Bound MCP discovery with a probe deadline

discoverTools (the shared connect+listTools path behind resolveTools,
detect, probeEndpoint, and checkHealth) had no timeout of its own, and
neither the MCP SDK's connect handshake nor listTools call one either.
An unresponsive endpoint (a closed loopback port after its e2e scenario's
scope exits, a server wedged mid-handshake) hung the calling fiber, and
with it the server-side request handling it ran under, indefinitely.

Under CI shard load this showed up as auth-methods-ui.test.ts sitting on
its 90s auto-probe wait and then hitting the full 120s vitest timeout,
followed by every later test failing "login did not redirect to AuthKit
(500)": the dev server's request-handling capacity was pinned by fibers
stuck in an unbounded MCP connect, starving unrelated routes.

Give discoverTools a default 15s deadline (Effect.timeoutOrElse), mapping
a timeout to the same McpToolDiscoveryError("connect") shape a failed
connect already produces, so callers' existing handling (auth
classification, incomplete-tools fallback, health "degraded" status) all
keeps working unchanged. Connections that DID get established before the
deadline still close via the existing Effect.onExit handler, which fires
on interruption too.

Note: discoverTools already closed its connection deterministically via
Effect.onExit — there was no connector/session leak. The bug was purely
missing deadline, not missing cleanup.

Author: RhysSullivan

packages/plugins/mcp/src/sdk/discover.ts

@@ -2,7 +2,7 @@
 // MCP tool discovery — connect to an MCP server and list its tools
 // ---------------------------------------------------------------------------
 
-import { Effect, Option, Predicate } from "effect";
+import { Duration, Effect, Option, Predicate } from "effect";
 
 import type { McpConnection, McpConnector } from "./connection";
 import { McpToolDiscoveryError } from "./errors";
@@ -17,6 +17,18 @@ import {
 // omitting `nextCursor`, so any real catalog fits well inside this.
 const MAX_LIST_TOOLS_PAGES = 100;
 
+// Every caller of `discoverTools` (resolveTools, detect, probeEndpoint,
+// checkHealth) is a probe: dial a server we don't control and list its
+// tools. Neither the MCP SDK's transport connect nor its `listTools` call
+// carries a deadline of its own against a server that never answers (a
+// closed/half-open loopback socket, a server wedged mid-handshake), so
+// without a bound here a single unresponsive endpoint hangs the calling
+// fiber forever. Mirrors the shape-probe fallback's default
+// (`probeMcpEndpointShape`'s `timeoutMs = 8_000`) at a slightly longer
+// bound since a real handshake + listTools round-trip is heavier than the
+// shape probe's single unauth POST.
+const DEFAULT_DISCOVER_TIMEOUT = Duration.seconds(15);
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -70,9 +82,19 @@ const listAllTools = (
 /**
  * Connect to an MCP server and discover all available tools.
  * Returns the parsed manifest containing server metadata and tool entries.
+ *
+ * Bounded by `timeoutMs` (default `DEFAULT_DISCOVER_TIMEOUT`): every caller
+ * is dialing a server we don't control, and neither the connect handshake
+ * nor `listTools` has a deadline of its own, so an unresponsive endpoint
+ * (dead loopback port, wedged mid-handshake) would otherwise hang the
+ * calling fiber — and, transitively, the server-side request handling it —
+ * forever. On timeout, any connection that DID get established is closed
+ * before the timeout error is raised (`Effect.onExit` still fires for an
+ * interrupted fiber).
  */
 export const discoverTools = (
   connector: McpConnector,
+  timeoutMs: number = Duration.toMillis(DEFAULT_DISCOVER_TIMEOUT),
 ): Effect.Effect<McpToolManifest, McpToolDiscoveryError> =>
   Effect.gen(function* () {
     // Acquire connection
@@ -96,7 +118,18 @@ export const discoverTools = (
     );
 
     return manifest;
-  });
+  }).pipe(
+    Effect.timeoutOrElse({
+      duration: Duration.millis(timeoutMs),
+      orElse: () =>
+        Effect.fail(
+          new McpToolDiscoveryError({
+            stage: "connect",
+            message: `MCP discovery timed out after ${timeoutMs}ms`,
+          }),
+        ),
+    }),
+  );
 
 const closeConnection = (connection: {
   readonly close: () => Promise<void>;