Skip to content

feat: move MCP servers to AI settings - #26642

Merged
DanielleMaywood merged 8 commits into
mainfrom
danielle/mcp-ai-settings-redesign
Jun 24, 2026
Merged

feat: move MCP servers to AI settings#26642
DanielleMaywood merged 8 commits into
mainfrom
danielle/mcp-ai-settings-redesign

Conversation

@DanielleMaywood

Copy link
Copy Markdown
Contributor

Moves MCP server administration out of Coder Agents settings and into route-based AI Settings pages that follow the Models page structure.

This adds AI Settings list, add, and edit routes for MCP servers, redirects the old Agents settings route, updates both settings sidebars, and preserves the existing MCP form behavior for secrets, custom headers, availability, and tool governance.

Note

🤖 This PR was written by Coder Agent on behalf of Danielle Maywood

Implementation plan

MCP servers route-based AI Settings migration plan

Problem statement

MCP server settings currently live under Agents settings and use a monolithic query-param panel. The Models settings page was moved and redesigned under AI Settings. MCP servers should follow the same route-based AI Settings architecture and match the attached designs.

Approved direction

Use route-based AI Settings pages rather than keeping the existing ?server= panel flow.

New routes:

  • /ai/settings/mcp-servers
  • /ai/settings/mcp-servers/add
  • /ai/settings/mcp-servers/:serverId

Compatibility route:

  • /agents/settings/mcp-servers redirects to /ai/settings/mcp-servers

Files likely to change

  • site/src/router.tsx
  • site/src/modules/management/AISettingsSidebarView.tsx
  • site/src/modules/dashboard/Navbar/Navbar.tsx
  • site/src/pages/AgentsPage/components/ChatsSidebar/settings/SettingsPanel.tsx
  • New files under site/src/pages/AISettingsPage/MCPServersPage/
  • Existing MCP settings component stories may be moved or replaced with new AI Settings stories.

Implementation steps

  1. Add AI Settings routes and lazy imports for MCP servers list, add, and update pages.
  2. Redirect old /agents/settings/mcp-servers to /ai/settings/mcp-servers.
  3. Add AI Settings sidebar entry for MCP servers, gated by permissions.editDeploymentConfig.
  4. Update Agents settings sidebar link to point to /ai/settings/mcp-servers with external-link treatment, matching Providers and Models.
  5. Ensure top-level AI Settings visibility includes MCP server access, not only providers or gateway keys.
  6. Create MCPServersPage container that uses existing React Query MCP helpers and RequirePermission.
  7. Create MCPServersPageView with SettingsHeader, shared table primitives, loading, error, empty, and populated states.
  8. Create MCPServerRow with clickable row behavior, icon, auth method, availability, status badge, and chevron.
  9. Extract MCP form logic from the existing admin panel into local form helpers:
    • initial value building
    • slugification
    • list splitting and joining
    • create/update request mapping
    • secret placeholder and touched handling
  10. Create route-based add and edit pages backed by a shared MCPServerForm.
  11. Preserve current submit behavior and secret/custom-header security behavior.
  12. Add Storybook stories for list, empty, loading, error, add, edit, collapsible sections, auth variants, and delete dialog.
  13. Run formatting and targeted checks.

Rejected alternatives

Reuse MCPServerAdminPanel unchanged

Rejected because it preserves the old Agents visual style and query-param navigation, which conflicts with the Models page and Figma direction.

Light restyle of the existing monolith

Rejected because the component mixes list, URL state, form logic, dialogs, and field rendering. Splitting route-based pages is more maintainable and closer to the Models page.

Edge cases to preserve

  • Slug auto-generates from display name until manually edited.
  • Required submit gating remains display name, slug, and URL.
  • Existing OAuth2 and API key secrets are represented by the placeholder and omitted from update requests unless changed.
  • Replacement secrets are sent only after the user changes the field.
  • Existing custom headers are not prepopulated. Replacements are sent only when changed.
  • Tool allow and deny lists remain comma-separated strings mapped to arrays.
  • Old Agents MCP route remains usable through redirect.
  • Direct edit route for a missing server returns users to the list instead of rendering a broken form.

Verification plan

Targeted checks:

cd site
pnpm format
pnpm lint
pnpm test:storybook src/pages/AISettingsPage/MCPServersPage

Manual or Storybook states to inspect:

  • Populated list matches Figma table layout.
  • Empty list matches Figma empty state.
  • Add server form matches route-based add design.
  • Edit server form matches route-based edit design.
  • Details, Authentication, and Behavior sections open and close correctly.
  • OAuth2, API key, custom headers, and User OIDC auth modes render correctly.
  • Delete confirmation works and preserves existing mutation behavior.

Open questions

None.

@DanielleMaywood

Copy link
Copy Markdown
Contributor Author

/coder-agents-review

@coder-agents-review

coder-agents-review Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Chat: Review posted | View chat
Requested: 2026-06-24 09:45 UTC by @DanielleMaywood
Spend: $74.65 / $100.00

Review history
  • R1 (2026-06-23), 1 Nit, 1 P2, COMMENT. Review
  • R2 (2026-06-23): 15 reviewers, 3 Nit, 1 P1, 2 P2, 9 P3, REQUEST_CHANGES. Review
  • R3 (2026-06-24): 4 reviewers, 3 Nit, 1 P1, 2 P2, 11 P3, COMMENT. Review
  • R4 (2026-06-24): 1 reviewers, 3 Nit, 1 P1, 2 P2, 11 P3, COMMENT. Review

deep-review v0.9.0 | Round 4 | b11cd07..d7fbc05

Last posted: Round 4, 17 findings (1 P1, 2 P2, 11 P3, 3 Nit), COMMENT. Review

Finding inventory

Findings

# Sev Status Location Summary Round Reviewer Posted
CRF-1 P2 Author fixed (922f8a9) MCPServersPageView.stories.tsx:1 Story coverage dropped from 16 interactive stories to 6; mcpServerFormLogic.ts has no unit tests R1 Netero Yes
CRF-2 Nit Author contested; panel closed R2 (6/6 accept) ProviderField.tsx:1 Unrelated file deletion bundled with MCP migration R1 Law Yes
CRF-3 P3 Author contested; panel closed R3 (3/3 accept) MCPServerFormFieldPrimitives.tsx:43 CollapsibleSection duplicates existing component in ModelFormFields.tsx R2 Netero Yes
CRF-4 P3 Author contested; panel closed R3 (4/4 accept) MCPServersPageView.stories.tsx:1 Story coverage still thin after CRF-1 fix; auth modes, behavior, delete, toggle lack interactive coverage R2 Netero Yes
CRF-5 P1 Author fixed (65f923b) MCPServerForm.tsx:48 Header enable/disable toggle and form submit fight over enabled; form save silently reverts the toggle R2 Pariston P1, Hisoka P2, Mafuuu P2, Meruem P2 Yes
CRF-6 P2 Author fixed (65f923b) MCPServerAuthSection.tsx:184 Focusing a secret field then blurring without typing sends empty string as new secret R2 Nami Yes
CRF-7 P3 Author fixed (65f923b) mcpServerFormLogic.ts:85 slugTouched always false on init; editing display name rewrites slug R2 Nami Yes
CRF-8 P3 Author fixed (65f923b) MCPServerFormFields.tsx:55 Form fields stay enabled during delete; isDeleting not passed to MCPServerFormFields R2 Nami P3, Kite P3 Yes
CRF-9 P3 Author fixed (65f923b) MCPServersPageView.tsx:67 Error and empty state render simultaneously on first load failure R2 Nami Yes
CRF-10 P3 Author fixed (65f923b) mcpServerFormLogic.test.ts:43 API key secret-stripping branch has no test R2 Bisky Yes
CRF-11 P3 Author fixed (65f923b) AddMCPServerPageView.stories.tsx:26 Add story fills form but never submits; onCreateServer mock not asserted R2 Bisky Yes
CRF-12 P3 Author fixed (65f923b) MCPServerForm.tsx:16 Form interface requires both create and update callbacks; callers no-op one R2 Mafuuu P3, Gon P3 Yes
CRF-13 P3 Author fixed (65f923b) UpdateMCPServerPage.tsx:77 Toggle error toast says generic "Failed to update" instead of "Failed to enable/disable" R2 Leorio Yes
CRF-14 Nit Author fixed (65f923b) MCPServersPage.tsx:13 .slice().sort() is pre-5.2 idiom; codebase uses .toSorted() in 10+ places R2 Ging-ts Yes
CRF-15 Nit Author fixed (65f923b) MCPServerAuthSection.tsx:252 Custom header labels change per index; inconsistent accessible names R2 Gon Yes
CRF-16 P3 Author fixed (9849f82) mcpServerFormLogic.ts:3 SECRET_PLACEHOLDER defined in two files; drift would break secret handling R3 Netero Yes
CRF-17 P3 Author fixed (9849f82) MCPServersPageView.stories.tsx:75 LoadError story proves empty state hidden but not that error is visible R3 Chopper Yes

Contested and acknowledged

CRF-2 (Nit, ProviderField.tsx:1) - Unrelated file deletion bundled with MCP migration

  • Finding: Law noted that ProviderField.tsx is in the ChatModelAdminPanel directory, not the MCP server path, and deleting it here is unrelated to the stated PR scope.
  • Author defense: The old MCP panel was the last consumer of ProviderField.tsx. Keeping the file would leave dead code.
  • Panel closure (R2, 6/6): Hisoka, Mafuuu, Meruem, Pariston, Zoro, and Kite all independently verified that ProviderField.tsx has zero remaining consumers. The deletion removes dead code created by this PR's panel removal. Defense holds.

CRF-3 (P3, MCPServerFormFieldPrimitives.tsx:43) - CollapsibleSection duplicates existing component in ModelFormFields.tsx

  • Finding: Netero noted that the new CollapsibleSection is structurally identical to the private one in ModelFormFields.tsx with only two Tailwind token differences.
  • Author defense: Extraction would touch the Models page and increase review surface for a style-only concern. Keeping it local keeps this PR focused on the MCP settings move; extraction can happen once both forms settle.
  • Panel closure (R3, 3/3): Mafuuu, Pariston, and Chopper verified the component is ~30 LOC, stateless, and local. Extraction requires a cross-page refactor. Drift consequence is purely visual. Defense holds.

CRF-4 (P3, MCPServersPageView.stories.tsx:1) - Story coverage still thin

  • Finding: Netero noted auth modes beyond OAuth2, behavior section, delete dialog, and toggle-enabled have zero interactive story coverage. Production-to-test ratio above 5:1 threshold.
  • Author defense: Targeted coverage was added for bugs and submit paths from this review. Exhaustive play coverage for every auth mode, behavior option, delete flow, and toggle flow would add too much review surface beyond the migration and concrete regressions.
  • Panel closure (R3, 4/4): Bisky, Mafuuu, Pariston, and Chopper verified existing stories are genuine and cover critical submit paths. Gap is real but proportional to a migration PR. Defense holds.

Law analysis

Effective LOC: +1979 -2105 (29 files). Head SHA: ac321a8. Verdict: Don't split. Enforcement: Advisory.

Round log

Round 1

Netero-only. 1 P2, 1 Nit (Law). Reviewed against 7ea5d48..ac321a8.

Round 2

Panel. CRF-1 addressed. CRF-2 contested, panel closed (6/6 accept). 1 P1, 1 P2, 6 P3, 2 Nit new. Reviewed against 7ea5d48..922f8a9.

Round 3

Panel. CRF-5 (P1), CRF-6 (P2), CRF-7-15 verified fixed. CRF-3 closed (3/3), CRF-4 closed (4/4). 2 P3 new. Reviewed against 7ea5d48..65f923b.

Round 4

CRF-16, CRF-17 addressed, verified by Netero. 0 open findings. Clean. Reviewed against b11cd07..d7fbc05.

About deep-review

CRF = Coder Review Finding (P0-P4, Nit, Note)

Reviewer Focus
Bisky tests
Chopper ops/errors
Churn-guard change verification
Ging language modernization
Gon naming
Hisoka edge cases
Killua perf
Kite change integrity
Knov contracts
Knuckle SQL
Komugi flake/determinism
Kurapika security
Law decomposition
Leorio docs
Luffy product
Mafu-san process
Mafuuu contracts
Melody dispatch/pairing
Meruem structural
Nami frontend
Netero mechanical checks
Pariston premise testing
Pen-botter product gaps
Razor verification
Robin duplication
Ryosuke Go arch
Takumi concurrency
Zoro shape

🤖 Managed by Coder Agents.

@coder-agents-review coder-agents-review Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First-pass review (Netero). One P2, one Nit.

This is a first-pass review only: these are mechanical findings from Netero. The full review panel has not yet reviewed this PR. The panel will review after these findings are addressed.

The migration is structurally clean: no emdashes, no stale references, no dead exports, no circular imports, tsc passes, all 6 story tests pass. Error handling follows the toast pattern consistently. Law evaluated the LOC (1979 additions) and concluded "Don't split" (advisory) since the concerns form a single linear dependency chain (pages -> routes -> deletion) in a single frontend domain.

"This is 1742 new production lines with 134 test/fixture lines (13:1 ratio, project threshold is 5:1)." - Netero

🤖 This review was automatically generated with Coder Agents.

@DanielleMaywood

Copy link
Copy Markdown
Contributor Author

/coder-agents-review

@coder-agents-review coder-agents-review Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Panel review (round 2). 1 P1, 1 P2, 6 P3, 2 Nit.

The migration is well-structured: routes mirror the Models page, the monolithic panel decomposition is clean, permission gating is consistent, error handling follows the toast pattern, and the MUI-to-design-system direction is correct. Four commits with a clear feature/test split.

The P1 is a data integrity issue where the header enable/disable toggle and form submit hold competing copies of enabled. Four independent reviewers found it. The P2 is an accidental credential wipe: focus a secret field, blur without typing, save.

CRF-2 (ProviderField deletion) is closed: 6/6 reviewers verified the file has zero remaining consumers.

"Two state owners, one field, no synchronization. The header toggle mutates the server directly. The form holds a stale copy of the same field." - Hisoka

Process note: commit messages on this 2100-line PR are sparse. test(site): cover MCP server settings feedback doesn't name the feedback or the tests. Consider adding commit bodies that reference the finding IDs or describe the change.

🤖 This review was automatically generated with Coder Agents.

Comment thread site/src/pages/AISettingsPage/MCPServersPage/components/mcpServerFormLogic.ts Outdated
Comment thread site/src/pages/AISettingsPage/MCPServersPage/components/MCPServerForm.tsx Outdated
Comment thread site/src/pages/AISettingsPage/MCPServersPage/MCPServersPage.tsx Outdated
Comment thread site/src/pages/AISettingsPage/MCPServersPage/components/MCPServerAuthSection.tsx Outdated
@DanielleMaywood

Copy link
Copy Markdown
Contributor Author

/coder-agents-review

@coder-agents-review coder-agents-review Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-review (round 3). 0 P0-P1 open. 2 new P3.

All 11 addressed findings verified fixed by the panel. The P1 (toggle/form enabled desync) is clean: buildUpdateMCPServerConfigRequest strips enabled, the toggle owns it exclusively, and unit test + story both verify. The P2 (secret focus-blur) is clean: onBlur restores the placeholder and resets touched, with defense-in-depth empty-string guards in the request builder.

CRF-3 (CollapsibleSection duplication) closed by panel (3/3). CRF-4 (story coverage) closed by panel (4/4). Both defenses hold for a migration PR.

Test density improved from 6.8% (R1) to 15.2% (R3). Production-to-test ratio is 5.57:1.

"The tests that exist are genuine gems. The Add story proves slug auto-generation, form gating, auth mode switching, and submit payload." - Bisky

🤖 This review was automatically generated with Coder Agents.

Comment thread site/src/pages/AISettingsPage/MCPServersPage/components/mcpServerFormLogic.ts Outdated
@DanielleMaywood

Copy link
Copy Markdown
Contributor Author

/coder-agents-review

@coder-agents-review coder-agents-review Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All 17 findings resolved across 4 rounds. No open issues.

The P1 (toggle/form enabled desync, found by 4 reviewers) is fixed: buildUpdateMCPServerConfigRequest strips enabled, leaving the toggle as sole owner. Verified by unit test and story. The P2 (secret focus-blur wipe) is fixed: onBlur restores placeholder and resets touched, with defense-in-depth guards in the request builder.

Contest closures: CRF-2 (6/6), CRF-3 (3/3), CRF-4 (4/4), all with verified defenses.

Test density improved from 6.8% (R1) to 15.3% (R4). Production-to-test ratio is 4.4:1, under the 5:1 threshold. tsc --noEmit passes, all 7 unit tests pass, all story tests pass.

"I tried to build a case that the premises were wrong, that this change solves the wrong problem, or that the fix level was too shallow. I couldn't." - Pariston

🤖 This review was automatically generated with Coder Agents.

@DanielleMaywood
DanielleMaywood marked this pull request as ready for review June 24, 2026 10:12
@coderagents

coderagents Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Documentation Check

Updates Needed

  • docs/ai-coder/agents/platform-controls/mcp-servers.md - Navigation instructions reference the old path Agents > Settings > Manage Agents > MCP Servers (lines 8 and 12-13). Should be updated to reflect the new AI Settings > MCP servers location at /ai/settings/mcp-servers.

Automated review via Coder Agents

@github-actions

Copy link
Copy Markdown
Contributor

Docs preview

📖 View docs preview for docs/ai-coder/agents/platform-controls/mcp-servers.md

Copy link
Copy Markdown
Contributor Author

🤖 This comment was written by Coder Agent on behalf of Danielle Maywood 🤖

Fixed in d7829c9cb8. Updated the MCP servers documentation to use the new AI Settings > MCP servers path.

@DanielleMaywood DanielleMaywood changed the title feat(site): move MCP servers to AI settings feat: move MCP servers to AI settings Jun 24, 2026

@johnstcn johnstcn left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving to unblock. This will be manually smoke-tested.

@DanielleMaywood
DanielleMaywood merged commit 8565255 into main Jun 24, 2026
36 of 39 checks passed
@DanielleMaywood
DanielleMaywood deleted the danielle/mcp-ai-settings-redesign branch June 24, 2026 11:30
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 24, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants