdk/plugin.test.ts

@@ -147,7 +147,7 @@ const withStdioFixtureScript = Effect.acquireRelease(
     yield* Effect.promise(() =>
       Fs.writeFile(
         script,
-        `import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";\nimport { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";\nconst toolName = process.argv[2] ?? "one";\nconst server = new McpServer({ name: "stdio-fixture", version: "1.0.0" }, { capabilities: {} });\nserver.registerTool(toolName, { description: "Stdio fixture tool", inputSchema: {} }, async () => ({ content: [{ type: "text", text: process.env.STDIO_VALUE ?? "ok" }] }));\nawait server.connect(new StdioServerTransport());\n`,
+        `import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";\nimport { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";\nconst toolName = process.argv[2] ?? "one";\nconst requiredEnv = process.argv[3];\nif (requiredEnv && process.env[requiredEnv] == null) process.exit(1);\nconst server = new McpServer({ name: "stdio-fixture", version: "1.0.0" }, { capabilities: {} });\nserver.registerTool(toolName, { description: "Stdio fixture tool", inputSchema: {} }, async () => ({ content: [{ type: "text", text: process.env.STDIO_VALUE ?? process.env.STDIO_SECRET ?? "ok" }] }));\nawait server.connect(new StdioServerTransport());\n`,
       ),
     );
     return { dir, script } as const;
@@ -602,6 +602,95 @@ describe("mcpPlugin", () => {
     ),
   );
 
+  it.effect(
+    "configureServer preflights stdio secret env sources with existing connection values",
+    () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const fixture = yield* withStdioFixtureScript;
+          const executor = yield* createExecutor(
+            makeTestConfig({
+              plugins: [
+                memoryCredentialsPlugin(),
+                mcpPlugin({ dangerouslyAllowStdioMCP: true }),
+              ] as const,
+            }),
+          );
+
+          yield* executor.mcp.addServer({
+            transport: "stdio",
+            name: "Stdio secret edit",
+            slug: "stdio_secret_edit",
+            command: process.execPath,
+            args: [fixture.script, "one", "STDIO_SECRET"],
+            envVars: ["STDIO_SECRET"],
+          });
+          yield* executor.connections.create({
+            owner: "org",
+            name: ConnectionName.make("default"),
+            integration: IntegrationSlug.make("stdio_secret_edit"),
+            template: AuthTemplateSlug.make("env"),
+            values: { STDIO_SECRET: "secret-value" },
+          });
+
+          yield* executor.mcp.configureServer("stdio_secret_edit", {
+            transport: "stdio",
+            command: process.execPath,
+            args: [fixture.script, "two", "STDIO_SECRET"],
+            authenticationTemplate: [{ slug: "env", kind: "stdio_env", vars: ["STDIO_SECRET"] }],
+          });
+
+          const tools = yield* executor.tools.list({
+            integration: IntegrationSlug.make("stdio_secret_edit"),
+          });
+          expect(tools.map((tool) => String(tool.name))).toContain("two");
+          expect(tools.map((tool) => String(tool.name))).not.toContain("one");
+        }),
+      ),
+  );
+
+  it.effect("configureServer reports missing stdio secret values before preflight", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fixture = yield* withStdioFixtureScript;
+        const executor = yield* createExecutor(
+          makeTestConfig({
+            plugins: [
+              memoryCredentialsPlugin(),
+              mcpPlugin({ dangerouslyAllowStdioMCP: true }),
+            ] as const,
+          }),
+        );
+
+        yield* executor.mcp.addServer({
+          transport: "stdio",
+          name: "Stdio secret missing",
+          slug: "stdio_secret_missing",
+          command: process.execPath,
+          args: [fixture.script, "one", "STDIO_SECRET"],
+          envVars: ["STDIO_SECRET"],
+        });
+
+        const result = yield* Effect.result(
+          executor.mcp.configureServer("stdio_secret_missing", {
+            transport: "stdio",
+            command: process.execPath,
+            args: [fixture.script, "two", "STDIO_SECRET"],
+            authenticationTemplate: [{ slug: "env", kind: "stdio_env", vars: ["STDIO_SECRET"] }],
+          }),
+        );
+
+        expect(Result.isFailure(result)).toBe(true);
+        const failure = Result.isFailure(result) ? result.failure : null;
+        expect(failure).toMatchObject({
+          _tag: "McpConnectionError",
+          message:
+            "Cannot validate this command because no visible connection has values for required environment variables: STDIO_SECRET.",
+        });
+      }),
+    ),
+  );
+
   it.effect("configureServer blocks invalid stdio configs without updating", () =>
     Effect.scoped(
       Effect.gen(function* () {

packages/plugins/mcp/src/sdk/plugin.ts

@@ -1036,16 +1036,61 @@ export const mcpPlugin = definePlugin((options?: McpPluginOptions) => {
           }),
         );
 
-      const preflightStdioConfig = (config: McpIntegrationConfigType) =>
+      const requiredStdioEnvVars = (config: McpStdioIntegrationConfig): readonly string[] => [
+        ...new Set(
+          (config.authenticationTemplate ?? []).flatMap((method: McpAuthMethod) =>
+            method.kind === "stdio_env" ? method.vars : [],
+          ),
+        ),
+      ];
+
+      const missingStdioEnvVars = (
+        requiredVars: readonly string[],
+        values: Record<string, string | null>,
+      ): readonly string[] => requiredVars.filter((variable) => values[variable] == null);
+
+      const preflightStdioConfig = (
+        integration: IntegrationSlug,
+        config: McpStdioIntegrationConfig,
+      ) =>
         Effect.gen(function* () {
-          const connectorInput = yield* buildConnectorInput(
-            config,
-            {},
-            null,
-            allowStdio,
-            httpClientLayer,
-          );
-          yield* discoverTools(createMcpConnector(connectorInput));
+          const requiredVars = requiredStdioEnvVars(config);
+          if (requiredVars.length === 0) {
+            const connectorInput = yield* buildConnectorInput(
+              config,
+              {},
+              null,
+              allowStdio,
+              httpClientLayer,
+            );
+            yield* discoverTools(createMcpConnector(connectorInput));
+            return;
+          }
+
+          const connections = yield* ctx.connections.list({ integration });
+          for (const connection of connections) {
+            const template = String(connection.template);
+            const method = selectAuthMethod(config, template);
+            if (method?.kind !== "stdio_env") continue;
+
+            const values = yield* ctx.connections.resolveValues(connection);
+            if (missingStdioEnvVars(method.vars, values).length > 0) continue;
+
+            const connectorInput = yield* buildConnectorInput(
+              config,
+              values,
+              template,
+              allowStdio,
+              httpClientLayer,
+            );
+            yield* discoverTools(createMcpConnector(connectorInput));
+            return;
+          }
+
+          return yield* new McpConnectionError({
+            transport: "stdio",
+            message: `Cannot validate this command because no visible connection has values for required environment variables: ${requiredVars.join(", ")}.`,
+          });
         });
 
       const removePoliciesScopedToIntegration = (integration: IntegrationSlug) =>
@@ -1141,7 +1186,7 @@ export const mcpPlugin = definePlugin((options?: McpPluginOptions) => {
             return;
           }
 
-          yield* preflightStdioConfig(config);
+          yield* preflightStdioConfig(integration, config);
           yield* ctx.transaction(
             Effect.gen(function* () {
               yield* removePoliciesScopedToIntegration(integration);