Skip to content

feat: add filtering and pagination to MCP sessions table - #3825

Merged
Pratham-Mishra04 merged 1 commit into
devfrom
05-27-feat_adds_mcp_session_ui_filters
May 28, 2026
Merged

Pratham-Mishra04 merged 1 commit into
devfrom
05-27-feat_adds_mcp_session_ui_filters

Conversation

@Pratham-Mishra04

Copy link
Copy Markdown
Collaborator

Summary

Adds server-side filtering and pagination to the MCP Sessions page. Previously the page fetched all sessions in a single unfiltered request. This PR introduces a filter bar with search, type, status, and identity-mode dropdowns, plus previous/next pagination, all synced to the URL via query string so filters survive navigation and can be shared as links.

Changes

  • Added a SessionsFilterBar component with a search input and three multi-select dropdowns (type, status, identity mode). Filter values are URL-synced via nuqs with history: "push" so the back button restores previous filter state.
  • Debounced the search input (300 ms) to avoid firing a request on every keystroke.
  • Wired getMCPSessions to accept MCPSessionsQueryParams (search, kind, status, auth_mode, mcp_client_id, limit, offset). Array filters are CSV-joined to match the backend's parseCommaSeparated convention. Empty values are dropped so RTK Query's cache key doesn't fragment unnecessarily.
  • Added a total_count-based pagination footer with Previous/Next buttons. The offset snaps back to the last valid page if a revoke removes the final row on the current page (same pattern used by the virtual keys page).
  • Replaced the optimistic patch on revokeMCPSession with invalidatesTags: ["MCPSessions"]. The optimistic approach only worked with a singleton cache key; with per-filter cache entries, invalidating all keyed entries via a tag refetch is simpler and correct.
  • Added an icon prop to ComboboxSelectOption and a compactTrigger prop to ComboboxSelect. compactTrigger renders "N selected" instead of a row of badges, preventing overflow in narrow filter-bar dropdowns.
  • Added MCPSessionsQueryParams and pagination fields to MCPSessionsListResponse in the type definitions.
  • Page size is set to 50 (larger than the governance default of 25) since session rows are denser than virtual key rows.

Type of change

  • Bug fix
  • Feature
  • Refactor
  • Documentation
  • Chore/CI

Affected areas

  • Core (Go)
  • Transports (HTTP)
  • Providers/Integrations
  • Plugins
  • UI (React)
  • Docs

How to test

  1. Navigate to the MCP Sessions page.
  2. Verify the filter bar appears above the table with a search input and Type, Status, and Identity dropdowns.
  3. Enter a search term and confirm the table updates after ~300 ms with matching sessions.
  4. Select one or more values in each dropdown and confirm the table filters accordingly.
  5. Confirm filter state is reflected in the URL and survives a page refresh.
  6. With more than 50 sessions, confirm the pagination footer shows the correct range and that Previous/Next navigate correctly.
  7. Revoke a session on the last page (when it is the only row) and confirm the page snaps back to the previous page rather than showing an empty paginated view.
  8. Confirm the "Clear filters" button appears only when a filter is active and resets all filters and offset.
cd ui
pnpm i || npm i
pnpm build || npm run build

Screenshots/Recordings

Add before/after screenshots of the MCP Sessions page showing the filter bar and pagination footer.

Breaking changes

  • Yes
  • No

Related issues

Security considerations

Filter values are passed as query parameters to the existing authenticated /api/mcp/sessions endpoint. No new auth surface is introduced. Filter state stored in the URL does not include secrets.

Checklist

  • I read docs/contributing/README.md and followed the guidelines
  • I added/updated tests where appropriate
  • I updated documentation where needed
  • I verified builds succeed (Go and UI)
  • I verified the CI pipeline passes locally if applicable

Pratham-Mishra04 commented May 27, 2026

Copy link
Copy Markdown
Collaborator Author

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@coderabbitai

coderabbitai Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@Pratham-Mishra04, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 22 minutes and 36 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c5975624-d1ca-4a15-9353-531f9b30d250

📥 Commits

Reviewing files that changed from the base of the PR and between ff0276e and 61ff2b5.

📒 Files selected for processing (7)
  • ui/app/workspace/mcp-sessions/page.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsTable.tsx
  • ui/components/ui/combobox.tsx
  • ui/lib/store/apis/mcpSessionsApi.ts
  • ui/lib/types/mcpSessions.ts
  • ui/next-env.d.ts
📝 Walkthrough

Walkthrough

This PR upgrades the MCP sessions page from a basic unfiltered list to a fully featured filterable and paginated experience. The changes flow backward from UI components through state management to the backend API contract: new type definitions support parameterized queries, the combobox gains rendering features needed by filters, a new filter bar provides the UI, the sessions table grows to host filters and pagination controls, and the page component orchestrates everything with URL-driven state and debouncing.

Changes

MCP Sessions Filtering and Pagination

Layer / File(s) Summary
Type contracts and API layer
ui/lib/types/mcpSessions.ts, ui/lib/store/apis/mcpSessionsApi.ts, ui/next-env.d.ts
MCPSessionsListResponse gains optional pagination fields (count, total_count, limit, offset). New MCPSessionsQueryParams type documents the GET /api/mcp/sessions query string shape with optional filters and pagination. getMCPSessions now accepts parameterized filters and pagination, building query strings with selective inclusion and CSV-joined arrays. revokeMCPSession refactored to invalidate keyed list queries. Minor next-env triple-slash reference removed.
Combobox component enhancements
ui/components/ui/combobox.tsx
ComboboxSelectOption adds optional icon field for rendering in dropdown lists. Multi-select variant gains compactTrigger prop to collapse selected badges into "N selected" text, and dropdown items now render icons when present. data-testid is passed through to trigger buttons.
Filter bar component
ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx
New SessionsFilterBar component renders search input and three multi-select filters (kind, status, auth mode) with in-file option definitions and lucide icons. Conditionally shows "Clear filters" button when any filter is active. Fully controlled via props.
Sessions table with filters and pagination
ui/app/workspace/mcp-sessions/views/sessionsTable.tsx
SessionsTableProps expanded to accept search, filter arrays with change handlers, clear handler, pagination state (offset, limit, totalCount), and loading indicator. Integrates SessionsFilterBar above the table and applies opacity transition when fetching. Empty state now distinguishes "no matches for filters" vs "no sessions yet". Pagination footer shows "Showing X–Y of Z" and Previous/Next controls when totalCount > 0.
Page component orchestration and URL state
ui/app/workspace/mcp-sessions/page.tsx
MCPSessionsPage now uses useQueryStates to parse filter and pagination parameters from URL (q, kind, status, auth_mode, mcp_client_id, offset) and useDebouncedValue to debounce search before querying. Implements filter change handlers that update query state and reset offset, and a clear-filters handler. Effect snaps offset backward when total count shrinks. All state and handlers wired to SessionsTable.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

  • akshaydeo
  • danpiths

🐰 With icons and filters in place,
Sessions rows align with grace,
Debounced queries hum along,
Pages flip where results belong,
URL keeps every trace.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main changes: adding filtering and pagination functionality to the MCP sessions table, which is the primary purpose of this PR.
Description check ✅ Passed The description covers all key sections with comprehensive detail: purpose, implementation changes, type of change, affected areas, testing instructions, security considerations, and a completed checklist. All required template sections are addressed.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 05-27-feat_adds_mcp_session_ui_filters

Comment @coderabbitai help to get the list of available commands and usage tips.

@greptile-apps

greptile-apps Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Confidence Score: 4/5

Safe to merge after the isLoading full-page-flash regression (noted in the prior review) is addressed; everything else is well-structured.

The isLoading guard in page.tsx shows a full-screen spinner on every first visit to a new filter combination, replacing the intended opacity overlay. This is a visible regression from the previous behaviour where a single cache entry meant transitions never triggered isLoading. The rest of the change — URL-synced state, sorted-CSV cache keys, tag invalidation, snap-back logic, and the combobox additions — is solid.

ui/app/workspace/mcp-sessions/page.tsx — the isLoading guard needs to be tightened to !data && isLoading so stale-data transitions use the opacity overlay instead of replacing the page.

Important Files Changed

Filename Overview
ui/app/workspace/mcp-sessions/page.tsx Adds nuqs URL state for filters and pagination; isLoading guard still triggers full-page loader on every uncached filter combination (noted in prior review)
ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx New filter-bar component with search, kind, status, and identity-mode multi-selects; clean and self-contained
ui/app/workspace/mcp-sessions/views/sessionsTable.tsx Integrates SessionsFilterBar and adds a Previous/Next pagination footer; isFetching opacity overlay applied correctly
ui/components/ui/combobox.tsx Adds icon prop to options, compactTrigger mode for narrow dropdowns, and properly forwards data-testid to both single- and multi-select trigger buttons
ui/lib/store/apis/mcpSessionsApi.ts Parameterises getMCPSessions with sorted CSV array encoding; switches revokeMCPSession from optimistic patch to invalidatesTags for correctness with per-filter cache keys
ui/lib/types/mcpSessions.ts Adds MCPSessionsQueryParams and pagination envelope to MCPSessionsListResponse; count field is declared but unused alongside total_count
ui/next-env.d.ts Removes stale reference to ./out/types/routes.d.ts and adds trailing newline; cosmetic generated-file cleanup

Reviews (7): Last reviewed commit: "feat: adds mcp session ui filters" | Re-trigger Greptile

Comment thread ui/components/ui/combobox.tsx
Comment thread ui/app/workspace/mcp-sessions/page.tsx

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx (1)

52-52: ⚡ Quick win

Rename file to PascalCase to match component-file convention.

SessionsFilterBar export is PascalCase, but the filename sessionsFilterBar.tsx is not. Please rename the file to SessionsFilterBar.tsx and update imports to keep convention consistent.

As per coding guidelines: “ui/**/*.tsx: React component files must use PascalCase for component exports and filenames”.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx` at line 52, The
component export SessionsFilterBar uses PascalCase but the filename
sessionsFilterBar.tsx does not; rename the file to SessionsFilterBar.tsx and
update all imports that reference the old filename to the new one (e.g., import
{ SessionsFilterBar } from './SessionsFilterBar' or default imports pointing to
'./SessionsFilterBar') so the file and export follow the PascalCase
component-file convention used for React components in ui/**/*.tsx.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx`:
- Line 52: The component export SessionsFilterBar uses PascalCase but the
filename sessionsFilterBar.tsx does not; rename the file to
SessionsFilterBar.tsx and update all imports that reference the old filename to
the new one (e.g., import { SessionsFilterBar } from './SessionsFilterBar' or
default imports pointing to './SessionsFilterBar') so the file and export follow
the PascalCase component-file convention used for React components in
ui/**/*.tsx.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 94d2ee77-c50e-4e3c-b47d-683b3a78ee5a

📥 Commits

Reviewing files that changed from the base of the PR and between f16dc9a and 0c43360.

📒 Files selected for processing (7)
  • ui/app/workspace/mcp-sessions/page.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsTable.tsx
  • ui/components/ui/combobox.tsx
  • ui/lib/store/apis/mcpSessionsApi.ts
  • ui/lib/types/mcpSessions.ts
  • ui/next-env.d.ts

@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_filters_for_mcp_session branch from f16dc9a to f3b68ca Compare May 27, 2026 19:36
@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_mcp_session_ui_filters branch from 0c43360 to 18dd115 Compare May 27, 2026 19:36

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/lib/store/apis/mcpSessionsApi.ts`:
- Around line 21-24: The serialization of
params.kind/status/auth_mode/mcp_client_id uses the incoming array order,
causing different cache keys for the same filter set; update the code that
builds out (the block referencing params and out) to normalize each array before
joining by sorting (e.g., sort a copy of
params.kind/status/auth_mode/mcp_client_id) and then join with "," so the CSV is
stable regardless of selection order.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: dec6d322-f904-4852-86d5-30cca7fdcedc

📥 Commits

Reviewing files that changed from the base of the PR and between 0c43360 and 18dd115.

📒 Files selected for processing (7)
  • ui/app/workspace/mcp-sessions/page.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsTable.tsx
  • ui/components/ui/combobox.tsx
  • ui/lib/store/apis/mcpSessionsApi.ts
  • ui/lib/types/mcpSessions.ts
  • ui/next-env.d.ts
✅ Files skipped from review due to trivial changes (1)
  • ui/next-env.d.ts
🚧 Files skipped from review as they are similar to previous changes (5)
  • ui/lib/types/mcpSessions.ts
  • ui/app/workspace/mcp-sessions/page.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsFilterBar.tsx
  • ui/app/workspace/mcp-sessions/views/sessionsTable.tsx
  • ui/components/ui/combobox.tsx

Comment thread ui/lib/store/apis/mcpSessionsApi.ts Outdated
@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_mcp_session_ui_filters branch 2 times, most recently from d29ee9c to aaac840 Compare May 27, 2026 19:54
@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_filters_for_mcp_session branch 2 times, most recently from ee8ef16 to 4618bc3 Compare May 28, 2026 05:23
@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_mcp_session_ui_filters branch from aaac840 to ff0276e Compare May 28, 2026 05:23
coderabbitai[bot]
coderabbitai Bot previously approved these changes May 28, 2026
@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_filters_for_mcp_session branch from 4618bc3 to 358bc58 Compare May 28, 2026 07:26
@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_mcp_session_ui_filters branch from ff0276e to c541cbd Compare May 28, 2026 07:26

Pratham-Mishra04 commented May 28, 2026

Copy link
Copy Markdown
Collaborator Author

Merge activity

  • May 28, 7:29 AM UTC: A user started a stack merge that includes this pull request via Graphite.
  • May 28, 7:37 AM UTC: Graphite rebased this pull request as part of a merge.
  • May 28, 7:38 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

@Pratham-Mishra04
Pratham-Mishra04 changed the base branch from 05-27-feat_adds_filters_for_mcp_session to graphite-base/3825 May 28, 2026 07:33
@Pratham-Mishra04
Pratham-Mishra04 changed the base branch from graphite-base/3825 to dev May 28, 2026 07:36
@Pratham-Mishra04
Pratham-Mishra04 dismissed coderabbitai[bot]’s stale review May 28, 2026 07:36

The base branch was changed.

@Pratham-Mishra04
Pratham-Mishra04 force-pushed the 05-27-feat_adds_mcp_session_ui_filters branch from c541cbd to 61ff2b5 Compare May 28, 2026 07:36
@Pratham-Mishra04
Pratham-Mishra04 merged commit 26ee9db into dev May 28, 2026
13 of 15 checks passed
@Pratham-Mishra04
Pratham-Mishra04 deleted the 05-27-feat_adds_mcp_session_ui_filters branch May 28, 2026 07:38
akshaydeo pushed a commit that referenced this pull request May 29, 2026
## Summary

Adds server-side filtering and pagination to the MCP Sessions page. Previously the page fetched all sessions in a single unfiltered request. This PR introduces a filter bar with search, type, status, and identity-mode dropdowns, plus previous/next pagination, all synced to the URL via query string so filters survive navigation and can be shared as links.

## Changes

- Added a `SessionsFilterBar` component with a search input and three multi-select dropdowns (type, status, identity mode). Filter values are URL-synced via `nuqs` with `history: "push"` so the back button restores previous filter state.
- Debounced the search input (300 ms) to avoid firing a request on every keystroke.
- Wired `getMCPSessions` to accept `MCPSessionsQueryParams` (search, kind, status, auth_mode, mcp_client_id, limit, offset). Array filters are CSV-joined to match the backend's `parseCommaSeparated` convention. Empty values are dropped so RTK Query's cache key doesn't fragment unnecessarily.
- Added a `total_count`-based pagination footer with Previous/Next buttons. The offset snaps back to the last valid page if a revoke removes the final row on the current page (same pattern used by the virtual keys page).
- Replaced the optimistic patch on `revokeMCPSession` with `invalidatesTags: ["MCPSessions"]`. The optimistic approach only worked with a singleton cache key; with per-filter cache entries, invalidating all keyed entries via a tag refetch is simpler and correct.
- Added an `icon` prop to `ComboboxSelectOption` and a `compactTrigger` prop to `ComboboxSelect`. `compactTrigger` renders "N selected" instead of a row of badges, preventing overflow in narrow filter-bar dropdowns.
- Added `MCPSessionsQueryParams` and pagination fields to `MCPSessionsListResponse` in the type definitions.
- Page size is set to 50 (larger than the governance default of 25) since session rows are denser than virtual key rows.

## Type of change

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Chore/CI

## Affected areas

- [ ] Core (Go)
- [ ] Transports (HTTP)
- [ ] Providers/Integrations
- [ ] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

1. Navigate to the MCP Sessions page.
2. Verify the filter bar appears above the table with a search input and Type, Status, and Identity dropdowns.
3. Enter a search term and confirm the table updates after ~300 ms with matching sessions.
4. Select one or more values in each dropdown and confirm the table filters accordingly.
5. Confirm filter state is reflected in the URL and survives a page refresh.
6. With more than 50 sessions, confirm the pagination footer shows the correct range and that Previous/Next navigate correctly.
7. Revoke a session on the last page (when it is the only row) and confirm the page snaps back to the previous page rather than showing an empty paginated view.
8. Confirm the "Clear filters" button appears only when a filter is active and resets all filters and offset.

```sh
cd ui
pnpm i || npm i
pnpm build || npm run build
```

## Screenshots/Recordings

_Add before/after screenshots of the MCP Sessions page showing the filter bar and pagination footer._

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

## Security considerations

Filter values are passed as query parameters to the existing authenticated `/api/mcp/sessions` endpoint. No new auth surface is introduced. Filter state stored in the URL does not include secrets.

## Checklist

- [ ] I read `docs/contributing/README.md` and followed the guidelines
- [ ] I added/updated tests where appropriate
- [ ] I updated documentation where needed
- [ ] I verified builds succeed (Go and UI)
- [ ] I verified the CI pipeline passes locally if applicable
@akshaydeo akshaydeo mentioned this pull request May 29, 2026
18 tasks
akshaydeo added a commit that referenced this pull request May 29, 2026
## Summary

This PR releases **core v1.5.14**, **framework v1.3.14**, **transports v1.5.6**, and bumps all dependent plugins to their respective `.14` patch versions. It delivers a broad set of new capabilities across MCP authentication, key rotation, OTel metrics, Bedrock/Anthropic compatibility, and UI improvements, alongside a number of targeted bug fixes and refactors.

## Changes

- **Direct API Key Header** — Providers can now receive an API key passed directly via a request header (#3817)
- **MCP Per-User Auth** — Introduced `MCPCredentialStore` abstraction, per-user MCP credential reconciliation, and a new per-user header auth type with lazy-auth submission flow (#3656, #3702, #3703, #3704, #3705)
- **MCP TLS Configuration** — Added configurable TLS (`insecureSkipVerify`, `caCertPem`) for HTTP/SSE MCP client connections (#3779, #3783)
- **MCP Sessions Management** — Filter, search, and pagination on the MCP sessions list API and table, plus a `can_reauth` identity gate (#3823, #3824, #3825)
- **Key Rotation** — Keys now rotate on 401/402/403 responses; returns `502 upstream_credentials_exhausted` when all keys are permanently exhausted. Added `triggered_rotation` to `KeyAttemptRecord` and tightened `bifrost_key_rotation_events_total` semantics (#3430, #3491)
- **OTel Metrics** — Added OTel spec-compatible metrics (backward compatible) with provider cache and semantic cache attributes in metrics export (#3865, #3816)
- **Opus 4.8 Support** — System message handling and general compatibility for Opus 4.8 (#3868, #3878)
- **Dimension Rankings** — New `GetDimensionRankings` API and dashboard tabs for team, customer, BU, and user rankings (#3766)
- **Model Pricing Attributes** — `additional_attributes` field on model pricing rows with management API and UI editor (#3829)
- **Prompt Cache Retention** — Added prompt cache retention parameter on responses requests (#3810)
- **Tool Call Execution UI** — Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (#3837, #3843)
- **Sheet Navigation** — Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (#3739, #3740, #3744, #3745)
- **Bedrock Tool Name Truncation** — Truncate Bedrock function/tool names to the provider length limit
- **Bedrock Guardrails** — Set guardrail config in Bedrock requests built from responses (#3862)
- **Anthropic Tool Use** — Default `tool_use` input to `{}` when arguments are absent (#3880)
- **Responses Streaming** — Fixed responses stream events (#3838)
- **Compat Flow** — Fixed missing parameter parsing on the compat flow (#3881)
- **Passthrough API Version** — Set a default API version in passthrough requests as a fallback (#3853)
- **Virtual Key Updates** — Avoid overriding optional fields during virtual key update (#3855)
- **User-Mode Flows** — Gate user-mode flows on caller `user_id`, skip temp token mint, and unify flow/credential kind filtering for pending flows (#3841, #3859)
- **Partial Tool Calls** — Handle partial tool call execution failures and return successful results (#3849)
- **URL Query Escaping** — Support escaped characters in URL query parameters (#3826)
- **MCP Auth Errors** — Inline banner and retry support for MCP auth-required errors (#3856)
- **Renamed Resolvers** — `staticHeadersResolver`/`serverOAuthResolver` renamed to `sharedHeadersResolver`/`sharedOAuthResolver` (#3840)
- **Starlark Nested Tool Calls** — Exposed `RunWithPluginPipeline` on `ClientManager` and routed Starlark nested tool calls through the canonical plugin gate (#3794)
- **Deferred-Fill OAuth Removed** — Removed deferred-fill user-mode OAuth flow support (#3839)
- **Go 1.26.3** — Upgraded toolchain to Go 1.26.3 (#3782)

## Type of change

- [x] Bug fix
- [x] Feature
- [x] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

```sh
# Core/Transports
go version  # should report go1.26.3
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build
```

- Validate MCP per-user auth by configuring a per-user header auth type and confirming credentials are stored and reconciled on virtual key and MCP client changes.
- Validate key rotation by triggering a 401/402/403 from an upstream provider and confirming rotation occurs; exhaust all keys and confirm a `502 upstream_credentials_exhausted` is returned.
- Validate OTel metrics output includes `provider_cache` and `semantic_cache` attributes.
- Validate Bedrock requests with tool names exceeding the provider limit are truncated correctly.
- Validate Opus 4.8 system message handling by sending a request with a system message to an Opus 4.8 endpoint.

## Breaking changes

- [x] Yes
- [ ] No

The deferred-fill user-mode OAuth flow has been removed (#3839). Any integrations relying on that flow must migrate to the new per-user credential store approach. The `staticHeadersResolver` and `serverOAuthResolver` identifiers have been renamed to `sharedHeadersResolver` and `sharedOAuthResolver` respectively (#3840); any direct references must be updated.

## Related issues

#3817, #3656, #3702, #3703, #3704, #3705, #3779, #3783, #3823, #3824, #3825, #3430, #3491, #3865, #3816, #3868, #3878, #3766, #3829, #3810, #3837, #3843, #3739, #3740, #3744, #3745, #3862, #3880, #3838, #3881, #3853, #3855, #3841, #3859, #3849, #3826, #3856, #3840, #3794, #3839, #3782, #3724, #3814, #3836, #3869, #3886

## Security considerations

- MCP per-user credentials are stored via the new `MCPCredentialStore` abstraction; ensure the backing store is appropriately access-controlled and that credential values are encrypted at rest.
- The direct API key header feature passes provider secrets via HTTP headers; ensure TLS is enforced on all ingress paths and that headers are not logged in plaintext.
- User-mode flows are now gated on `caller user_id` and temp token minting is skipped where appropriate, reducing the surface for privilege escalation.
- TLS configuration for MCP HTTP/SSE connections supports `insecureSkipVerify`; this should only be enabled in controlled environments.

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable
@akshaydeo akshaydeo mentioned this pull request May 29, 2026
akshaydeo added a commit that referenced this pull request May 29, 2026
## ✨ Features

- **Direct API Key Header** - Pass a provider API key directly via
request header (#3817)
- **MCP Per-User Authentication** - New per-user header auth type with
credential storage
  and lazy-auth submission flow (#3703, #3704, #3705)
- **MCP TLS Configuration** - Configurable TLS (insecureSkipVerify,
caCertPem) for HTTP/SSE
  MCP client connections (#3779, #3783)
- **MCP Sessions Management** - Filter, search, and pagination on the
MCP sessions list API
  and table, plus a can_reauth identity gate (#3823, #3824, #3825)
- **Tool Call Execution UI** - Inline tool-call execution, stop
streaming, bulk
  execute/submit, and a redesigned tool-call UI (#3837, #3843)
- **Dimension Rankings Dashboard** - New dashboard tabs for team,
customer, BU, and user
  rankings, backed by a GetDimensionRankings API (#3766)
- **Model Pricing Attributes** - additional_attributes on model pricing
rows with management
  API and UI editor (#3829)
- **Prompt Cache Retention** - Prompt cache retention parameter on
responses requests
  (#3810)
- **Opus 4.8 Support** - System message handling and compatibility for
Opus 4.8 (#3878,
  #3868)
  - **Key Rotation** - Rotate keys on 401/402/403 and return 502
upstream_credentials_exhausted when all keys are permanently dead
(#3491)
- **OTel Metrics** - OTel spec compatible metrics plus provider and
semantic cache
  attributes in metrics export (#3865, #3816)
- **Sheet Navigation** - Prev/next keyboard navigation and URL state
across virtual key, MCP
  client, and routing rule sheets (#3739, #3740, #3744, #3745)
  - **Go 1.26.3** - Upgraded toolchain to Go 1.26.3 (#3782)

  ## 🐞 Fixed

- **Bedrock Tool Names** - Truncate Bedrock function/tool names to the
provider length limit
- **Bedrock Guardrails** - Set guardrail config in Bedrock request built
from responses
  (#3862)
- **Anthropic Tool Use** - Default Anthropic tool_use input to {} when
arguments are absent
  (#3880)
  - **Responses Streaming** - Fixed responses stream events (#3838)
- **Compat Flow** - Fixed missing parameter parsing on the compat flow
(#3881)
- **Passthrough API Version** - Set a default API version in passthrough
requests as a
  fallback (#3853)
- **Virtual Key Updates** - Avoid overriding optional fields during
virtual key update
  (#3855)
- **User-Mode Flows** - Gate user-mode flows on caller user_id, skip
temp token mint, and
  unify flow/credential kind filtering for pending flows (#3841, #3859)
- **Partial Tool Calls** - Handle partial tool call execution failures
and return successful
  results (#3849)
- **URL Query Escaping** - Support escaped characters in URL query
parameters (#3826)
- **MCP Auth Errors** - Inline banner and retry support for MCP
auth-required errors (#3856)
- **JSON Editor Height** - Cap JSON editor max height at 400px in
message views (#3842)
akhsaul pushed a commit to akhsaul/bifrost that referenced this pull request Aug 27, 2026
## Summary

Adds server-side filtering and pagination to the MCP Sessions page. Previously the page fetched all sessions in a single unfiltered request. This PR introduces a filter bar with search, type, status, and identity-mode dropdowns, plus previous/next pagination, all synced to the URL via query string so filters survive navigation and can be shared as links.

## Changes

- Added a `SessionsFilterBar` component with a search input and three multi-select dropdowns (type, status, identity mode). Filter values are URL-synced via `nuqs` with `history: "push"` so the back button restores previous filter state.
- Debounced the search input (300 ms) to avoid firing a request on every keystroke.
- Wired `getMCPSessions` to accept `MCPSessionsQueryParams` (search, kind, status, auth_mode, mcp_client_id, limit, offset). Array filters are CSV-joined to match the backend's `parseCommaSeparated` convention. Empty values are dropped so RTK Query's cache key doesn't fragment unnecessarily.
- Added a `total_count`-based pagination footer with Previous/Next buttons. The offset snaps back to the last valid page if a revoke removes the final row on the current page (same pattern used by the virtual keys page).
- Replaced the optimistic patch on `revokeMCPSession` with `invalidatesTags: ["MCPSessions"]`. The optimistic approach only worked with a singleton cache key; with per-filter cache entries, invalidating all keyed entries via a tag refetch is simpler and correct.
- Added an `icon` prop to `ComboboxSelectOption` and a `compactTrigger` prop to `ComboboxSelect`. `compactTrigger` renders "N selected" instead of a row of badges, preventing overflow in narrow filter-bar dropdowns.
- Added `MCPSessionsQueryParams` and pagination fields to `MCPSessionsListResponse` in the type definitions.
- Page size is set to 50 (larger than the governance default of 25) since session rows are denser than virtual key rows.

## Type of change

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Chore/CI

## Affected areas

- [ ] Core (Go)
- [ ] Transports (HTTP)
- [ ] Providers/Integrations
- [ ] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

1. Navigate to the MCP Sessions page.
2. Verify the filter bar appears above the table with a search input and Type, Status, and Identity dropdowns.
3. Enter a search term and confirm the table updates after ~300 ms with matching sessions.
4. Select one or more values in each dropdown and confirm the table filters accordingly.
5. Confirm filter state is reflected in the URL and survives a page refresh.
6. With more than 50 sessions, confirm the pagination footer shows the correct range and that Previous/Next navigate correctly.
7. Revoke a session on the last page (when it is the only row) and confirm the page snaps back to the previous page rather than showing an empty paginated view.
8. Confirm the "Clear filters" button appears only when a filter is active and resets all filters and offset.

```sh
cd ui
pnpm i || npm i
pnpm build || npm run build
```

## Screenshots/Recordings

_Add before/after screenshots of the MCP Sessions page showing the filter bar and pagination footer._

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

## Security considerations

Filter values are passed as query parameters to the existing authenticated `/api/mcp/sessions` endpoint. No new auth surface is introduced. Filter state stored in the URL does not include secrets.

## Checklist

- [ ] I read `docs/contributing/README.md` and followed the guidelines
- [ ] I added/updated tests where appropriate
- [ ] I updated documentation where needed
- [ ] I verified builds succeed (Go and UI)
- [ ] I verified the CI pipeline passes locally if applicable
akhsaul pushed a commit to akhsaul/bifrost that referenced this pull request Aug 27, 2026
## Summary

This PR releases **core v1.5.14**, **framework v1.3.14**, **transports v1.5.6**, and bumps all dependent plugins to their respective `.14` patch versions. It delivers a broad set of new capabilities across MCP authentication, key rotation, OTel metrics, Bedrock/Anthropic compatibility, and UI improvements, alongside a number of targeted bug fixes and refactors.

## Changes

- **Direct API Key Header** — Providers can now receive an API key passed directly via a request header (maximhq#3817)
- **MCP Per-User Auth** — Introduced `MCPCredentialStore` abstraction, per-user MCP credential reconciliation, and a new per-user header auth type with lazy-auth submission flow (maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** — Added configurable TLS (`insecureSkipVerify`, `caCertPem`) for HTTP/SSE MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** — Filter, search, and pagination on the MCP sessions list API and table, plus a `can_reauth` identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Key Rotation** — Keys now rotate on 401/402/403 responses; returns `502 upstream_credentials_exhausted` when all keys are permanently exhausted. Added `triggered_rotation` to `KeyAttemptRecord` and tightened `bifrost_key_rotation_events_total` semantics (maximhq#3430, maximhq#3491)
- **OTel Metrics** — Added OTel spec-compatible metrics (backward compatible) with provider cache and semantic cache attributes in metrics export (maximhq#3865, maximhq#3816)
- **Opus 4.8 Support** — System message handling and general compatibility for Opus 4.8 (maximhq#3868, maximhq#3878)
- **Dimension Rankings** — New `GetDimensionRankings` API and dashboard tabs for team, customer, BU, and user rankings (maximhq#3766)
- **Model Pricing Attributes** — `additional_attributes` field on model pricing rows with management API and UI editor (maximhq#3829)
- **Prompt Cache Retention** — Added prompt cache retention parameter on responses requests (maximhq#3810)
- **Tool Call Execution UI** — Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Sheet Navigation** — Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
- **Bedrock Tool Name Truncation** — Truncate Bedrock function/tool names to the provider length limit
- **Bedrock Guardrails** — Set guardrail config in Bedrock requests built from responses (maximhq#3862)
- **Anthropic Tool Use** — Default `tool_use` input to `{}` when arguments are absent (maximhq#3880)
- **Responses Streaming** — Fixed responses stream events (maximhq#3838)
- **Compat Flow** — Fixed missing parameter parsing on the compat flow (maximhq#3881)
- **Passthrough API Version** — Set a default API version in passthrough requests as a fallback (maximhq#3853)
- **Virtual Key Updates** — Avoid overriding optional fields during virtual key update (maximhq#3855)
- **User-Mode Flows** — Gate user-mode flows on caller `user_id`, skip temp token mint, and unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** — Handle partial tool call execution failures and return successful results (maximhq#3849)
- **URL Query Escaping** — Support escaped characters in URL query parameters (maximhq#3826)
- **MCP Auth Errors** — Inline banner and retry support for MCP auth-required errors (maximhq#3856)
- **Renamed Resolvers** — `staticHeadersResolver`/`serverOAuthResolver` renamed to `sharedHeadersResolver`/`sharedOAuthResolver` (maximhq#3840)
- **Starlark Nested Tool Calls** — Exposed `RunWithPluginPipeline` on `ClientManager` and routed Starlark nested tool calls through the canonical plugin gate (maximhq#3794)
- **Deferred-Fill OAuth Removed** — Removed deferred-fill user-mode OAuth flow support (maximhq#3839)
- **Go 1.26.3** — Upgraded toolchain to Go 1.26.3 (maximhq#3782)

## Type of change

- [x] Bug fix
- [x] Feature
- [x] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

```sh
# Core/Transports
go version  # should report go1.26.3
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build
```

- Validate MCP per-user auth by configuring a per-user header auth type and confirming credentials are stored and reconciled on virtual key and MCP client changes.
- Validate key rotation by triggering a 401/402/403 from an upstream provider and confirming rotation occurs; exhaust all keys and confirm a `502 upstream_credentials_exhausted` is returned.
- Validate OTel metrics output includes `provider_cache` and `semantic_cache` attributes.
- Validate Bedrock requests with tool names exceeding the provider limit are truncated correctly.
- Validate Opus 4.8 system message handling by sending a request with a system message to an Opus 4.8 endpoint.

## Breaking changes

- [x] Yes
- [ ] No

The deferred-fill user-mode OAuth flow has been removed (maximhq#3839). Any integrations relying on that flow must migrate to the new per-user credential store approach. The `staticHeadersResolver` and `serverOAuthResolver` identifiers have been renamed to `sharedHeadersResolver` and `sharedOAuthResolver` respectively (maximhq#3840); any direct references must be updated.

## Related issues

maximhq#3817, maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705, maximhq#3779, maximhq#3783, maximhq#3823, maximhq#3824, maximhq#3825, maximhq#3430, maximhq#3491, maximhq#3865, maximhq#3816, maximhq#3868, maximhq#3878, maximhq#3766, maximhq#3829, maximhq#3810, maximhq#3837, maximhq#3843, maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745, maximhq#3862, maximhq#3880, maximhq#3838, maximhq#3881, maximhq#3853, maximhq#3855, maximhq#3841, maximhq#3859, maximhq#3849, maximhq#3826, maximhq#3856, maximhq#3840, maximhq#3794, maximhq#3839, maximhq#3782, maximhq#3724, maximhq#3814, maximhq#3836, maximhq#3869, maximhq#3886

## Security considerations

- MCP per-user credentials are stored via the new `MCPCredentialStore` abstraction; ensure the backing store is appropriately access-controlled and that credential values are encrypted at rest.
- The direct API key header feature passes provider secrets via HTTP headers; ensure TLS is enforced on all ingress paths and that headers are not logged in plaintext.
- User-mode flows are now gated on `caller user_id` and temp token minting is skipped where appropriate, reducing the surface for privilege escalation.
- TLS configuration for MCP HTTP/SSE connections supports `insecureSkipVerify`; this should only be enabled in controlled environments.

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable
akhsaul pushed a commit to akhsaul/bifrost that referenced this pull request Aug 27, 2026
## ✨ Features

- **Direct API Key Header** - Pass a provider API key directly via
request header (maximhq#3817)
- **MCP Per-User Authentication** - New per-user header auth type with
credential storage
  and lazy-auth submission flow (maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** - Configurable TLS (insecureSkipVerify,
caCertPem) for HTTP/SSE
  MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** - Filter, search, and pagination on the
MCP sessions list API
  and table, plus a can_reauth identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Tool Call Execution UI** - Inline tool-call execution, stop
streaming, bulk
  execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Dimension Rankings Dashboard** - New dashboard tabs for team,
customer, BU, and user
  rankings, backed by a GetDimensionRankings API (maximhq#3766)
- **Model Pricing Attributes** - additional_attributes on model pricing
rows with management
  API and UI editor (maximhq#3829)
- **Prompt Cache Retention** - Prompt cache retention parameter on
responses requests
  (maximhq#3810)
- **Opus 4.8 Support** - System message handling and compatibility for
Opus 4.8 (maximhq#3878,
  maximhq#3868)
  - **Key Rotation** - Rotate keys on 401/402/403 and return 502
upstream_credentials_exhausted when all keys are permanently dead
(maximhq#3491)
- **OTel Metrics** - OTel spec compatible metrics plus provider and
semantic cache
  attributes in metrics export (maximhq#3865, maximhq#3816)
- **Sheet Navigation** - Prev/next keyboard navigation and URL state
across virtual key, MCP
  client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
  - **Go 1.26.3** - Upgraded toolchain to Go 1.26.3 (maximhq#3782)

  ## 🐞 Fixed

- **Bedrock Tool Names** - Truncate Bedrock function/tool names to the
provider length limit
- **Bedrock Guardrails** - Set guardrail config in Bedrock request built
from responses
  (maximhq#3862)
- **Anthropic Tool Use** - Default Anthropic tool_use input to {} when
arguments are absent
  (maximhq#3880)
  - **Responses Streaming** - Fixed responses stream events (maximhq#3838)
- **Compat Flow** - Fixed missing parameter parsing on the compat flow
(maximhq#3881)
- **Passthrough API Version** - Set a default API version in passthrough
requests as a
  fallback (maximhq#3853)
- **Virtual Key Updates** - Avoid overriding optional fields during
virtual key update
  (maximhq#3855)
- **User-Mode Flows** - Gate user-mode flows on caller user_id, skip
temp token mint, and
  unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** - Handle partial tool call execution failures
and return successful
  results (maximhq#3849)
- **URL Query Escaping** - Support escaped characters in URL query
parameters (maximhq#3826)
- **MCP Auth Errors** - Inline banner and retry support for MCP
auth-required errors (maximhq#3856)
- **JSON Editor Height** - Cap JSON editor max height at 400px in
message views (maximhq#3842)
occcat pushed a commit to occcat/bifrost that referenced this pull request Sep 2, 2026
## Summary

Adds server-side filtering and pagination to the MCP Sessions page. Previously the page fetched all sessions in a single unfiltered request. This PR introduces a filter bar with search, type, status, and identity-mode dropdowns, plus previous/next pagination, all synced to the URL via query string so filters survive navigation and can be shared as links.

## Changes

- Added a `SessionsFilterBar` component with a search input and three multi-select dropdowns (type, status, identity mode). Filter values are URL-synced via `nuqs` with `history: "push"` so the back button restores previous filter state.
- Debounced the search input (300 ms) to avoid firing a request on every keystroke.
- Wired `getMCPSessions` to accept `MCPSessionsQueryParams` (search, kind, status, auth_mode, mcp_client_id, limit, offset). Array filters are CSV-joined to match the backend's `parseCommaSeparated` convention. Empty values are dropped so RTK Query's cache key doesn't fragment unnecessarily.
- Added a `total_count`-based pagination footer with Previous/Next buttons. The offset snaps back to the last valid page if a revoke removes the final row on the current page (same pattern used by the virtual keys page).
- Replaced the optimistic patch on `revokeMCPSession` with `invalidatesTags: ["MCPSessions"]`. The optimistic approach only worked with a singleton cache key; with per-filter cache entries, invalidating all keyed entries via a tag refetch is simpler and correct.
- Added an `icon` prop to `ComboboxSelectOption` and a `compactTrigger` prop to `ComboboxSelect`. `compactTrigger` renders "N selected" instead of a row of badges, preventing overflow in narrow filter-bar dropdowns.
- Added `MCPSessionsQueryParams` and pagination fields to `MCPSessionsListResponse` in the type definitions.
- Page size is set to 50 (larger than the governance default of 25) since session rows are denser than virtual key rows.

## Type of change

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Chore/CI

## Affected areas

- [ ] Core (Go)
- [ ] Transports (HTTP)
- [ ] Providers/Integrations
- [ ] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

1. Navigate to the MCP Sessions page.
2. Verify the filter bar appears above the table with a search input and Type, Status, and Identity dropdowns.
3. Enter a search term and confirm the table updates after ~300 ms with matching sessions.
4. Select one or more values in each dropdown and confirm the table filters accordingly.
5. Confirm filter state is reflected in the URL and survives a page refresh.
6. With more than 50 sessions, confirm the pagination footer shows the correct range and that Previous/Next navigate correctly.
7. Revoke a session on the last page (when it is the only row) and confirm the page snaps back to the previous page rather than showing an empty paginated view.
8. Confirm the "Clear filters" button appears only when a filter is active and resets all filters and offset.

```sh
cd ui
pnpm i || npm i
pnpm build || npm run build
```

## Screenshots/Recordings

_Add before/after screenshots of the MCP Sessions page showing the filter bar and pagination footer._

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

## Security considerations

Filter values are passed as query parameters to the existing authenticated `/api/mcp/sessions` endpoint. No new auth surface is introduced. Filter state stored in the URL does not include secrets.

## Checklist

- [ ] I read `docs/contributing/README.md` and followed the guidelines
- [ ] I added/updated tests where appropriate
- [ ] I updated documentation where needed
- [ ] I verified builds succeed (Go and UI)
- [ ] I verified the CI pipeline passes locally if applicable
occcat pushed a commit to occcat/bifrost that referenced this pull request Sep 2, 2026
## Summary

This PR releases **core v1.5.14**, **framework v1.3.14**, **transports v1.5.6**, and bumps all dependent plugins to their respective `.14` patch versions. It delivers a broad set of new capabilities across MCP authentication, key rotation, OTel metrics, Bedrock/Anthropic compatibility, and UI improvements, alongside a number of targeted bug fixes and refactors.

## Changes

- **Direct API Key Header** — Providers can now receive an API key passed directly via a request header (maximhq#3817)
- **MCP Per-User Auth** — Introduced `MCPCredentialStore` abstraction, per-user MCP credential reconciliation, and a new per-user header auth type with lazy-auth submission flow (maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** — Added configurable TLS (`insecureSkipVerify`, `caCertPem`) for HTTP/SSE MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** — Filter, search, and pagination on the MCP sessions list API and table, plus a `can_reauth` identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Key Rotation** — Keys now rotate on 401/402/403 responses; returns `502 upstream_credentials_exhausted` when all keys are permanently exhausted. Added `triggered_rotation` to `KeyAttemptRecord` and tightened `bifrost_key_rotation_events_total` semantics (maximhq#3430, maximhq#3491)
- **OTel Metrics** — Added OTel spec-compatible metrics (backward compatible) with provider cache and semantic cache attributes in metrics export (maximhq#3865, maximhq#3816)
- **Opus 4.8 Support** — System message handling and general compatibility for Opus 4.8 (maximhq#3868, maximhq#3878)
- **Dimension Rankings** — New `GetDimensionRankings` API and dashboard tabs for team, customer, BU, and user rankings (maximhq#3766)
- **Model Pricing Attributes** — `additional_attributes` field on model pricing rows with management API and UI editor (maximhq#3829)
- **Prompt Cache Retention** — Added prompt cache retention parameter on responses requests (maximhq#3810)
- **Tool Call Execution UI** — Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Sheet Navigation** — Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
- **Bedrock Tool Name Truncation** — Truncate Bedrock function/tool names to the provider length limit
- **Bedrock Guardrails** — Set guardrail config in Bedrock requests built from responses (maximhq#3862)
- **Anthropic Tool Use** — Default `tool_use` input to `{}` when arguments are absent (maximhq#3880)
- **Responses Streaming** — Fixed responses stream events (maximhq#3838)
- **Compat Flow** — Fixed missing parameter parsing on the compat flow (maximhq#3881)
- **Passthrough API Version** — Set a default API version in passthrough requests as a fallback (maximhq#3853)
- **Virtual Key Updates** — Avoid overriding optional fields during virtual key update (maximhq#3855)
- **User-Mode Flows** — Gate user-mode flows on caller `user_id`, skip temp token mint, and unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** — Handle partial tool call execution failures and return successful results (maximhq#3849)
- **URL Query Escaping** — Support escaped characters in URL query parameters (maximhq#3826)
- **MCP Auth Errors** — Inline banner and retry support for MCP auth-required errors (maximhq#3856)
- **Renamed Resolvers** — `staticHeadersResolver`/`serverOAuthResolver` renamed to `sharedHeadersResolver`/`sharedOAuthResolver` (maximhq#3840)
- **Starlark Nested Tool Calls** — Exposed `RunWithPluginPipeline` on `ClientManager` and routed Starlark nested tool calls through the canonical plugin gate (maximhq#3794)
- **Deferred-Fill OAuth Removed** — Removed deferred-fill user-mode OAuth flow support (maximhq#3839)
- **Go 1.26.3** — Upgraded toolchain to Go 1.26.3 (maximhq#3782)

## Type of change

- [x] Bug fix
- [x] Feature
- [x] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

```sh
# Core/Transports
go version  # should report go1.26.3
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build
```

- Validate MCP per-user auth by configuring a per-user header auth type and confirming credentials are stored and reconciled on virtual key and MCP client changes.
- Validate key rotation by triggering a 401/402/403 from an upstream provider and confirming rotation occurs; exhaust all keys and confirm a `502 upstream_credentials_exhausted` is returned.
- Validate OTel metrics output includes `provider_cache` and `semantic_cache` attributes.
- Validate Bedrock requests with tool names exceeding the provider limit are truncated correctly.
- Validate Opus 4.8 system message handling by sending a request with a system message to an Opus 4.8 endpoint.

## Breaking changes

- [x] Yes
- [ ] No

The deferred-fill user-mode OAuth flow has been removed (maximhq#3839). Any integrations relying on that flow must migrate to the new per-user credential store approach. The `staticHeadersResolver` and `serverOAuthResolver` identifiers have been renamed to `sharedHeadersResolver` and `sharedOAuthResolver` respectively (maximhq#3840); any direct references must be updated.

## Related issues

maximhq#3817, maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705, maximhq#3779, maximhq#3783, maximhq#3823, maximhq#3824, maximhq#3825, maximhq#3430, maximhq#3491, maximhq#3865, maximhq#3816, maximhq#3868, maximhq#3878, maximhq#3766, maximhq#3829, maximhq#3810, maximhq#3837, maximhq#3843, maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745, maximhq#3862, maximhq#3880, maximhq#3838, maximhq#3881, maximhq#3853, maximhq#3855, maximhq#3841, maximhq#3859, maximhq#3849, maximhq#3826, maximhq#3856, maximhq#3840, maximhq#3794, maximhq#3839, maximhq#3782, maximhq#3724, maximhq#3814, maximhq#3836, maximhq#3869, maximhq#3886

## Security considerations

- MCP per-user credentials are stored via the new `MCPCredentialStore` abstraction; ensure the backing store is appropriately access-controlled and that credential values are encrypted at rest.
- The direct API key header feature passes provider secrets via HTTP headers; ensure TLS is enforced on all ingress paths and that headers are not logged in plaintext.
- User-mode flows are now gated on `caller user_id` and temp token minting is skipped where appropriate, reducing the surface for privilege escalation.
- TLS configuration for MCP HTTP/SSE connections supports `insecureSkipVerify`; this should only be enabled in controlled environments.

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable
occcat pushed a commit to occcat/bifrost that referenced this pull request Sep 2, 2026
## ✨ Features

- **Direct API Key Header** - Pass a provider API key directly via
request header (maximhq#3817)
- **MCP Per-User Authentication** - New per-user header auth type with
credential storage
  and lazy-auth submission flow (maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** - Configurable TLS (insecureSkipVerify,
caCertPem) for HTTP/SSE
  MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** - Filter, search, and pagination on the
MCP sessions list API
  and table, plus a can_reauth identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Tool Call Execution UI** - Inline tool-call execution, stop
streaming, bulk
  execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Dimension Rankings Dashboard** - New dashboard tabs for team,
customer, BU, and user
  rankings, backed by a GetDimensionRankings API (maximhq#3766)
- **Model Pricing Attributes** - additional_attributes on model pricing
rows with management
  API and UI editor (maximhq#3829)
- **Prompt Cache Retention** - Prompt cache retention parameter on
responses requests
  (maximhq#3810)
- **Opus 4.8 Support** - System message handling and compatibility for
Opus 4.8 (maximhq#3878,
  maximhq#3868)
  - **Key Rotation** - Rotate keys on 401/402/403 and return 502
upstream_credentials_exhausted when all keys are permanently dead
(maximhq#3491)
- **OTel Metrics** - OTel spec compatible metrics plus provider and
semantic cache
  attributes in metrics export (maximhq#3865, maximhq#3816)
- **Sheet Navigation** - Prev/next keyboard navigation and URL state
across virtual key, MCP
  client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
  - **Go 1.26.3** - Upgraded toolchain to Go 1.26.3 (maximhq#3782)

  ## 🐞 Fixed

- **Bedrock Tool Names** - Truncate Bedrock function/tool names to the
provider length limit
- **Bedrock Guardrails** - Set guardrail config in Bedrock request built
from responses
  (maximhq#3862)
- **Anthropic Tool Use** - Default Anthropic tool_use input to {} when
arguments are absent
  (maximhq#3880)
  - **Responses Streaming** - Fixed responses stream events (maximhq#3838)
- **Compat Flow** - Fixed missing parameter parsing on the compat flow
(maximhq#3881)
- **Passthrough API Version** - Set a default API version in passthrough
requests as a
  fallback (maximhq#3853)
- **Virtual Key Updates** - Avoid overriding optional fields during
virtual key update
  (maximhq#3855)
- **User-Mode Flows** - Gate user-mode flows on caller user_id, skip
temp token mint, and
  unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** - Handle partial tool call execution failures
and return successful
  results (maximhq#3849)
- **URL Query Escaping** - Support escaped characters in URL query
parameters (maximhq#3826)
- **MCP Auth Errors** - Inline banner and retry support for MCP
auth-required errors (maximhq#3856)
- **JSON Editor Height** - Cap JSON editor max height at 400px in
message views (maximhq#3842)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants