Feat/mcp implementation by DIodide · Pull Request #7 · DIodide/Harness

DIodide · 2026-03-04T18:44:39Z

Fun fact, the PR description for this was generated by Harness itself, I'm sure that says enough

Feat: Complete MCP Implementation with OAuth Support, Chat Queues & Interrupts

This PR implements a comprehensive Model Context Protocol (MCP) integration with advanced chat features and OAuth authentication support.

Key Features

MCP OAuth & Authentication

Full OAuth 2.1 Support: Complete implementation following MCP authorization spec (RFC 9728, RFC 8414, RFC 7591, RFC 8707)
Dynamic Discovery: Automatic discovery of authorization servers and protected resource metadata
Multi-Auth Types: Support for none, bearer, and oauth authentication types
Token Management: Automatic token refresh and secure storage in Convex
Pre-registered Clients: Built-in support for known providers (GitHub)
Dynamic Client Registration: Fallback registration for unknown providers

Advanced Chat Experience

Message Queuing: Queue messages while model is responding instead of blocking
Stream Interruption: Stop generation mid-stream and save partial responses
Thinking Support: Real-time display of model reasoning (Claude Sonnet 4, DeepSeek R1)
Tool Call Visualization: Collapsible, detailed view of function calls and results
Message Actions: Copy, regenerate, and developer info based on display mode
Prompt History: Arrow key navigation through previous user messages

MCP Server Management

Visual MCP Editor: Dedicated harness editing page with server configuration
Real-time OAuth Status: Live connection status with one-click authentication
Inline URL Editing: Edit server URLs directly with keyboard shortcuts
Server Type Indicators: Visual badges for authentication types

Enhanced UI/UX

Display Modes: Zen (minimal), Standard (copy), Developer (full debugging)
Streaming Parts: Chronological display of reasoning, text, and tool calls
Usage Tracking: Token counts and cost tracking for each response
Interrupted Messages: Visual indicators for partial responses
Queue Chips: Visual queue with send-now and remove actions

Technical Implementation

Backend (FastAPI)

MCP Client Refactor: Complete rewrite with session management, streaming support, and error handling
OAuth Service: Full OAuth 2.1 implementation with PKCE, discovery, and refresh flows
Parallel Tool Execution: Execute multiple tool calls concurrently and stream results
Usage Backfilling: Capture and backfill usage data even when streams are interrupted
Thinking Models: Support for models with reasoning capabilities

Frontend (React)

Queue State Management: React state for message queuing with automatic processing
Stream Interruption: Graceful handling of aborted streams with data preservation
Parts-based Rendering: Dynamic rendering of mixed content types (text, reasoning, tools)
Real-time OAuth: Popup-based OAuth flows with message passing
Harness Editor: Dedicated editing interface with live validation

Database (Convex)

OAuth Token Storage: Secure token storage with user/server indexing
Enhanced Message Schema: Support for reasoning, tool calls, parts, usage, and interruption flags
Migration System: Automated schema migrations for harness data structure changes
Display Settings: User preference storage for UI display modes

Data Flow Improvements

Message Processing

Streaming: Real-time token, reasoning, and tool call streaming
Interruption: Graceful abort handling with partial data preservation
Queuing: Automatic queue processing when streams complete
Persistence: Enhanced data persistence with usage and metadata

MCP Integration

Discovery: Automatic OAuth server discovery and metadata fetching
Authentication: Secure token management with automatic refresh
Tool Execution: Parallel execution with real-time result streaming
Error Handling: Comprehensive error handling with re-auth prompts

Breaking Changes

Harness schema migrated from mcps: string[] to mcpServers: McpServer[]
Message schema enhanced with new optional fields (backward compatible)
FastAPI MCP client completely rewritten (internal implementation)

New Dependencies

Frontend: Enhanced React state management and animation libraries
Backend: OAuth discovery and token management utilities
Database: New Convex tables for OAuth tokens and enhanced schemas

Usage Examples

Adding MCP Servers

// New MCP server configuration
{
  name: "GitHub",
  url: "https://mcp.example.com/github",
  authType: "oauth", // or "bearer" or "none"
  authToken?: "optional_bearer_token"
}

OAuth Flow

User clicks "Connect" on OAuth server
Popup opens with authorization URL
User authorizes with provider
Tokens automatically stored in Convex
Server immediately available for use

Message Queuing

Type message while model is responding → automatically queued
Visual chips show queued messages
Click "Send Now" to interrupt and prioritize
Automatic processing when stream completes

This implementation provides a production-ready MCP integration with enterprise-grade OAuth support and significantly enhanced chat experience. All features are backward compatible and include comprehensive error handling and user feedback.

…d 16k for thinking models (play around with this param, it heavily determines output)

Add chat interrupts, auto scroll

Copilot

Pull request overview

This PR introduces a full MCP (Model Context Protocol) integration across the stack, adding OAuth-based MCP server auth, richer streaming chat UX (thinking/tool parts, interrupts, queues), and expanded message/harness schemas to persist the new metadata.

Changes:

Adds MCP server configuration (URL + auth type) and an OAuth flow (FastAPI routes + Convex token storage).
Refactors MCP client/tooling to support sessions, SSE responses, tool name sanitization, and parallel tool execution.
Upgrades chat streaming end-to-end: reasoning parts, tool call visualization, interrupts/queueing, and usage capture/backfill.

Reviewed changes

Copilot reviewed 26 out of 27 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
packages/fastapi/app/services/openrouter.py	Adds usage-inclusive streaming options, thinking support, and improved error/log handling for OpenRouter streams.
packages/fastapi/app/services/mcp_oauth.py	Implements OAuth discovery, PKCE, code exchange/refresh, and Convex token persistence helpers.
packages/fastapi/app/services/mcp_client.py	Major MCP client refactor: session caching, SSE-safe requests, parallel tool listing/calls, OAuth header resolution.
packages/fastapi/app/services/convex.py	Extends message save payload and adds usage backfill mutation helper.
packages/fastapi/app/routes/mcp_oauth.py	Adds OAuth start/callback/status/revoke endpoints for MCP servers.
packages/fastapi/app/routes/chat.py	Adds thinking/tool parts streaming, tool parallelism, interrupt draining for usage, and expanded persistence payload.
packages/fastapi/app/models.py	Introduces `McpServer` model and updates harness config to `mcp_servers`.
packages/fastapi/app/main.py	Registers new OAuth router and updates CORS allowlist.
packages/fastapi/app/config.py	Adds model mappings (incl. thinking variants) and OAuth-related settings.
packages/convex-backend/convex/userSettings.ts	Adds `displayMode` setting with validation/defaulting.
packages/convex-backend/convex/seed.ts	Updates seed harnesses to new `mcpServers` shape.
packages/convex-backend/convex/schema.ts	Adds MCP servers to harness schema, expands message schema (parts/toolCalls/usage/interrupted), adds `mcpOAuthTokens` table.
packages/convex-backend/convex/migrations.ts	Adds a harness migration helper for the new `mcpServers` field.
packages/convex-backend/convex/messages.ts	Adds message removal, interrupted message saving, assistant message enrichment, and usage backfill mutation.
packages/convex-backend/convex/mcpOAuthTokens.ts	Adds token storage/query/revoke endpoints for MCP OAuth tokens.
packages/convex-backend/convex/harnesses.ts	Updates harness create/update mutations for `mcpServers`.
packages/convex-backend/convex/conversations.ts	Limits conversation list query to 50 entries.
packages/convex-backend/convex/_generated/api.d.ts	Regenerates API typing for new Convex modules.
apps/web/vite.config.ts	Adds allowedHosts entry for an ngrok host.
apps/web/src/routes/onboarding.tsx	Replaces MCP selection with MCP server entry management (name/url/auth).
apps/web/src/routes/harnesses/index.tsx	Adds navigation to a dedicated harness edit route and updates MCP count display.
apps/web/src/routes/harnesses/$harnessId.tsx	New harness editor route with MCP server editing and OAuth connect/status UI.
apps/web/src/routes/chat/index.tsx	Adds message queueing, interrupts, thinking/tool part rendering, display modes, regenerate, and usage/model UI plumbing.
apps/web/src/routeTree.gen.ts	Route tree regeneration to include `/harnesses/$harnessId`.
apps/web/src/lib/use-chat-stream.ts	Extends stream protocol to include thinking events + usage/model on done; adds abort callback.
apps/web/src/lib/models.ts	Centralizes model options for the frontend.
apps/web/src/components/message-actions.tsx	Adds per-message actions (copy/regenerate/dev info) gated by display mode.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-04T18:55:45Z

packages/fastapi/app/routes/mcp_oauth.py

+    return f"""<!DOCTYPE html>
+<html>
+<head><title>MCP OAuth</title></head>
+<body>
+<p>{"Connected successfully!" if success else f"Error: {error}"}</p>
+<p>You can close this window.</p>
+<script>
+    if (window.opener) {{
+        window.opener.postMessage({json.dumps(message_data)}, "*");
+    }}


The OAuth callback HTML both (1) interpolates error directly into the HTML (potential XSS if the error ever contains attacker-controlled text) and (2) posts a message to the opener with targetOrigin="*". Please HTML-escape any user-visible strings and restrict postMessage to a known origin (e.g. settings.frontend_url) so other origins can’t spoof the callback.

Copilot · 2026-03-04T18:55:46Z

apps/web/src/routes/harnesses/$harnessId.tsx

+			const handler = (event: MessageEvent) => {
+				if (event.data?.type === "mcp-oauth-callback") {
+					window.removeEventListener("message", handler);
+					if (event.data.success) {
+						setStatus("connected");
+						toast.success("Connected to MCP server via OAuth");
+					} else {
+						toast.error(event.data.error || "OAuth connection failed");
+					}
+					setConnecting(false);
+					popup?.close();
+				}
+			};
+			window.addEventListener("message", handler);


The message event handler accepts any postMessage payload with { type: "mcp-oauth-callback" } without validating event.origin or event.source (the popup). This allows any site to spoof a successful OAuth callback in the parent window. Please verify the origin matches your FastAPI base URL and that event.source === popup (and consider including/verifying a nonce/state).

packages/fastapi/app/main.py

packages/fastapi/app/services/mcp_client.py

packages/convex-backend/convex/messages.ts

packages/convex-backend/convex/migrations.ts

apps/web/src/routes/harnesses/index.tsx

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…Harness into feat/mcp-implementation

DIodide · 2026-03-07T12:58:33Z

⏺ ---
MCP Health Checks, Auth UX, and QoL Improvements

Summary

MCP server health checks: Added backend health check endpoint (/api/mcp/health/check) with frontend status indicators
showing server connectivity in real-time
MCP error handling: Surface MCP connection errors on the frontend; ease connectivity for servers that don't support
sessions
Auth & onboarding: Revamped sign-in UI, added in-onboarding auth step
UX polish: Auto-scroll fix, default to newly created harness, Linear integration + proxy support
Infra: Migrated env validation to t3-oss, removed legacy migrations, added GPT-5.4 model support

Test plan

Verify MCP server health indicators show correct status (healthy/unhealthy/checking)
Test MCP servers without session support still connect
Confirm onboarding auth step flow works end-to-end
Verify auto-scroll behavior on new messages
Test Linear integration and proxy configuration

cole-ramer

The changes look good. The only main issue I found was the commenting/documentation. You do a good job with inline in function comments, but the more overview comments are lacking from almost every function. I think it would be better if going forward we all wrote quick little comments at the top of each function saying what it does and what it returns, and parameters if they aren't obvious. In general, we should as a group think about what documentation we are going to do, but I feel like the function comments are the bare minimum.

DIodide and others added 15 commits March 1, 2026 04:23

add reasoning support

db62032

basic tool calls working + dynamic httpstreamable mcps

a41f4d3

persist tool call output and render to screen

21cf316

add QoL modes for interactivity

e406f47

add usage token data, costs, to the developer mode ui

6363077

add include usage to openrouter

3f4dfb4

parallelize tool calls

13087d5

stream tool calls correctly.

4d67fbc

log openrouter error: set max_tokens: 4096 for non thinking models an…

7cf478b

…d 16k for thinking models (play around with this param, it heavily determines output)

working parts stream + persist, + fix conversations css

883ae74

Add backend oauth implementation + routes based on MCP standard

f6727be

add frontend handling for oauth connectivity + initial ui

06e3240

Add chat interrupts, auto scroll

be0bd76

Merge pull request #6 from DIodide:feat/chat-interrupts-and-scroll

c97104a

Add chat interrupts, auto scroll

Merge branch 'staging' into feat/mcp-implementation

1c1ed1e

DIodide self-assigned this Mar 4, 2026

DIodide requested review from abubahmed, cole-ramer, Copilot, jon3350 and richardw19 March 4, 2026 18:50

Copilot started reviewing on behalf of DIodide March 4, 2026 18:50 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

DIodide and others added 7 commits March 4, 2026 14:13

Update apps/web/src/routes/harnesses/index.tsx

e287513

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

remove migrations.ts

98b9b35

Merge branch 'feat/mcp-implementation' of https://github.com/DIodide/…

1bb307e

…Harness into feat/mcp-implementation

remove migrations

f92956a

sign in ui

85d351c

default to newly created harness (prefer)

af9df03

add in-onboarding auth step

398bdac

DIodide added 9 commits March 4, 2026 15:03

use t3-oss-env validator instead of meta.env

3aaccfe

add mcp server status check in the ui

ba3aa24

show mcp error on frontend

81f5685

add ui indicator for api/mcp/health/check

5db47ac

ease connectivity for mcp servers that do not support sessions

0901548

indicator

6ca2e28

linear support + proxies

a033b4c

fix auto scroll issue

e5dbaed

add gpt-5.4

1f4eaa9

cole-ramer approved these changes Mar 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/mcp implementation#7

Feat/mcp implementation#7
DIodide wants to merge 31 commits intostagingfrom
feat/mcp-implementation

DIodide commented Mar 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DIodide commented Mar 7, 2026

Uh oh!

cole-ramer left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

DIodide commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Feat: Complete MCP Implementation with OAuth Support, Chat Queues & Interrupts

Key Features

MCP OAuth & Authentication

Advanced Chat Experience

MCP Server Management

Enhanced UI/UX

Technical Implementation

Backend (FastAPI)

Frontend (React)

Database (Convex)

Data Flow Improvements

Message Processing

MCP Integration

Breaking Changes

New Dependencies

Usage Examples

Adding MCP Servers

OAuth Flow

Message Queuing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DIodide commented Mar 7, 2026

Uh oh!

cole-ramer left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

DIodide commented Mar 4, 2026 •

edited

Loading