feat: add MCP auth required error handling with inline banner and retry support

[impoiler]

Summary

When a tool call fails because an MCP server requires OAuth authentication, the error was previously swallowed and shown only as a generic toast. This PR surfaces MCP authentication errors directly in the tool call UI, allowing users to authenticate and retry without losing context.

Changes

• Introduced a MCPAuthRequiredError class in executor.ts that captures the auth kind (oauth or headers), the MCP client name, and the authorization URL parsed from the extra_fields.mcp_auth_required field in the error response.
• Updated executeToolCall to detect and throw MCPAuthRequiredError when the API response indicates authentication is required.
• Updated the prompt context's tool call handler to re-throw MCPAuthRequiredError instead of catching it as a generic error toast.
• Added authErrors state to ToolCallMessageView to track per-tool-call authentication errors.
• Rendered an inline amber banner within the tool call card when an auth error is present, showing the MCP client name, a prompt to authenticate, an "Authenticate" button that opens the authorization URL in a new tab, and a "Retry" button to re-execute the tool call after authenticating.
• Hid the normal action bar when an auth error is active to avoid conflicting UI states.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Configure a prompt with an MCP tool that requires OAuth authentication.
2. Execute the tool call without being authenticated.
3. Verify that an inline amber banner appears on the tool call card with the MCP client name and an "Authenticate" button.
4. Click "Authenticate" and confirm it opens the authorization URL in a new tab.
5. After authenticating, click "Retry" and confirm the tool call executes successfully.

cd ui
pnpm i || npm i
pnpm build || npm run build

Screenshots/Recordings

Before

After

Breaking changes

• Yes
• No

Related issues

Security considerations

The authorization URL is opened via window.open(..., "_blank"), which is consistent with standard OAuth redirect flows. No tokens or credentials are stored in component state; only the error metadata (client name and URL) is retained until the error is cleared on retry.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

Summary by CodeRabbit

• New Features

  • Tool calls now show inline "authentication required" banners with optional authorize links and a Retry button.
  • Users can follow authorize URLs and retry individual tool executions.
  • Improved execution flow: bulk execution clears prior auth states before running.

• Bug Fixes

  • Per-tool action controls are suppressed while a tool awaits authentication to prevent conflicting actions.
  • Authentication failures are surfaced distinctly instead of a generic error.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds MCP authentication error handling end-to-end: a new MCPAuthRequiredError, executor detection and throw, context rethrow to surface the error, and per-tool UI banners with authorize links and retry behavior.

Changes

MCP Authentication Error Handling

Layer / File(s)	Summary
Error class definition and detection ui/components/prompts/utils/executor.ts	MCPAuthRequiredError carries auth context (kind, mcpClientName, authorizeUrl). executeToolCall parses non-OK JSON responses for extra_fields.mcp_auth_required and throws MCPAuthRequiredError, mapping authorize/submit URL fields.
Error propagation through context ui/components/prompts/context.tsx	handleExecuteToolCall imports MCPAuthRequiredError and rethrows it when encountered, bypassing the generic "Failed to execute tool" toast so the UI can handle auth-required errors.
UI component auth error tracking and display ui/components/prompts/components/messagesView/toolCallView.tsx	Adds authErrors state keyed by toolCallId. Single- and multi-mode handlers capture and store MCPAuthRequiredError. Bulk execution clears stored auth errors. handleRetry removes an auth error and retries the specific tool call. Per-tool cards render an auth-required banner with optional authorize link and a Retry button and hide normal action controls while in the auth-error state.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested reviewers

• akshaydeo
• danpiths

Poem

🐰 A rabbit sniffed the auth request light,

Tools paused and banners showed their plight,
We store the error, show the way,
Click Retry and let the tasks play,
Hops of code make everything right.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main feature: adding MCP auth error handling with an inline banner and retry capability, which is the primary focus of the changeset.
Description check	✅ Passed	The description comprehensively covers all required template sections: summary, changes, type of change, affected areas, testing instructions, screenshots, breaking changes, and security considerations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-28-feat_inplace_auth_popup_for_mcp_tool_calls

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[impoiler]

• fix: correct step numbering, clarify role mapping rules, and fix Okta/Entra doc copy errors #3860
• feat: add MCP auth required error handling with inline banner and retry support #3856 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 4/5

The core single-tool auth-error flow works correctly; the Execute All path is broken for auth errors and could leave users with no feedback or a degraded experience.

The new auth-error handling works well for the primary single-tool execution path, but the Execute All code path in context.tsx does not propagate MCPAuthRequiredError back to the component: a single-tool Execute All produces an unhandled rejection with no visible feedback, and the multi-tool branch converts the error to a generic toast string, discarding the authorize URL and preventing the inline banner from ever appearing.

ui/components/prompts/context.tsx — the handleExecuteAllToolCalls function needs to surface MCPAuthRequiredError instances per-tool rather than flatten them.

Important Files Changed

Filename	Overview
ui/components/prompts/utils/executor.ts	Introduces MCPAuthRequiredError class and throws it when the API returns mcp_auth_required; JSON parse error handling is preserved correctly.
ui/components/prompts/context.tsx	Re-throws MCPAuthRequiredError from handleExecuteToolCall (single-call path), but handleExecuteAllToolCalls swallows auth errors in the multi-tool branch and causes an unhandled rejection in the single-tool branch.
ui/components/prompts/components/messagesView/toolCallView.tsx	Adds authErrors state and inline amber banner with Authenticate/Retry buttons; handleExecuteSingle and handleExecuteOne correctly capture MCPAuthRequiredError, but handleExecuteAll has no catch for it.

Comments Outside Diff (1)

1. ui/components/prompts/context.tsx, line 718-727 (link)

   Auth error swallowed / unhandled in Execute All path

   When the Execute All button triggers handleExecuteAllToolCalls, two failure modes arise for MCPAuthRequiredError:

   1. Single-tool branch (line 718–720): handleExecuteToolCall re-throws MCPAuthRequiredError, but handleExecuteAll in toolCallView.tsx has only a finally block — no catch for MCPAuthRequiredError — so the error becomes an unhandled promise rejection. The user sees nothing: no banner, no toast.
   2. Multi-tool branch (line 723–746): Promise.allSettled catches the rejection, getErrorMessage(r.reason) converts it to a plain string, and a generic toast fires. The auth metadata (client name, authorize URL) is discarded, so the inline banner and Retry button are never shown for the affected tool call.

   In both cases the user loses the auth-error UX introduced by this PR whenever they use Execute All. The handleExecuteAll function in toolCallView.tsx would need its own MCPAuthRequiredError catch (to call setAuthErrors) and the multi-tool path in context would need to surface per-tool MCPAuthRequiredError instances rather than flattening them into strings.

_{Reviews (2): Last reviewed commit: "feat: inplace auth popup for mcp tool ca..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/components/prompts/components/messagesView/toolCallView.tsx`:
- Around line 466-485: Add stable data-testid attributes to the new interactive
buttons so E2E tests can target them: add a data-testid to the Authenticate
button (the Button that opens authErrors[tc.id].authorizeUrl) and to the Retry
button (the Button that calls handleRetry(tc) and uses RefreshCw), using clear,
unique values that include the tool call id (e.g.,
data-testid={`auth-btn-${tc.id}`} and data-testid={`retry-btn-${tc.id}`}).
- Line 469: The onClick handler opening external auth uses
window.open(authErrors[tc.id].authorizeUrl, "_blank") which is vulnerable to
tabnabbing and lacks test hooks; update the onClick in toolCallView.tsx to
validate/parse the authorize URL with the URL constructor inside a try/catch and
bail if invalid, then open it with window.open(parsedUrl.toString(), "_blank",
"noopener,noreferrer") (or render a safe <a> with target="_blank" rel="noopener
noreferrer") to mitigate opener risks, and add stable data-testid attributes
(e.g., data-testid={`authenticate-${tc.id}`} and data-testid={`retry-${tc.id}`})
to the inline “Authenticate” and “Retry” buttons so E2E tests can select them
reliably.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7418c358-fa50-497a-aaed-7cee58a40a4c

📥 Commits

Reviewing files that changed from the base of the PR and between 777c8ae and 8f9b29f.

📒 Files selected for processing (3)

• ui/components/prompts/components/messagesView/toolCallView.tsx
• ui/components/prompts/context.tsx
• ui/components/prompts/utils/executor.ts

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

ui/components/prompts/components/messagesView/toolCallView.tsx (1)

177-181: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Batch execution currently drops per-tool auth-required state.

setAuthErrors({}) clears existing auth banners, but this flow never repopulates authErrors for auth failures returned from onExecuteAllToolCalls, so users lose inline Authenticate/Retry for failed tools after Execute all. Please return structured failures (including MCPAuthRequiredError per toolCallId) from the batch path and map them into authErrors.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/components/prompts/components/messagesView/toolCallView.tsx` around lines
177 - 181, The batch Execute All flow currently wipes auth banners with
setAuthErrors({}) and never repopulates them; change the flow around
setAuthErrors / onExecuteAllToolCalls so that onExecuteAllToolCalls returns
structured per-tool failures (including MCPAuthRequiredError keyed by
toolCallId) and map those failures into authErrors after the call instead of
clearing blindly—specifically, keep setIsExecutingAll(true), call const
partialResults = await onExecuteAllToolCalls(latestCalls), then build a
newAuthErrors object by iterating partialResults for each toolCallId that failed
with MCPAuthRequiredError (or other auth failures) and call
setAuthErrors(newAuthErrors) (merging with existing authErrors if needed) so
each failed tool re-displays its Authenticate/Retry inline.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@ui/components/prompts/components/messagesView/toolCallView.tsx`:
- Around line 177-181: The batch Execute All flow currently wipes auth banners
with setAuthErrors({}) and never repopulates them; change the flow around
setAuthErrors / onExecuteAllToolCalls so that onExecuteAllToolCalls returns
structured per-tool failures (including MCPAuthRequiredError keyed by
toolCallId) and map those failures into authErrors after the call instead of
clearing blindly—specifically, keep setIsExecutingAll(true), call const
partialResults = await onExecuteAllToolCalls(latestCalls), then build a
newAuthErrors object by iterating partialResults for each toolCallId that failed
with MCPAuthRequiredError (or other auth failures) and call
setAuthErrors(newAuthErrors) (merging with existing authErrors if needed) so
each failed tool re-displays its Authenticate/Retry inline.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d3295aad-e272-457f-a14c-e086baa3c159

📥 Commits

Reviewing files that changed from the base of the PR and between 8f9b29f and c1d74b2.

📒 Files selected for processing (3)

• ui/components/prompts/components/messagesView/toolCallView.tsx
• ui/components/prompts/context.tsx
• ui/components/prompts/utils/executor.ts

[akshaydeo]

Merge activity

• May 28, 5:10 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 28, 5:10 PM UTC: @akshaydeo merged this pull request with Graphite.