MCP Revamp by Prasanna721 · Pull Request #1120 · supermemoryai/supermemory

Prasanna721 · 2026-06-15T22:43:52Z

Relocates the revamped MCP (formerly "enterprise-mcp") into apps/mcp as the public MCP, renamed to SupermemoryMCP. The old apps/mcp is replaced; functionality is unchanged. Location, config, and naming change only.

Changes:

apps/mcp/src/**: the revamped MCP code (server + widget + tools). EnterpriseMCP to SupermemoryMCP, branding Enterprise MCP to Supermemory MCP (functionality identical; demo/mock text left as-is).
apps/mcp/package.json: worker supermemory-mcp; catalog: refs pinned to explicit versions (this repo has no catalog); portless dev:app.
apps/mcp/wrangler.jsonc: name supermemory-mcp, route mcp.supermemory.ai, DO SupermemoryMCP.

Verified locally: builds (vite widget bundle), boots, and OAuth discovery + the 401 handshake + the worker to api /v3/mcp/session-with-key path all work at the valid-audience host.

Deploy notes:

The DO class is SupermemoryMCP, the same as the existing supermemory-mcp worker's v1 migration, so the cutover is a no-op for the DO (no transition, no session reset).
Set a real AUTH_CACHE KV id (placeholder for now).
Coordinate with the OAuth provider migration (mono #1812) so existing OAuth clients reconnect once.

Draft until the cutover plan is finalized.

socket-security · 2026-06-15T22:44:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/@radix-ui/react-slot@1.3.3
npm/@radix-ui/react-popover@1.1.23
npm/@radix-ui/react-tooltip@1.2.16
npm/@modelcontextprotocol/client@2.0.0
npm/@types/react@19.2.17
npm/@supermemory/memory-graph@0.2.3
npm/@phosphor-icons/react@2.1.10
npm/@modelcontextprotocol/server@2.0.0
npm/tailwindcss@4.3.3
npm/react@19.2.8
npm/tailwind-merge@3.6.0
npm/zod@4.4.3
npm/@tailwindcss/vite@4.3.3
npm/react-dom@19.2.8
npm/@vitejs/plugin-react@4.7.0
npm/@modelcontextprotocol/sdk@1.25.2 ⏵ 1.30.0		⁺¹⁶
npm/@modelcontextprotocol/ext-apps@1.1.2 ⏵ 1.7.5	⁺⁷		⁺¹	⁺¹
npm/agents@0.3.10 ⏵ 0.20.1			⁺¹	⁺¹

View full report

cloudflare-workers-and-pages · 2026-06-15T22:44:58Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	`f6b1816`	Jul 30 2026, 09:52 PM

cloudflare-workers-and-pages · 2026-06-15T22:46:34Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	`f6b1816`	Commit Preview URL Branch Preview URL	Jul 30 2026, 09:53 PM

Replaces the old apps/mcp with the enterprise-mcp code (functionality unchanged). package.json: worker supermemory-mcp, catalog deps pinned to explicit versions, portless dev:app. wrangler: name supermemory-mcp, route mcp.supermemory.ai, DO EnterpriseMCP. Builds + boots + OAuth discovery/401/worker-to-api verified locally. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Functionality unchanged; just the name. The DO class is now SupermemoryMCP, which matches the existing supermemory-mcp worker's v1 migration -> the cutover is a no-op, no DO session reset. Demo/mock 'enterprise buyers' text left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Consumers think in "spaces", not "container tags". Renames the tool to listSpaces and updates its description + text output to say "spaces". Internal plumbing is unchanged: the client method listContainerTags() and the structuredContent.containerTags key (widget contract) keep their names.

Resolve MCP revamp conflicts by keeping the new server layout, deleting legacy root MCP files, and carrying forward API timeout handling into the new auth/client modules.

Make the widget fall back to dark tokens when the host does not provide an explicit theme, and expand workspace memory count labels from mem/mems to memory/memories. Co-authored-by: Ishaan Gupta <ishaankone@gmail.com>

claude · 2026-06-30T14:41:53Z

Claude finished @Prasanna721's task in 2m 48s —— View job

Code Review: MCP Revamp

Fetch PR diff and existing review comments
Analyze auth and security-critical code paths
Review tool implementations for bugs/edge cases
Check for breaking changes and data loss risks
Submit review summary

Result: No bugs, security issues, or logic errors found. The refactor introduces a clean architecture with proper auth (JWT+JWKS for OAuth, session introspection for API keys), RBAC enforcement on container tag access, and consistent error handling throughout.

Score: 9/10 — Ready to ship once the AUTH_CACHE KV namespace placeholder is replaced at deploy time.

Consolidate multi-line shadow values to single lines to match Biome formatting rules. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

claude

Code Review: MCP Revamp

Overview: Relocates the revamped MCP server into apps/mcp, replacing the old implementation with a new architecture featuring RBAC, auth caching, and a React-based widget UI.

Security & Auth Analysis

Auth Caching (auth/cache.ts): Properly implemented with:

SHA-256 hashing of tokens before storage (never stores raw tokens)
5-minute TTL matching Better Auth's session cache
Defensive validators that treat malformed cache entries as misses
Fail-open on KV errors (request still succeeds via upstream validation)

RBAC (auth/rbac.ts, auth/index.ts): Correctly implemented:

validateOAuthToken returns null on RBAC fetch failure (fail-closed) — this prevents silent privilege escalation if the RBAC endpoint is unreachable
buildRbacContext properly gates canRead/canWrite on accessType === "restricted"
All tools consistently check RBAC permissions before operations

Tool Permissions: Each tool properly validates access:

Write tools (add-memory, save-memory, upload-file-submit) check deps.rbac.canWrite(containerTag)
Read tools (search-memory, fetch-graph-data, memory-graph) check deps.rbac.canRead(containerTag)

Config Notes

The AUTH_CACHE KV namespace in wrangler.jsonc uses a placeholder ID (REPLACE_WITH_KV_NAMESPACE_ID). This is correctly documented in the PR description as a deploy-time task.

Code Quality

Clean separation between server, auth, tools, and widget
Shared types (shared/types.ts) provide a single source of truth for server↔widget contract
Error handling consistently uses deps.errorResult() pattern
PostHog analytics removed from this implementation (was in the old code)

Issues found: None — this looks good to ship.

Score: 9/10

Minor deduction for the placeholder KV ID that needs manual replacement before deploy, but this is properly documented.

linear-code · 2026-07-01T17:59:52Z

ENG-948

ENG-947

ENG-949

ishaanxgupta · 2026-07-02T11:50:57Z

Fix generic error for oversized MCP file uploads #1193 : 2 dependent PRs (#1194 , #1195 )
Fix nonexistent container tag handling in MCP tools #1192
Fix MCP widgets according to consumer app #1189
MCP Revamp #1120 👈 (View in Graphite)
register SpaceState durable object #1376
main

How to use the Graphite Merge Queue

Add the label Main to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

_{An organization admin has enabled the Graphite Merge Queue in this repository.} _{Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.}

This stack of pull requests is managed by Graphite. Learn more about stacking.

claude

Code Review: MCP Revamp

Overview: Relocates the revamped MCP server into apps/mcp, replacing the old implementation with a new architecture featuring RBAC, auth caching, and a React-based widget UI.

Security & Auth Analysis

Auth Caching (auth/cache.ts): Properly implemented:

SHA-256 hashing of tokens before storage (never stores raw tokens)
5-minute TTL matching Better Auth's session cache
Defensive validators that treat malformed cache entries as misses
Fail-open on KV errors (request still succeeds via upstream validation)

RBAC (auth/rbac.ts, auth/index.ts): Correctly implemented:

validateOAuthToken returns null on RBAC fetch failure (fail-closed) — prevents silent privilege escalation if the RBAC endpoint is unreachable
buildRbacContext properly gates canRead/canWrite on accessType === "restricted"
All tools consistently check RBAC permissions before operations

Tool Permissions: Each tool properly validates access:

Write tools (add-memory, save-memory, upload-file-submit) check deps.rbac.canWrite(containerTag)
Read tools (search-memory, fetch-graph-data, memory-graph) check deps.rbac.canRead(containerTag)

Config Notes

The AUTH_CACHE KV namespace in wrangler.jsonc uses a placeholder ID (REPLACE_WITH_KV_NAMESPACE_ID). This is correctly documented in the PR description as a deploy-time task.

Code Quality

Clean separation between server, auth, tools, and widget
Shared types (shared/types.ts) provide a single source of truth for server↔widget contract
Error handling consistently uses deps.errorResult() pattern
PostHog analytics removed from this implementation (was in the old code)

Issues found: None — this looks good to ship.

Score: 9/10

Minor deduction for the placeholder KV ID that needs manual replacement before deploy, but this is properly documented.

socket-security · 2026-07-30T03:56:57Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…nna721/review-mcp-revamp-stack

vorflux

Found several concrete regressions in the MCP cutover. The most urgent are the stale app-local pnpm lockfile (which blocks the Workers build), removal of authentication/header behaviors still emitted by the current web UI, and widget/graph correctness issues.

Review with Vorflux

Registers `SpaceState` before the stateless MCP starts routing requests through it. The class is intentionally unused here, so this changes no request behavior. Rollout: 1. Apply this exact commit once with `wrangler deploy`, not `wrangler versions upload`. 2. Rerun the Workers check and merge this parent PR. 3. Land #1120, which adds the active-space methods and request routing. Verified with the MCP widget build, isolated class typecheck, and Wrangler deploy/version dry runs.

Parent stack PR landed on main. Keep the revamp SpaceState implementation and server entrypoint; drop the pre-revamp apps/mcp/src/index.ts from trunk. Co-authored-by: Dhravya Shah <dhravya@supermemory.com>

Co-authored-by: Prasanna <106952318+Prasanna721@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: ved015 <vedant.04.mahajan@gmail.com> Co-authored-by: ved015 <ved015@users.noreply.github.com> Co-authored-by: Ishaan Gupta <ishaankone@gmail.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Prasanna721 changed the title ~~mcp: relocate enterprise-mcp as the public MCP revamp~~ MCP Revamp Jun 15, 2026

Prasanna721 force-pushed the Prasanna721/dalat-v1 branch from 888e7c7 to 06f62ec Compare June 19, 2026 16:55

Prasanna721 and others added 5 commits June 19, 2026 09:55

fix: format CSS file to pass Biome CI check

387606b

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

fix: format ternary expression to pass Biome CI check

e1289e5

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Prasanna721 force-pushed the Prasanna721/dalat-v1 branch from 06f62ec to f887bd6 Compare June 19, 2026 16:55

Prasanna721 and others added 4 commits June 19, 2026 13:02

fix mcp oauth resource metadata

db990e9

fix mcp root transport alias

113862f

Merge main into MCP revamp PR

d36aa64

Resolve MCP revamp conflicts by keeping the new server layout, deleting legacy root MCP files, and carrying forward API timeout handling into the new auth/client modules.

Fix MCP widget dark mode readability

99a8ada

Make the widget fall back to dark tokens when the host does not provide an explicit theme, and expand workspace memory count labels from mem/mems to memory/memories. Co-authored-by: Ishaan Gupta <ishaankone@gmail.com>

ved015 marked this pull request as ready for review June 30, 2026 14:41

graphite-app Bot requested a review from Dhravya June 30, 2026 14:41

graphite-app Bot assigned Prasanna721 Jun 30, 2026

Fix Biome CSS formatting in tokens.css

75b3aaa

Consolidate multi-line shadow values to single lines to match Biome formatting rules. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

claude Bot reviewed Jun 30, 2026

View reviewed changes

ishaanxgupta force-pushed the Prasanna721/dalat-v1 branch from 55fc0d5 to d36aa64 Compare July 2, 2026 11:50

ishaanxgupta mentioned this pull request Jul 2, 2026

Fix MCP widgets according to consumer app #1189

Merged

claude Bot reviewed Jul 2, 2026

View reviewed changes

This was referenced Jul 3, 2026

Fix nonexistent container tag handling in MCP tools #1192

Closed

Fix generic error for oversized MCP file uploads #1193

Closed

DONT merge #1194

Closed

ishaanxgupta mentioned this pull request Jul 3, 2026

fix(mcp): return graph view message from fetch-graph-data #1195

Closed

2 tasks

Prasanna721 added 4 commits July 29, 2026 12:46

polish mcp light mode

9523e56

migrate mcp app to stateless sdk v2

f85366c

split mcp documents and memories

0437c09

merge main into mcp revamp

36db68a

mintlify Bot deployed to staging - apps/docs July 30, 2026 03:56 View deployment

github-actions Bot and others added 6 commits July 30, 2026 03:57

fix: update bun.lock to resolve frozen lockfile CI failure

d744bdb

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

track stateless mcp tool usage

f155acc

Merge remote-tracking branch 'origin/Prasanna721/dalat-v1' into Prasa…

d6e34d2

…nna721/review-mcp-revamp-stack

use space across mcp surfaces

8a9fcd5

rename mcp internals to space

30e1242

exercise mcp document flows

6081c13

vorflux Bot reviewed Jul 30, 2026

View reviewed changes

Prasanna721 added 4 commits July 29, 2026 23:20

refresh mcp pnpm lockfile

4c2486f

fix mcp widget lifecycle and setup

14c4f10

fix local auth cookie detection

81fb87e

register space state durable object

f25e272

Prasanna721 mentioned this pull request Jul 30, 2026

register SpaceState durable object #1376

Merged

stack mcp revamp on space state migration

b561e18

Prasanna721 changed the base branch from main to graphite-base/1120 July 30, 2026 08:43

Prasanna721 changed the base branch from graphite-base/1120 to Prasanna721/mcp-space-state-migration July 30, 2026 08:43

Dhravya approved these changes Jul 30, 2026

View reviewed changes

graphite-app Bot changed the base branch from Prasanna721/mcp-space-state-migration to graphite-base/1120 July 30, 2026 21:28

Dhravya approved these changes Jul 30, 2026

View reviewed changes

restack on main after SpaceState DO merge (#1376)

f6b1816

Parent stack PR landed on main. Keep the revamp SpaceState implementation and server entrypoint; drop the pre-revamp apps/mcp/src/index.ts from trunk. Co-authored-by: Dhravya Shah <dhravya@supermemory.com>

cursor Bot force-pushed the graphite-base/1120 branch from f25e272 to 95a3460 Compare July 30, 2026 21:50

Dhravya merged commit 089cdc7 into graphite-base/1120 Jul 30, 2026
8 checks passed

claude Bot mentioned this pull request Jul 31, 2026

MCP Revamp (#1120) #1380

Merged

Uh oh!

Conversation

Prasanna721 commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

claude Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review: MCP Revamp

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Code Review: MCP Revamp

Security & Auth Analysis

Config Notes

Code Quality

Uh oh!

linear-code Bot commented Jul 1, 2026

Uh oh!

ishaanxgupta commented Jul 2, 2026 • edited by Prasanna721 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How to use the Graphite Merge Queue

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Code Review: MCP Revamp

Security & Auth Analysis

Config Notes

Code Quality

Uh oh!

socket-security Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vorflux Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Prasanna721 commented Jun 15, 2026 •

edited

Loading

socket-security Bot commented Jun 15, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

claude Bot commented Jun 30, 2026 •

edited

Loading

ishaanxgupta commented Jul 2, 2026 •

edited by Prasanna721

Loading

socket-security Bot commented Jul 30, 2026 •

edited

Loading