Files
supabase/apps/studio/evals/preflight.ts
Pedro Rodrigues c4c213ce3d feat(studio): switch dashboard assistant to remote MCP server (#47479)
## I have read the
[CONTRIBUTING.md](<https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md>)
file.

YES

## What kind of change does this PR introduce?

Feature / refactor.

## What is the current behavior?

The dashboard assistant runs `@supabase/mcp-server-supabase` in-process
over an in-memory transport (`lib/ai/supabase-mcp.ts`).

## What is the new behavior?

The assistant connects to the **remote MCP server** over HTTP
(`@ai-sdk/mcp`), forwarding the dashboard session token as a bearer. URL
comes from `NEXT_PUBLIC_MCP_URL` with a local-dev fallback;
platform-only, and Nimbus works via the same env var.

* **Tool model unchanged:** UI-controlled `execute_sql` (with
`needsApproval`) and `deploy_edge_function` still come from Studio; the
allowlist (`TOOL_CATEGORY_MAP`) remains the gate keeping the remote's
write tools away from the assistant (`read_only` is defense-in-depth).
* **Attribution:** sends `x-source-name: supabase-studio` (+
`x-source-version`) → logged as `source_name`/`client_name`.
* **Connection lifecycle:** the HTTP client is closed via the request's
`AbortSignal` (tools execute later during streaming); `signal` is
required on `getTools`/`getMcpTools`.
* **Resilience:** a remote-MCP failure degrades to the remaining tools
instead of failing the assistant.
* **Drift protection:** relied-upon tools are typed against `keyof
typeof supabaseMcpToolSchemas`, so a package bump that renames/removes
one fails `pnpm typecheck`; a runtime check also warns if the deployed
server returns fewer tools.
* Adds unit tests for the above.

## Additional context

* Verified end-to-end against a local remote MCP server with a dashboard
token: `initialize` 200, tools listed, a tool executed, client closed
cleanly.
* The remote MCP (mgmt-api) already accepts dashboard session tokens
(GoTrue-JWT auth path) — no backend change needed. `NEXT_PUBLIC_MCP_URL`
must point at each env's `/mcp`.
* `@supabase/mcp-server-supabase` is kept — still used by the
self-hosted `/api/mcp` routes.

Closes
[AI-137](https://linear.app/supabase/issue/AI-137/switch-dashboard-assistant-to-remote-mcp)

## Rollout

* **Rollout:** merges with `USE_REMOTE_MCP` off (in-process); flip it to
`true` per environment (staging → prod → Nimbus) once each one's
prerequisites land.
* **Rollback:** unset `USE_REMOTE_MCP` and redeploy to fall back to the
in-process client — no revert needed.

## Summary by CodeRabbit

* **Bug Fixes**
* Improved AI request handling so tool loading and generation clean up
properly when a request is cancelled or the browser connection closes.
* Added safer fallback behavior when remote tool loading fails, so AI
features can continue with available tools instead of stopping entirely.
* Updated remote tool access to use the current project reference and
preserve the correct access headers.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* AI tools now connect more reliably to remote services and stop cleanly
when requests end or are canceled.
* Tool loading is more resilient, continuing with available tools if
remote access is unavailable.

* **Bug Fixes**
* Improved cleanup to prevent lingering connections during SQL
generation and policy workflows.
  * Added safer handling for remote tool changes and invalid responses.

* **Tests**
* Expanded automated coverage for remote tool setup, cancellation, and
fallback behavior.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-07 19:38:21 +01:00

50 lines
1.8 KiB
TypeScript

/**
* Eval preflight — MCP connectivity check.
*
* The assistant eval harness (`getMockTools`) mocks every tool except
* `search_docs`, which it sources from a real MCP server. If that connection is
* broken (endpoint down, bad/expired token, contract drift, missing package),
* evals fail deep inside a Braintrust run with an opaque per-case error.
*
* This preflight exercises the exact same path and fails fast with an
* actionable message, so a broken MCP connection is caught up front when the
* eval job runs (e.g. on push). Keep it in lockstep with how `getMockTools`
* obtains `search_docs` — if that switches to the remote client (see AI-897),
* switch this too.
*/
import { createInProcessSupabaseMCPClient } from '@/lib/ai/supabase-mcp'
async function runPreflight() {
let client: Awaited<ReturnType<typeof createInProcessSupabaseMCPClient>> | undefined
try {
client = await createInProcessSupabaseMCPClient({
accessToken: 'mock-access-token',
projectRef: 'mock-project-ref',
})
const tools = await client.tools()
if (!tools || !('search_docs' in tools)) {
throw new Error(
'Connected to the MCP server but `search_docs` was not returned. ' +
'The tool contract may have drifted, or the server is misconfigured.'
)
}
console.log('✅ Eval MCP preflight OK — connected and `search_docs` is available.')
} finally {
await client?.close().catch(() => {})
}
}
runPreflight().catch((error) => {
console.error(
'❌ Eval MCP preflight failed — the eval harness cannot reach the MCP server, ' +
'so evals would fail. Check NEXT_PUBLIC_MCP_URL, the access token, and the ' +
'@supabase/mcp-server-supabase dependency.'
)
console.error(error instanceof Error ? error.message : error)
process.exit(1)
})