mirror of
https://github.com/supermemoryai/supermemory.git
synced 2026-08-23 15:33:52 +00:00
3487666481
<!-- VORFLUX_AGENT_PR_BODY_BEGIN -->
Adds the full 654-entry MCP directory without bundling records into client JavaScript, with explicit capability status and connector branding that degrades safely when no authoritative logo is available.
## Changes
- Lazy-load and validate the searchable, filterable, progressively rendered MCP catalog.
- Render same-origin proxied provider icons for 543 entries, with a reviewed domain allowlist and deterministic fallback marks for 111 unresolved or unbranded entries.
- Record OAuth discovery capability separately from end-to-end support; all directory setup actions remain suppressed until their authentication flow is verified.
- Add a reproducible OAuth metadata probe with HTTPS/private-network protections, stable URL keys, authorization-server scanning, and catalog fingerprint validation.
- Add Google Drive branding for the curated built-in connector.
## Testing
- **Passed:** Deterministic generation and catalog assertions.
```bash
PATH="$HOME/.bun/bin:$PATH" python3 apps/web/scripts/generate-mcp-directory.py --output
cmp apps/web/public/mcp-directory.json
```
Verified 654 entries, 254 DCR discoveries, 27 preregistered OAuth discoveries, 373 unclassified entries, and zero directory setup actions.
- **Passed:** Stale OAuth metadata fingerprint is rejected by the generator.
- **Passed:** Touched-file Biome checks and `git diff --check`.
- **Passed:** Icon proxy returned 200 for an allowlisted domain and 400 for an unknown valid-looking domain.
- **Passed:** Authenticated desktop/mobile browser inspection and conservative capability labels.
- **Passed:** Public preview returned HTTP 200 and rendered the real app. Authentication cookies do not transfer to the public hostname, so the public screenshot shows login.
- **Partial:** Repository-wide TypeScript checks remain blocked by unrelated existing errors outside the touched MCP files.
- **Partial:** 111 entries intentionally retain deterministic fallback marks; endpoint-derived domains may not always be the canonical brand logo.
- **Blocked:** Google rejected the local HTTP OAuth callback, so live Google Drive consent, callback, persistence, tool discovery, disconnect, and reconnect were not completed.
Public preview: https://ar8ruchhbi65.preview.us1.vorflux.com/configure/tools
---
**Attached Images**
*[288.csv]*
*[mcp-directory-final.json]*
<!-- VORFLUX_AGENT_PR_BODY_END -->
---
**Session Details**
- Session: [View Session](https://supermemory.us1.vorflux.com/agent-sessions/1cd0aab9-2a45-4818-aa13-f9bfe032ddba)
- Requested by: Dhravya Shah (dhravya@supermemory.com)
- Address comments on this PR. Add `(aside)` to your comment to have me ignore it.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Changes how users pick MCP URLs and auth (OAuth vs API key) before hitting existing connect endpoints; no new backend auth logic in this diff, but misconfiguration or trusting bad URLs remains a user-risk surface.
>
> **Overview**
> Adds a **browseable MCP directory** on the Company Brain connectors page: the catalog is **not bundled in JS**—it loads from static **`/mcp-directory.json`** only after the user opens the directory (with validation, caching, and abort handling).
>
> The new **`McpDirectoryBrowser`** supports search, category/availability filters, and progressive “show more” rendering. Supported remote entries route into the existing custom MCP flow via **Set up**, which pre-fills name/URL and opens the connector dialog with context-specific copy.
>
> The custom connector dialog now uses an explicit **OAuth vs API key** toggle; API key fields only appear for API-key mode, and directory-backed connections get **stable slugs** (`-dir-` suffix) so names display cleanly on connected cards. **Middleware** excludes `mcp-directory.json` from the auth matcher so the asset can be fetched publicly.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
|
||
|---|---|---|
| .. | ||
| add-document | ||
| brain-home | ||
| chat | ||
| directory | ||
| document-cards | ||
| document-modal | ||
| integrations | ||
| mcp-modal | ||
| memory-graph | ||
| nova | ||
| onboarding | ||
| onboarding-brain | ||
| settings | ||
| text-editor | ||
| add-space-modal.tsx | ||
| animated-gradient-background.tsx | ||
| app-experience.tsx | ||
| bottom-nav.tsx | ||
| brain-connector-icons.tsx | ||
| brain-trial-pill.tsx | ||
| company-brain-header.tsx | ||
| company-brain-promo.tsx | ||
| configure-view.tsx | ||
| connect-ai-modal.tsx | ||
| dashboard-view.tsx | ||
| digests-view.tsx | ||
| document-icon.tsx | ||
| documents-command-palette.tsx | ||
| edit-space-modal.tsx | ||
| ensure-workspace.tsx | ||
| error-boundary.tsx | ||
| feedback-modal.tsx | ||
| fullscreen-note-modal.tsx | ||
| granola-connect-modal.tsx | ||
| graph-layout-view.tsx | ||
| header.tsx | ||
| highlights-card.tsx | ||
| initial-header.tsx | ||
| integration-icons.tsx | ||
| integrations-view.tsx | ||
| login-tools-panel.tsx | ||
| memories-grid.tsx | ||
| orbit-memory.tsx | ||
| org-plan-badge.tsx | ||
| pwa-install-prompt.tsx | ||
| query-client.tsx | ||
| quick-note-card.tsx | ||
| remove-connection-dialog.tsx | ||
| review-memories-card.tsx | ||
| review-memories-modal.tsx | ||
| select-spaces-modal.tsx | ||
| share-modal.tsx | ||
| slack-connect-card.tsx | ||
| space-folder-icon.tsx | ||
| space-glyph.tsx | ||
| space-profile-modal.tsx | ||
| space-profile-panel.tsx | ||
| space-selector.tsx | ||
| spinner.tsx | ||
| superloader.tsx | ||
| timeline-view.tsx | ||
| trial-setup-banner.tsx | ||
| user-profile-menu.tsx | ||
| utils.ts | ||
