feat(mcp): add Tool Registry Service for agent tool credentials #208
Conversation
ENG-96
- Create ToolRegistryService with Redis-backed storage
- Implement registerComponentTool, registerRemoteMcp, registerLocalMcp
- Implement getToolsForRun, getTool, getToolByName, getToolCredentials
- Implement areAllToolsReady for agent readiness check
- Implement cleanupRun for workflow completion cleanup
- Encrypt credentials using existing SecretsEncryptionService
- Redis key pattern: mcp:run:{runId}:tools (Hash, TTL 1hr)
- Add McpModule to app imports
- Add comprehensive tests (8 tests passing)
Note: Temporal activities (registerToolActivity, waitForToolsActivity, etc.)
will be added in a follow-up as they reside in the worker package.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f8251468d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| try { | ||
| const encryptionMaterial = JSON.parse(tool.encryptedCredentials); | ||
| const decrypted = await this.encryption.decrypt(encryptionMaterial); | ||
| return JSON.parse(decrypted); |
There was a problem hiding this comment.
registerRemoteMcp encrypts a raw authToken string, but getToolCredentials always JSON.parses the decrypted payload. When the tool is a remote MCP (auth token is a plain string, not JSON), JSON.parse(decrypted) throws and the method returns null, so any consumer trying to fetch credentials for remote MCPs will never receive the token. This breaks authenticated remote MCP calls whenever authToken is not JSON-encoded.
Useful? React with 👍 / 👎.
Summary
Redis-backed registry for storing tool metadata and credentials during workflow runs. This bridges the gap between Temporal workflows (where credentials are resolved) and the MCP gateway (where agents call tools).
Stacked PR
Changes
New: `backend/src/mcp/` module
ToolRegistryService:
Redis Key Pattern
```
mcp:run:{runId}:tools (Hash, TTL 1hr)
```
Security
Tests
Note
Temporal activities (`registerToolActivity`, `waitForToolsActivity`, etc.) will be added in a follow-up as they reside in the worker package.
Linear Issue
Closes ENG-96