MCP Revamp by Prasanna721 · Pull Request #1120 · supermemoryai/supermemory

Prasanna721 · 2026-06-15T22:43:52Z

Relocates the revamped MCP (formerly "enterprise-mcp") into apps/mcp as the public MCP, renamed to SupermemoryMCP. The old apps/mcp is replaced; functionality is unchanged. Location, config, and naming change only.

Changes:

apps/mcp/src/**: the revamped MCP code (server + widget + tools). EnterpriseMCP to SupermemoryMCP, branding Enterprise MCP to Supermemory MCP (functionality identical; demo/mock text left as-is).
apps/mcp/package.json: worker supermemory-mcp; catalog: refs pinned to explicit versions (this repo has no catalog); portless dev:app.
apps/mcp/wrangler.jsonc: name supermemory-mcp, route mcp.supermemory.ai, DO SupermemoryMCP.

Verified locally: builds (vite widget bundle), boots, and OAuth discovery + the 401 handshake + the worker to api /v3/mcp/session-with-key path all work at the valid-audience host.

Deploy notes:

The DO class is SupermemoryMCP, the same as the existing supermemory-mcp worker's v1 migration, so the cutover is a no-op for the DO (no transition, no session reset).
Set a real AUTH_CACHE KV id (placeholder for now).
Coordinate with the OAuth provider migration (mono #1812) so existing OAuth clients reconnect once.

Draft until the cutover plan is finalized.

socket-security · 2026-06-15T22:44:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@radix-ui/react-slot@1.3.0
	npm/@radix-ui/react-popover@1.1.18
	npm/@radix-ui/react-tooltip@1.2.11
	npm/@types/react@19.2.17
	npm/@supermemory/memory-graph@0.2.3
	npm/tailwindcss@4.3.2
	npm/tailwind-merge@3.6.0
	npm/@tailwindcss/vite@4.3.2
	npm/react-dom@19.2.7

View full report

cloudflare-workers-and-pages · 2026-06-15T22:44:58Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	supermemory-mcp	`d36aa64`	Jul 02 2026, 11:56 AM

cloudflare-workers-and-pages · 2026-06-15T22:46:34Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	`d36aa64`	Commit Preview URL Branch Preview URL	Jul 02 2026, 11:58 AM

Replaces the old apps/mcp with the enterprise-mcp code (functionality unchanged). package.json: worker supermemory-mcp, catalog deps pinned to explicit versions, portless dev:app. wrangler: name supermemory-mcp, route mcp.supermemory.ai, DO EnterpriseMCP. Builds + boots + OAuth discovery/401/worker-to-api verified locally. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Functionality unchanged; just the name. The DO class is now SupermemoryMCP, which matches the existing supermemory-mcp worker's v1 migration -> the cutover is a no-op, no DO session reset. Demo/mock 'enterprise buyers' text left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Consumers think in "spaces", not "container tags". Renames the tool to listSpaces and updates its description + text output to say "spaces". Internal plumbing is unchanged: the client method listContainerTags() and the structuredContent.containerTags key (widget contract) keep their names.

Resolve MCP revamp conflicts by keeping the new server layout, deleting legacy root MCP files, and carrying forward API timeout handling into the new auth/client modules.

claude · 2026-06-30T14:41:53Z

Claude finished @ishaanxgupta's task in 2m 7s —— View job

Code Review: MCP Revamp

Fetching PR diff and existing comments
Analyzing changed files for bugs and security issues
Checking auth/RBAC implementation
Reviewing tool permission checks
Submitting review

Summary: Reviewed the auth caching system, RBAC implementation, and all tool permission checks. The code is well-structured with proper security controls:

Auth tokens are SHA-256 hashed before caching (never stored raw)
Fail-closed behavior on RBAC fetch failures prevents privilege escalation
All tools consistently check canRead/canWrite permissions before operations

Issues found: None — this looks good to ship.

Score: 9/10 (minor deduction for placeholder KV ID that needs replacement at deploy time, but this is documented)

claude

Code Review: MCP Revamp

Overview: Relocates the revamped MCP server into apps/mcp, replacing the old implementation with a new architecture featuring RBAC, auth caching, and a React-based widget UI.

Security & Auth Analysis

Auth Caching (auth/cache.ts): Properly implemented with:

SHA-256 hashing of tokens before storage (never stores raw tokens)
5-minute TTL matching Better Auth's session cache
Defensive validators that treat malformed cache entries as misses
Fail-open on KV errors (request still succeeds via upstream validation)

RBAC (auth/rbac.ts, auth/index.ts): Correctly implemented:

validateOAuthToken returns null on RBAC fetch failure (fail-closed) — this prevents silent privilege escalation if the RBAC endpoint is unreachable
buildRbacContext properly gates canRead/canWrite on accessType === "restricted"
All tools consistently check RBAC permissions before operations

Tool Permissions: Each tool properly validates access:

Write tools (add-memory, save-memory, upload-file-submit) check deps.rbac.canWrite(containerTag)
Read tools (search-memory, fetch-graph-data, memory-graph) check deps.rbac.canRead(containerTag)

Config Notes

The AUTH_CACHE KV namespace in wrangler.jsonc uses a placeholder ID (REPLACE_WITH_KV_NAMESPACE_ID). This is correctly documented in the PR description as a deploy-time task.

Code Quality

Clean separation between server, auth, tools, and widget
Shared types (shared/types.ts) provide a single source of truth for server↔widget contract
Error handling consistently uses deps.errorResult() pattern
PostHog analytics removed from this implementation (was in the old code)

Issues found: None — this looks good to ship.

Score: 9/10

Minor deduction for the placeholder KV ID that needs manual replacement before deploy, but this is properly documented.

linear-code · 2026-07-01T17:59:52Z

ENG-948

ENG-947

ENG-949

ishaanxgupta · 2026-07-02T11:50:57Z

Fix generic error for oversized MCP file uploads #1193 : 2 dependent PRs (#1194 , #1195 )
Fix nonexistent container tag handling in MCP tools #1192
Fix MCP widgets according to consumer app #1189
MCP Revamp #1120 👈 (View in Graphite)
main

How to use the Graphite Merge Queue

Add the label Main to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

_{An organization admin has enabled the Graphite Merge Queue in this repository.} _{Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.}

This stack of pull requests is managed by Graphite. Learn more about stacking.

claude

Code Review: MCP Revamp

Overview: Relocates the revamped MCP server into apps/mcp, replacing the old implementation with a new architecture featuring RBAC, auth caching, and a React-based widget UI.

Security & Auth Analysis

Auth Caching (auth/cache.ts): Properly implemented:

SHA-256 hashing of tokens before storage (never stores raw tokens)
5-minute TTL matching Better Auth's session cache
Defensive validators that treat malformed cache entries as misses
Fail-open on KV errors (request still succeeds via upstream validation)

RBAC (auth/rbac.ts, auth/index.ts): Correctly implemented:

validateOAuthToken returns null on RBAC fetch failure (fail-closed) — prevents silent privilege escalation if the RBAC endpoint is unreachable
buildRbacContext properly gates canRead/canWrite on accessType === "restricted"
All tools consistently check RBAC permissions before operations

Tool Permissions: Each tool properly validates access:

Write tools (add-memory, save-memory, upload-file-submit) check deps.rbac.canWrite(containerTag)
Read tools (search-memory, fetch-graph-data, memory-graph) check deps.rbac.canRead(containerTag)

Config Notes

The AUTH_CACHE KV namespace in wrangler.jsonc uses a placeholder ID (REPLACE_WITH_KV_NAMESPACE_ID). This is correctly documented in the PR description as a deploy-time task.

Code Quality

Clean separation between server, auth, tools, and widget
Shared types (shared/types.ts) provide a single source of truth for server↔widget contract
Error handling consistently uses deps.errorResult() pattern
PostHog analytics removed from this implementation (was in the old code)

Issues found: None — this looks good to ship.

Score: 9/10

Minor deduction for the placeholder KV ID that needs manual replacement before deploy, but this is properly documented.

Prasanna721 changed the title ~~mcp: relocate enterprise-mcp as the public MCP revamp~~ MCP Revamp Jun 15, 2026

Prasanna721 force-pushed the Prasanna721/dalat-v1 branch from 888e7c7 to 06f62ec Compare June 19, 2026 16:55

Prasanna721 and others added 5 commits June 19, 2026 09:55

fix: format CSS file to pass Biome CI check

387606b

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

fix: format ternary expression to pass Biome CI check

e1289e5

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Prasanna721 force-pushed the Prasanna721/dalat-v1 branch from 06f62ec to f887bd6 Compare June 19, 2026 16:55

Prasanna721 and others added 3 commits June 19, 2026 13:02

fix mcp oauth resource metadata

db990e9

fix mcp root transport alias

113862f

Merge main into MCP revamp PR

d36aa64

Resolve MCP revamp conflicts by keeping the new server layout, deleting legacy root MCP files, and carrying forward API timeout handling into the new auth/client modules.

ved015 marked this pull request as ready for review June 30, 2026 14:41

graphite-app Bot requested a review from Dhravya June 30, 2026 14:41

graphite-app Bot assigned Prasanna721 Jun 30, 2026

claude Bot reviewed Jun 30, 2026

View reviewed changes

ishaanxgupta force-pushed the Prasanna721/dalat-v1 branch from 55fc0d5 to d36aa64 Compare July 2, 2026 11:50

ishaanxgupta mentioned this pull request Jul 2, 2026

Fix MCP widgets according to consumer app #1189

Open

claude Bot reviewed Jul 2, 2026

View reviewed changes

This was referenced Jul 3, 2026

Fix nonexistent container tag handling in MCP tools #1192

Open

Fix generic error for oversized MCP file uploads #1193

Open

DONT merge #1194

Closed

ishaanxgupta mentioned this pull request Jul 3, 2026

fix(mcp): return graph view message from fetch-graph-data #1195

Open

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

MCP Revamp#1120

MCP Revamp#1120
Prasanna721 wants to merge 8 commits into
mainfrom
Prasanna721/dalat-v1

Prasanna721 commented Jun 15, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

linear-code Bot commented Jul 1, 2026

Uh oh!

ishaanxgupta commented Jul 2, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Prasanna721 commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

claude Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review: MCP Revamp

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Code Review: MCP Revamp

Security & Auth Analysis

Config Notes

Code Quality

Uh oh!

linear-code Bot commented Jul 1, 2026

Uh oh!

ishaanxgupta commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How to use the Graphite Merge Queue

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Code Review: MCP Revamp

Security & Auth Analysis

Config Notes

Code Quality

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Prasanna721 commented Jun 15, 2026 •

edited

Loading

socket-security Bot commented Jun 15, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

claude Bot commented Jun 30, 2026 •

edited

Loading

ishaanxgupta commented Jul 2, 2026 •

edited

Loading