Skip to content

feat(core): capture MCP OAuth client names per request - #24508

Open
betegon wants to merge 6 commits into
developfrom
feat/mcp-oauth-client-name
Open

betegon wants to merge 6 commits into
developfrom
feat/mcp-oauth-client-name

Conversation

@betegon

@betegon betegon commented Sep 18, 2026 •

Copy link
Copy Markdown
Member

OAuth registration can identify a different application from MCP clientInfo, but transport AuthInfo has no standard client name. Add an opt-in getOAuthClientName resolver that records the registered name as mcp.auth.client.name, independently of mcp.client.name.

For example, when a registered application named Example Desktop connects through a client identifying as example-connector, before the span contains only mcp.client.name = "example-connector". After configuring the resolver, it also contains mcp.auth.client.name = "Example Desktop".

Resolve the name once per incoming request, including discovery and unsupported methods. The callback receives clientId and application-defined extra metadata when available and may read request-scoped authentication context. Only the returned name is recorded; resolver failures leave dispatch intact. Preserve the wrapper's existing first-explicit-value option behavior. Real HTTP coverage exercises both MCP SDK majors in ESM/CJS, concurrent requests, and missing identities.

#25059 is merged; this branch is rebased on develop and imports MCP_AUTH_CLIENT_NAME from published @sentry/conventions@0.27.0. The conventions publication blocker is resolved. This identity distinction follows MCP client registration. Network metadata (#24506) and canonical attributes (#25060) remain separate changes.

Validated the 48-project SDK build, formatting and lint, 151 MCP unit tests, and ten real MCP SDK v1/v2 integration tests after rebase.

@betegon betegon self-assigned this Sep 18, 2026
@github-actions

github-actions Bot commented Sep 18, 2026 •

Copy link
Copy Markdown
Contributor

size-limit report 📦

Compared: 633d295 (PR test merge using develop at e02e745)

Against: e02e745 (develop) · base run #65588

✅ Baseline matches: this diff contains only this PR's changes.

Path Size % Change Change
@sentry/browser 29.92 kB - -
@sentry/browser - with treeshaking flags 28.08 kB - -
@sentry/browser - with treeshaking flags tracing without tracing 27.97 kB - -
@sentry/browser (incl. Tracing) 52.29 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 52.3 kB - -
@sentry/browser (incl. Tracing, Profiling) 55.27 kB - -
@sentry/browser (incl. Tracing, Replay) 92.7 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 81.37 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 97.43 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 110.42 kB - -
@sentry/browser (incl. Feedback) 47.52 kB - -
@sentry/browser (incl. sendFeedback) 35.02 kB - -
@sentry/browser (incl. FeedbackAsync) 40.13 kB - -
@sentry/browser (incl. Metrics) 31.48 kB - -
@sentry/browser (incl. Logs) 31.77 kB - -
@sentry/browser (incl. Metrics & Logs) 32.45 kB - -
@sentry/react 31.78 kB - -
@sentry/react (incl. Tracing) 54.76 kB - -
@sentry/vue 38.33 kB - -
@sentry/vue (incl. Tracing) 55.33 kB - -
@sentry/svelte 29.95 kB - -
@sentry/remix (Remix 3 client bundle) 57.92 kB - -
CDN Bundle 31.72 kB - -
CDN Bundle (incl. Tracing) 52.89 kB - -
CDN Bundle (incl. Logs, Metrics) 34.52 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 55.39 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 76 kB - -
CDN Bundle (incl. Tracing, Replay) 91.17 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 93.72 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 97.3 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 99.89 kB - -
CDN Bundle - uncompressed 92.76 kB - -
CDN Bundle (incl. Tracing) - uncompressed 156.02 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 101.29 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 163.79 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 233.18 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 278.04 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 285.8 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 291.74 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 299.5 kB - -
@sentry/nextjs (client) 57.73 kB - -
@sentry/sveltekit (client) 52.82 kB - -
@sentry/core/server 44.44 kB +0.29% +128 B 🔺
@sentry/core/browser 14.02 kB - -
@sentry/node 157.78 kB +0.11% +159 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 82.31 kB - -
@sentry/node - without tracing 97.21 kB +0.02% +19 B 🔺
@sentry/node - without channel injection 138.08 kB +0.13% +166 B 🔺
@sentry/aws-serverless 106.04 kB +0.02% +18 B 🔺
@sentry/cloudflare (withSentry) - minified 203.51 kB - -
@sentry/cloudflare (withSentry) 505.76 kB - -
@sentry/nextjs/cloudflare (withSentry) - minified 225.19 kB - -

View base workflow run

@betegon
betegon marked this pull request as ready for review October 5, 2026 11:34
@betegon
betegon requested a review from a team as a code owner October 5, 2026 11:34
@betegon
betegon requested review from andreiborza and mydea and removed request for a team October 5, 2026 11:34
@betegon
betegon marked this pull request as draft October 5, 2026 11:35
@betegon
betegon force-pushed the feat/mcp-oauth-client-name branch from 9b2892f to 914fd50 Compare October 5, 2026 14:50
@betegon
betegon force-pushed the feat/mcp-oauth-client-name branch from 914fd50 to ead1950 Compare October 13, 2026 08:52
betegon added a commit that referenced this pull request Oct 13, 2026
Use `@sentry/conventions/attributes` for registered MCP keys, including
all singleton and indexed result fields. The branch now uses published
conventions `0.27.0` from `develop`, so both local result prefixes can
be removed.

Before, the SDK constructed `mcp.tool.result.0.content` from a local
prefix. After, `MCP_TOOL_RESULT_KEY_CONTENT.replace('<key>', '0')`
produces that same key. Singleton keys, values, original array indexes,
and input/output capture behavior remain unchanged. Deprecated
tool-result fields stay emitted for compatibility; this change adds no
aliases or backfill.

This is the mechanical base for network metadata (#24506), OAuth
attribution (#24508), and canonical OpenTelemetry attributes (#25060).
The latter separately adds complete serialized results in
`gen_ai.tool.call.result`.
@betegon
betegon force-pushed the feat/mcp-oauth-client-name branch from ead1950 to f965bba Compare October 14, 2026 08:53
@betegon
betegon marked this pull request as ready for review October 21, 2026 15:09
@betegon
betegon requested a review from JPeer264 October 21, 2026 15:16

@cursor cursor Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

@github-actions

Copy link
Copy Markdown
Contributor

👋 @mydea, @andreiborza — Please review this PR when you get a chance!

@betegon
betegon requested review from a team as code owners October 23, 2026 12:04
@betegon
betegon requested review from logaretm and s1gr1d and removed request for a team October 23, 2026 12:04
@cursor

cursor Bot commented Oct 23, 2026

Copy link
Copy Markdown

This PR is too large for Bugbot to review. It changes 67,411 lines and 3,660,613 characters. Split the change into smaller pull requests to get a review.

@betegon

betegon commented Oct 23, 2026

Copy link
Copy Markdown
Member Author

bugbot run verbose=true

@cursor

cursor Bot commented Oct 23, 2026

Copy link
Copy Markdown

Bugbot request id: eea33c32-93f0-44cf-b25d-0cd32c7cc2f6

@cursor

cursor Bot commented Oct 23, 2026

Copy link
Copy Markdown

Bugbot rules debug

Bugbot rules included in this run
Rule Type Size Status
PR Review Guidelines for Cursor Bot (project-70ead460d2b3) project (BUGBOT.md) 15,678 chars included

https://cursor.com/docs/bugbot#team-rules

Bugbot request id: eea33c32-93f0-44cf-b25d-0cd32c7cc2f6

@betegon

betegon commented Oct 23, 2026

Copy link
Copy Markdown
Member Author

bugbot run verbose=true

@cursor

cursor Bot commented Oct 23, 2026

Copy link
Copy Markdown

Bugbot request id: f1ecc5b7-44f7-4fb2-935c-3b703c247d9a

@cursor

cursor Bot commented Oct 23, 2026

Copy link
Copy Markdown

Bugbot rules debug

Bugbot rules included in this run
Rule Type Size Status
PR Review Guidelines for Cursor Bot (project-70ead460d2b3) project (BUGBOT.md) 15,678 chars included

https://cursor.com/docs/bugbot#team-rules

Bugbot request id: f1ecc5b7-44f7-4fb2-935c-3b703c247d9a

@cursor cursor Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

*
* @param mcpServerInstance - MCP server instance to instrument
* @param options - Optional configuration for recording inputs and outputs
* @param options - Optional capture and OAuth client attribution configuration

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this diff is leaving to little information.

Suggested change
* @param options - Optional capture and OAuth client attribution configuration
* @param options - Optional config for recording inputs/outputs and OAuth client attribution configuration

@JPeer264 JPeer264 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. 2 tests are failing, but it seems not because of this PR

getCurrentScope().setClient(createMockClient(false));
vi.spyOn(tracing, 'startInactiveSpan').mockImplementation(options => {
const span = new SentrySpan(options);
spans.push(span);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: Since the tests within one test file are usually not executed in parallel it should be safe to have just one global span, rather than an array: let inactiveSpan. Wdyt?

const onmessage = transport.onmessage;
const result = { result: 'dispatch completed' };
onmessage.mockReturnValue(result);
transports.push(transport);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: Instead of pushing the transport globally into one array we could do something different:

let mockedTransport;

beforeEach(() => {
  mockedTransport = createMockTransport();
});

afterEach(() => {
  mockedTransport.onclose();
});

With that we wouldn't forget for new tests to push it to the global array

@JPeer264
JPeer264 force-pushed the feat/mcp-oauth-client-name branch from 0cb6dd6 to 2aa8392 Compare November 10, 2026 16:19
@JPeer264
JPeer264 requested a review from a team November 10, 2026 16:19
@JPeer264

Copy link
Copy Markdown
Member

FYI I rebased this PR, since this PR was still running the namespace runners and we removed them for now

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2aa8392. Configure here.

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Optional E2E tests

Some optional checks were not successful. They do not block the merge. 8 not successful, 49 successful. See the run.

Check Status
❌ CI: Optional E2E Tests / E2E node-eve (latest) Test (optional) Failing after 46s Details
❌ CI: Optional E2E Tests / E2E nextjs-orpc Test (optional) Failing after 3m Details
❌ CI: Optional E2E Tests / E2E node-eve (orchestrion) Test (optional) Failing after 2m Details
❌ CI: Optional E2E Tests / E2E node-flue (latest) Test (optional) Failing after 28s Details
❌ CI: Optional E2E Tests / E2E react-send-to-sentry Test (optional) Failing after 5m Details
❌ CI: Optional E2E Tests / E2E nextjs-16-cacheComponents (cloudflare) Test (optional) Failing after 10m Details
❌ CI: Optional E2E Tests / E2E node-eve Test (optional) Failing after 2m Details
❌ CI: Optional E2E Tests / E2E solidstart-2 Test (optional) Failing after 50s Details
Successful checks
Check Status
✅ CI: Optional E2E Tests / E2E cloudflare-flue-send-to-sentry Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E cloudflare-think Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E cloudflare-agent Test (optional) Successful in 42s Details
✅ CI: Optional E2E Tests / E2E astro-7 Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E debug-id-sourcemaps Test (optional) Successful in 43s Details
✅ CI: Optional E2E Tests / E2E cloudflare-pi-durable (latest) Test (optional) Successful in 49s Details
✅ CI: Optional E2E Tests / E2E cloudflare-pi-durable Test (optional) Successful in 48s Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (cloudflare, latest) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E cloudflare-mastra Test (optional) Successful in 55s Details
✅ CI: Optional E2E Tests / E2E astro-7-static Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nextjs-14 (latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-express-mcp-v2 Test (optional) Successful in 31s Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (vinext) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E tanstackstart-react-cloudflare Test (optional) Successful in 45s Details
✅ CI: Optional E2E Tests / E2E supabase-nextjs Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E vue-3 (no Options API) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-express-send-to-sentry-static Test (optional) Successful in 52s Details
✅ CI: Optional E2E Tests / E2E tanstackstart-react-sourcemaps Test (optional) Successful in 35s Details
✅ CI: Optional E2E Tests / E2E gen-ai-libraries Test (optional) Successful in 43s Details
✅ CI: Optional E2E Tests / E2E node-mastra Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nextjs-15 (latest) Test (optional) Successful in 4m Details
✅ CI: Optional E2E Tests / E2E cloudflare-think (ai v6) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (vinext, bun) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E gen-ai-libraries (cloudflare) Test (optional) Successful in 47s Details
✅ CI: Optional E2E Tests / E2E tanstackstart-react (latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E gen-ai-libraries (latest) Test (optional) Successful in 57s Details
✅ CI: Optional E2E Tests / E2E node-fastify-6 (tracer provider) Test (optional) Successful in 42s Details
✅ CI: Optional E2E Tests / E2E cloudflare-workers-send-to-sentry Test (optional) Successful in 3m Details
✅ CI: Optional E2E Tests / E2E node-openai-decisions Test (optional) Successful in 37s Details
✅ CI: Optional E2E Tests / E2E nestjs-12 (latest) Test (optional) Successful in 45s Details
✅ CI: Optional E2E Tests / E2E nextjs-15 (turbo) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E node-express-mcp-v1 Test (optional) Successful in 27s Details
✅ CI: Optional E2E Tests / E2E deno (latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-flue Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nuxt-5 (tunnel-dev) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-express-send-to-sentry Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-fastify-6 Test (optional) Successful in 37s Details
✅ CI: Optional E2E Tests / E2E react-router-7-framework-instrumentation Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E node-pi-durable Test (optional) Successful in 37s Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (deno) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E nuxt-5-sourcemaps Test (optional) Successful in 36s Details
✅ CI: Optional E2E Tests / E2E nuxt-5-sourcemaps (client source maps kept) Test (optional) Successful in 33s Details
✅ CI: Optional E2E Tests / E2E node-pi-durable (latest) Test (optional) Successful in 41s Details
✅ CI: Optional E2E Tests / E2E nuxt-5-cloudflare Test (optional) Successful in 29s Details
✅ CI: Optional E2E Tests / E2E nuxt-5-sourcemaps (static / nuxt generate) Test (optional) Successful in 43s Details
✅ CI: Optional E2E Tests / E2E node-mastra (latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nextjs-16-tunnel (cloudflare) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-openai-decisions (latest) Test (optional) Successful in 39s Details
✅ CI: Optional E2E Tests / E2E nuxt-5 Test (optional) Successful in 2m Details

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants