Repository navigation
refactor: hide the three credential-migration MCP tools from agent sessions that can never call them, and say who may #3435
Description
Summary
Two MCP tools for moving agent credentials between instances, import_credentials and get_credential_encryption_key, are reported to fail on every recorded call. If that holds, the documented way to move an agent's credentials from one instance to another does not work through the MCP surface.
Context
An operations audit of MCP tool calls found no successful call to either tool. This has not been reproduced on current dev, so the first step is to reproduce. Both tools are defined in src/mcp-server/src/tools/agents.ts; their access entries are in src/mcp-server/src/access.ts.
The pair matters together: export_credentials produces an encrypted file, get_credential_encryption_key supplies the key to carry out of band, and import_credentials loads the file on the target. A migration that depends on this flow cannot complete if the last two steps fail.
Acceptance Criteria
- Each tool is exercised on current
devwith a user-scoped key and with an agent-scoped key, and the result is recorded on this issue - If a tool fails for a caller that is meant to have access, it is fixed and covered by a test that calls it end to end against the backend route
- If the failure is an intended access refusal, the tool's description and error message say who may call it, and it is not listed for callers who can never use it
- An export on one agent followed by an import on another round-trips a credential set
- If either tool is judged not worth keeping, it is removed from the catalog and the credential-migration docs are updated to the supported path
Technical Notes
- The audit data cannot distinguish a broken request from a permission refusal;
access.tsmarksimport_credentialsadmin-only, which may explain part of it.
Activity
[-]bug: import_credentials and get_credential_encryption_key MCP tools are reported failing on every call[/-][+]refactor: hide the three credential-migration MCP tools from agent sessions that can never call them, and say who may[/+]vybe commentedon Oct 9, 2026
Diagnosis and ruling (operator, 2026-10-09). Not a defect. Static trace of
import_credentials,export_credentialsandget_credential_encryption_keyfrom the MCP tool through to the backend routes found the path, method, body, auth header and response parsing all correct. Calls from an agent-scoped key are refused by design: import and export are owner-or-admin and human-only, and the key route is admin-only. A user-scoped owner or admin key passes. An audit with no successful call is therefore the expected shape when only agents tried.Ruled: keep all three tools; list them only for user and system sessions, state in each description who may call it, and return a backend refusal as a typed denial. No backend change and no change to who can read an encryption key. Retitled and relabelled accordingly. The live exercise (admin, non-admin and agent keys, plus an export → import round trip between two agents) is required before merge.
refactor(mcp): credential tools are advertised only to the keys the b…
refactor(mcp): pin credential-tool visibility over the real transport…
refactor(mcp): pin the backend gates behind the three credential tool…
refactor(mcp): document who may call the credential tools (#3435)
refactor(mcp): a non-JSON 403 on a credential tool returns a fixed se…
refactor(mcp): credential tool descriptions and docs name the system-…
docs(mcp): the human-only note follows the MCP tool list instead of s…
docs(mcp): keep the MCP tool list tight after moving the human-only n…
vybe commentedon Oct 9, 2026
Draft PR: #3484 — the three tools are listed only for user and system sessions, descriptions say who may call them, no backend change. Reviewed MERGEABLE. Before merge: the live exercise (three key types × three tools, results recorded here) and one export → import round trip between two agents.
test(mcp): credential gate pins patch the module the running route re…
docs(faq): import a foreign credentials file via the secondary key, n…
refactor(mcp): credential-migration tools are listed only for the key…
feat(mcp): get_agent_spending + revoke_agent_delegation tools (ent#96…
feat(nevermined): fund an agent with a card — organization config, wi…
feat(mcp): apply_system, reconcile a live instance to a system manife…