feat: add virtual_key_id and user_id multi-select filters to MCP sessions

[Pratham-Mishra04]

Summary

Adds virtual_key_id and user_id as multi-select filter facets on the MCP Sessions list, allowing operators to narrow sessions down to specific virtual keys or users. The Users filter is enterprise-only (renders nothing in OSS builds where no user directory is available).

Changes

• Added VirtualKeyIDs and UserIDs fields to MCPSessionsFilterParams in the configstore, with corresponding WHERE ... IN ? clauses applied in applyMCPSessionFilters.
• Exposed virtual_key_id and user_id as query parameters in the HTTP handler (parseMCPSessionsListQuery).
• Extended MCPSessionsQueryParams (TypeScript types), buildMCPSessionsListParams (API layer), and the MCP Sessions page URL state to carry and serialize the new filter values.
• Added VirtualKeyFilterSection to the filter sidebar: a lazy-loaded, searchable checkbox list backed by the existing useGetVirtualKeysQuery hook, fetching one page at a time to handle large VK counts.
• Added UsersFilterSection to the filter sidebar: mirrors VirtualKeyFilterSection but uses a registry-injected search hook (getUserSearchQuery) so OSS builds render nothing while enterprise builds plug in their user directory.
• Registered registerUserSearchQuery / getUserSearchQuery in ui/lib/registries/userPicker.tsx alongside the existing single-select picker registry, following the same load-once contract.
• Added sidebar visibility logic: when the auth_mode facet is pinned to a single mode, the irrelevant picker (VK for user-mode, user for vk-mode, both for session-mode) is hidden and its stale selection is cleared automatically.
• Removed an unnecessary wrapping <div className="rounded-md border p-4"> around the headers FormField in mcpClientSheet.tsx, and corrected indentation throughout that file.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Open the MCP Sessions page.
2. Expand the filter sidebar. Confirm Virtual Key and Users sections appear (Users only in enterprise builds).
3. Select one or more virtual keys — confirm the session list narrows to rows with matching virtual_key_id.
4. Select one or more users (enterprise) — confirm the session list narrows to rows with matching user_id.
5. Pin the Auth Mode filter to "User" — confirm the Virtual Key section disappears and any prior VK selection is cleared. Pin to "VK" — confirm the Users section disappears.
6. Confirm URL state reflects virtual_key_id and user_id arrays and survives a page reload.

go test ./framework/configstore/...
go test ./transports/bifrost-http/...

cd ui
pnpm i
pnpm build

Breaking changes

• Yes
• No

Related issues

Security considerations

virtual_key_id and user_id filter values are passed as parameterized IN ? clauses via GORM — no raw string interpolation. The Users filter section is gated behind an enterprise-only registry hook, so no user directory data is exposed in OSS builds.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Pratham-Mishra04]

• docs: add token_exchange auth type, per-client TLS/sync/timeout fields, tool list persistence, and reconnect per-call clarifications to MCP docs and OpenAPI spec #5977
• docs: rename MCP states to healthy/unstable, add degraded and needs_session_stickiness, and expand 409/OAuth flow descriptions #5976
• docs: add connections page with full state table, connection-mode matrix, and per-auth-type lifecycle; rename connected→healthy, disconnected→unstable #5975
• docs: add needs_session_stickiness field, session stickiness behavior, and per-call vs sticky connection docs #5974
• fix: gate verify-headers replay guard on pre-request pending_verification state, project needs_reauth over unstable, and block premature shared-OAuth completion #5973
• fix: defer SetClientTools until after DB persistence to prevent runtime/DB state drift #5972
• feat: add tools-change callback funnel with content-hash gating and targeted DB persist for all MCP discovery paths #5971
• fix: enable per-call tool discovery for shared oauth/headers/none MCP clients and rename UpdateClientConnection to UpdateClientCredentials #5970
• feat: add virtual key and user identity filters to OAuth2 grants sidebar #5969
• feat: add virtual_key_id and user_id multi-select filters to MCP sessions #5921 👈 (View in Graphite)
• feat: add MCP state-change callback and degraded cluster-aggregate state with per-instance drill-down #5920
• feat: add compare-and-swap guard on refresh_token to RefreshOauthTokenFieldsIfActive #5919
• feat: add MCP server filter to MCP sessions sidebar #5918
• feat: replace OAuth grants filter bar with collapsible sidebar #5917
• feat: replace MCP sessions inline filter bar with collapsible sidebar #5916
• feat: add needs_session_stickiness to MCP HTTP clients for per-call vs persistent connection control #5915
• refactor: replace ClientHealthMonitor+ClientToolSyncer with unified ClientConnectionChecker and rename states connected→healthy, disconnected→unstable #5914
• refactor: extract shared SectionHeader, replace accordions with bordered sections in MCP client form #5913
• refactor: extract TLS, OAuth, and token exchange fields into shared components and reorganize MCP client sheet into tabs #5912
• feat: add tiered retry configs for MCP connect, per-call connect, and tool-call paths #5911
• refactor: replace OAuth2 token-expired text matching with errors.Is and preserve last-known tool map on disconnect #5910
• feat: add -jwt flag for JWT bearer auth to mcp-test-client #5909
• refactor: extract shared MCP authorizer dialog chrome into authorizerUi.tsx #5908
• feat: add shouldRun guard to skills orphan cleanup worker for multi-instance deployments #5813
• feat: add SetShouldRefreshGate to gate OAuth token sweep ticks #5812
• feat: add stack-absorb Claude skill for manual Graphite stack change distribution #5786 : 1 other dependent PR (#5787 )
• docs+feat: expand MCP connection states into reference table and add tooltip to State column header #5785
• feat: add token-exchange demo MCP server for testing against real identity providers #5730
• docs: add token exchange (on-behalf-of) MCP auth documentation #5729
• docs: document make-before-break reconnection and shared-client retry behavior #5728
• feat: make-before-break reconnect for HTTP/SSE MCP clients with generation-guarded stale write protection #5727
• feat: retry shared-connection MCP auth failures after bounded reconnect wait with concurrent dedup #5726
• feat: add ui for token_exchange (On-Behalf-Of) auth type MCP clients #5725
• feat: add token_exchange MCP auth type with delegated identity-provider token exchange #5724
• docs: add needs_reauth state, reauthorize endpoint, per-client tool sync/timeout, allowed_extra_headers, and OAuth config rotation to MCP OpenAPI spec #5723
• docs: add OAuth reauthorization, admin discovery credentials, auth failure recovery, and credential rotation docs #5722
• docs: add env./vault. reference support for OAuth client_id/client_secret and update OpenAPI EnvVar schema #4860
• docs: add pending_verification state and initiate-verification / verify-headers MCP client endpoints to OpenAPI spec #4858
• docs: add config.json bootstrap support for auth-aware MCP clients (oauth, per_user_oauth, per_user_headers) #3876
• feat: use *SecretVar for OAuth2Config credentials to preserve env./vault. #4859
• feat: add LRU credential cache to MCP headers provider with scoped eviction #5721
• feat: add in-memory LRU cache for per-user MCP OAuth access tokens with targeted eviction #5720
• feat: add generation-guarded LRU cache with single-flight fills and secondary index #5719
• feat: add per-user OAuth/headers admin discovery credential repair flow with registry needs_reauth projection #5718
• feat: retain admin bootstrap credential for periodic per-user MCP tool discovery refresh #5717
• feat: add MCPAuthModeAdmin + reauthorize endpoint for shared OAuth MCP clients #5716
• feat: replace OAuth config pin-and-warn with in-place rotation and needs_reauth cascade #5715
• feat: add needs_reauth state and replace per-user connection badge with sessions link #5714
• feat: add auth-failure retry with forced credential refresh for MCP tool calls #5713
• feat: add NeedsReauth MCP connection state for dead OAuth2 credentials #5712
• refactor: make GetExpiringOauthTokens auth modes caller-configurable via AuthModes field #5711
• refactor: unify shared and per-user OAuth refresh under a single RefreshAccessToken(tokenID) path, dropping oauth_configs.token_id FK shortcut #5710
• refactor: migrate OAuth flow state/PKCE fields from oauth_configs to new mcp_oauth_flows table #5709
• refactor: merge oauth_tokens/oauth_user_tokens into unified mcp_oauth_tokens table #5708
• feat: add per_user_headers bootstrap verification flow via submitHandler abstraction #3875
• feat: add verify-headers endpoint and pending_verification state for per-user-headers MCP clients #3874
• fix: extend pending_verification bootstrap path to cover per_user_oauth clients #3873
• feat: add OAuth authorization flow for config.json-bootstrapped pending_verification MCP clients #3872
• feat: add pending_verification state and initiate-verification endpoint for config.json shared-OAuth MCP clients #3871
• docs: document flow mode access rules, temp token toggle, and per-server tool manager overrides #3870 : 1 other dependent PR (#3882 )
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added MCP session filters for virtual key IDs and user IDs.
  • Added searchable, paginated selection lists for virtual keys and users.
  • Filter selections are reflected in the URL and session results, with active-filter counts and reset support.
  • Filters automatically adjust when the selected identity mode changes.

• Style

  • Simplified and reformatted MCP client connection settings for a cleaner presentation.

Walkthrough

The PR adds virtual key and user ID filters across MCP session contracts, queries, HTTP parsing, API requests, URL state, and filter controls. It also adds optional user search registration and reformats MCP client form markup.

Changes

MCP session identity filters

Layer / File(s)	Summary
Filter contracts and query handling framework/configstore/store.go, framework/configstore/rdb.go, transports/bifrost-http/handlers/mcpsessions.go, ui/lib/types/mcpSessions.ts, ui/lib/store/apis/mcpSessionsApi.ts	MCP session filters accept virtual key IDs and user IDs. The API and HTTP handler encode and parse comma-separated values. The RDB query applies exact-match predicates.
Filter sidebar and URL state ui/app/workspace/mcp-sessions/...	The session page persists the filters in URL state and API requests. The sidebar adds searchable checkbox sections, identity-mode visibility, pagination, reset handling, and active-filter counts.
Optional enterprise user search ui/lib/registries/userPicker.tsx	The registry defines user search result contracts and optional hook registration and retrieval functions.

MCP client form markup cleanup

Layer / File(s)	Summary
MCP client form markup and formatting ui/app/workspace/mcp-registry/views/mcpClientSheet.tsx	Form expressions and parsing blocks are reformatted. The outer headers wrapper is removed while editable headers and validation remain in place.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPSessionsFilterSidebar
  participant MCPSessionsPage
  participant mcpSessionsApi
  participant MCPHTTPHandler
  participant ConfigstoreRDB
  MCPSessionsFilterSidebar->>MCPSessionsPage: update virtual key and user selections
  MCPSessionsPage->>mcpSessionsApi: request sessions with selected filters
  mcpSessionsApi->>MCPHTTPHandler: send comma-separated query parameters
  MCPHTTPHandler->>ConfigstoreRDB: apply VirtualKeyIDs and UserIDs
  ConfigstoreRDB-->>MCPSessionsPage: return filtered MCP sessions

Loading

Possibly related PRs

• maximhq/bifrost#5916: Extends the MCP sessions filter state and sidebar used by this change.
• maximhq/bifrost#5918: Modifies shared MCP session filter state, URL synchronization, active counts, and reset behavior.
• maximhq/bifrost#5913: Modifies overlapping formatting and layout in mcpClientSheet.tsx.

Suggested reviewers: akshaydeo, danpiths, impoiler

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main feature: multi-select virtual key and user filters for MCP sessions.
Description check	✅ Passed	The description covers the purpose, changes, affected areas, testing steps, breaking changes, and security considerations; optional sections remain empty.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 08-06-feat_add_virtual_key_and_users_filters_to_mcp_auth_sessions_sidebar

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/app/workspace/mcp-sessions/views/mcpSessionsFilterSidebar.tsx`:
- Around line 483-506: Pass the Virtual Key query error state from
useGetVirtualKeysQuery into SearchableCheckboxList at
ui/app/workspace/mcp-sessions/views/mcpSessionsFilterSidebar.tsx:483-506 and
render the list’s distinct error state. Do the same for the Users query at
ui/app/workspace/mcp-sessions/views/mcpSessionsFilterSidebar.tsx:530-555. Extend
UserSearchQueryResult in ui/lib/registries/userPicker.tsx:56-65 with the
error-state field so registered and fallback user-search hooks share the same
contract.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 860433e8-5173-451f-b78c-696da5559fea

📥 Commits

Reviewing files that changed from the base of the PR and between 569aa6e and a2fd13b.

📒 Files selected for processing (9)

• framework/configstore/rdb.go
• framework/configstore/store.go
• transports/bifrost-http/handlers/mcpsessions.go
• ui/app/workspace/mcp-registry/views/mcpClientSheet.tsx
• ui/app/workspace/mcp-sessions/page.tsx
• ui/app/workspace/mcp-sessions/views/mcpSessionsFilterSidebar.tsx
• ui/lib/registries/userPicker.tsx
• ui/lib/store/apis/mcpSessionsApi.ts
• ui/lib/types/mcpSessions.ts

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[Pratham-Mishra04]

Merge activity

• Aug 8, 10:33 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Aug 8, 11:31 AM UTC: Graphite rebased this pull request as part of a merge.
• Aug 8, 11:32 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.