From 12161820e7ca5c397fad93ef33d55e0c881b9a86 Mon Sep 17 00:00:00 2001 From: Mickael Farina Date: Thu, 16 Jul 2026 15:55:07 +0200 Subject: [PATCH] fix(connector): a placeholder API key is not a connection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The seeded api_key entries ship placeholders — {"Authorization": "Bearer "} — and is_connected used bool(headers), so a connector with no key at all reported "Connected via API key". #270 made this visible by repairing github to api_key: the card immediately claimed Connected while holding the literal string "". Same class of lie as the old Hugging Face "Connected", one step removed. A header value containing <...> is a placeholder, not a key. Co-Authored-By: Claude Opus 4.8 --- skills/.manifest.json | 2 +- skills/mcp_connect.py | 18 ++++++++++++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/skills/.manifest.json b/skills/.manifest.json index 7f5502d..419412e 100644 --- a/skills/.manifest.json +++ b/skills/.manifest.json @@ -52,7 +52,7 @@ "health_check.py": "01ac95da13770e2419460b4aaf1bd79c6628b6bc5413a5608153b81feee81568", "imessage_send.py": "862f7031a525faed4cec7cb703ef32f5d8bdc1045326f880d50455baf4cfcf86", "json_formatter.py": "42a770a1455a574d33e2f96f34c63ae7a83845f70789862e5e5198d0b429fde2", - "mcp_connect.py": "05eb76c136e963e0a8e8fa06c03ab5bb5c3da2020ca4e5676067d29ae49e617c", + "mcp_connect.py": "30f601667986f6117245e2158c6f2ff241f8a73f8418c43e8c61fe35112b8ca4", "memory_entities.py": "252ad5861d614b916504b8af6300c4a8c62622c9f6c15238b11d6c6a052bada7", "memory_history.py": "a2762c03c325517d10907f8aa9511103a5716a29f9e956d48473b817105fb65c", "memory_save.py": "3d801338bfd0818aaf1e65e692e404af0a0fba6886d26150f0fb66e4b4fde424", diff --git a/skills/mcp_connect.py b/skills/mcp_connect.py index 126da3a..f2e5ea7 100644 --- a/skills/mcp_connect.py +++ b/skills/mcp_connect.py @@ -225,10 +225,24 @@ def _token_adapter(url: str): return TokenStorageAdapter(async_key_value=_token_store(), server_url=url) +def _headers_configured(server: dict) -> bool: + """True only if the api-key headers hold a REAL value. + + The seeded entries ship placeholders — {"Authorization": "Bearer + "} — and `bool(headers)` counted those as configured, so a + connector with no key at all reported "Connected via API key". That is the + same lie as the old Hugging Face "Connected", just with an extra step. + """ + headers = server.get("headers") or {} + if not headers: + return False + return not any("<" in str(v) and ">" in str(v) for v in headers.values()) + + def is_connected(name: str) -> bool: """True if this server has a stored OAuth token. Servers that need no auth are 'connected' as soon as they're enabled; api_key servers count as - connected once their header is configured.""" + connected once a real key is configured (a placeholder does not count).""" server = _find_server(name) if not server: return False @@ -236,7 +250,7 @@ def is_connected(name: str) -> bool: if auth in ("", "none"): return True if auth == "api_key": - return bool(server.get("headers")) + return _headers_configured(server) url = server.get("url") if not url: return False