MCP Revamp by Prasanna721 · Pull Request #1120 · supermemoryai/supermemory

Prasanna721 · 2026-06-15T22:43:52Z

Relocates the revamped MCP (formerly "enterprise-mcp") into apps/mcp as the public MCP, renamed to SupermemoryMCP. The old apps/mcp is replaced; functionality is unchanged. Location, config, and naming change only.

Changes:

apps/mcp/src/**: the revamped MCP code (server + widget + tools). EnterpriseMCP to SupermemoryMCP, branding Enterprise MCP to Supermemory MCP (functionality identical; demo/mock text left as-is).
apps/mcp/package.json: worker supermemory-mcp; catalog: refs pinned to explicit versions (this repo has no catalog); portless dev:app.
apps/mcp/wrangler.jsonc: name supermemory-mcp, route mcp.supermemory.ai, DO SupermemoryMCP.

Verified locally: builds (vite widget bundle), boots, and OAuth discovery + the 401 handshake + the worker to api /v3/mcp/session-with-key path all work at the valid-audience host.

Deploy notes:

The DO class is SupermemoryMCP, the same as the existing supermemory-mcp worker's v1 migration, so the cutover is a no-op for the DO (no transition, no session reset).
Set a real AUTH_CACHE KV id (placeholder for now).
Coordinate with the OAuth provider migration (mono #1812) so existing OAuth clients reconnect once.

Draft until the cutover plan is finalized.

socket-security · 2026-06-15T22:44:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@radix-ui/react-slot@1.3.0
	npm/@radix-ui/react-popover@1.1.17
	npm/@radix-ui/react-tooltip@1.2.10
	npm/@types/react@19.2.17
	npm/@supermemory/memory-graph@0.2.3
	npm/@phosphor-icons/react@2.1.10
	npm/tailwindcss@4.3.2
	npm/tailwind-merge@3.6.0
	npm/@tailwindcss/vite@4.3.2
	npm/react-dom@19.2.7
	npm/@vitejs/plugin-react@4.7.0

View full report

cloudflare-workers-and-pages · 2026-06-15T22:44:58Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	supermemory-mcp	`75b3aaa`	Jun 30 2026, 02:44 PM

cloudflare-workers-and-pages · 2026-06-15T22:46:34Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	`75b3aaa`	Commit Preview URL Branch Preview URL	Jun 30 2026, 02:45 PM

Replaces the old apps/mcp with the enterprise-mcp code (functionality unchanged). package.json: worker supermemory-mcp, catalog deps pinned to explicit versions, portless dev:app. wrangler: name supermemory-mcp, route mcp.supermemory.ai, DO EnterpriseMCP. Builds + boots + OAuth discovery/401/worker-to-api verified locally. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Functionality unchanged; just the name. The DO class is now SupermemoryMCP, which matches the existing supermemory-mcp worker's v1 migration -> the cutover is a no-op, no DO session reset. Demo/mock 'enterprise buyers' text left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Consumers think in "spaces", not "container tags". Renames the tool to listSpaces and updates its description + text output to say "spaces". Internal plumbing is unchanged: the client method listContainerTags() and the structuredContent.containerTags key (widget contract) keep their names.

Resolve MCP revamp conflicts by keeping the new server layout, deleting legacy root MCP files, and carrying forward API timeout handling into the new auth/client modules.

Make the widget fall back to dark tokens when the host does not provide an explicit theme, and expand workspace memory count labels from mem/mems to memory/memories. Co-authored-by: Ishaan Gupta <ishaankone@gmail.com>

claude · 2026-06-30T14:41:53Z

Claude finished @ved015's task in 2m 54s —— View job

PR Review: MCP Revamp

Fetch PR diff and analyze changes
Check for existing review comments (none found)
Review code for bugs, security issues, and logic errors
Submit review with findings

Summary

Reviewed 87 changed files (~5100 additions, ~3000 deletions). This PR relocates the revamped MCP server with new architecture featuring RBAC, auth caching, and a React widget UI.

Key findings:

✅ Auth caching properly hashes tokens with SHA-256 before storage
✅ RBAC implemented with fail-closed behavior (returns null on RBAC fetch failure)
✅ All tools consistently check read/write permissions before operations
✅ Clean separation between server, auth, tools, and widget layers
⚠️ AUTH_CACHE KV namespace uses placeholder ID (documented in PR description)

Score: 9/10 — No bugs or security issues found. Ready to ship once deploy notes are addressed.

Consolidate multi-line shadow values to single lines to match Biome formatting rules. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

claude

Code Review: MCP Revamp

Overview: Relocates the revamped MCP server into apps/mcp, replacing the old implementation with a new architecture featuring RBAC, auth caching, and a React-based widget UI.

Security & Auth Analysis

Auth Caching (auth/cache.ts): Properly implemented with:

SHA-256 hashing of tokens before storage (never stores raw tokens)
5-minute TTL matching Better Auth's session cache
Defensive validators that treat malformed cache entries as misses
Fail-open on KV errors (request still succeeds via upstream validation)

RBAC (auth/rbac.ts, auth/index.ts): Correctly implemented:

validateOAuthToken returns null on RBAC fetch failure (fail-closed) — this prevents silent privilege escalation if the RBAC endpoint is unreachable
buildRbacContext properly gates canRead/canWrite on accessType === "restricted"
All tools consistently check RBAC permissions before operations

Tool Permissions: Each tool properly validates access:

Write tools (add-memory, save-memory, upload-file-submit) check deps.rbac.canWrite(containerTag)
Read tools (search-memory, fetch-graph-data, memory-graph) check deps.rbac.canRead(containerTag)

Config Notes

The AUTH_CACHE KV namespace in wrangler.jsonc uses a placeholder ID (REPLACE_WITH_KV_NAMESPACE_ID). This is correctly documented in the PR description as a deploy-time task.

Code Quality

Clean separation between server, auth, tools, and widget
Shared types (shared/types.ts) provide a single source of truth for server↔widget contract
Error handling consistently uses deps.errorResult() pattern
PostHog analytics removed from this implementation (was in the old code)

Issues found: None — this looks good to ship.

Score: 9/10

Minor deduction for the placeholder KV ID that needs manual replacement before deploy, but this is properly documented.

Prasanna721 changed the title ~~mcp: relocate enterprise-mcp as the public MCP revamp~~ MCP Revamp Jun 15, 2026

Prasanna721 force-pushed the Prasanna721/dalat-v1 branch from 888e7c7 to 06f62ec Compare June 19, 2026 16:55

Prasanna721 and others added 5 commits June 19, 2026 09:55

fix: format CSS file to pass Biome CI check

387606b

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

fix: format ternary expression to pass Biome CI check

e1289e5

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Prasanna721 force-pushed the Prasanna721/dalat-v1 branch from 06f62ec to f887bd6 Compare June 19, 2026 16:55

Prasanna721 and others added 4 commits June 19, 2026 13:02

fix mcp oauth resource metadata

db990e9

fix mcp root transport alias

113862f

Merge main into MCP revamp PR

d36aa64

Resolve MCP revamp conflicts by keeping the new server layout, deleting legacy root MCP files, and carrying forward API timeout handling into the new auth/client modules.

Fix MCP widget dark mode readability

99a8ada

Make the widget fall back to dark tokens when the host does not provide an explicit theme, and expand workspace memory count labels from mem/mems to memory/memories. Co-authored-by: Ishaan Gupta <ishaankone@gmail.com>

ved015 marked this pull request as ready for review June 30, 2026 14:41

graphite-app Bot requested a review from Dhravya June 30, 2026 14:41

graphite-app Bot assigned Prasanna721 Jun 30, 2026

Fix Biome CSS formatting in tokens.css

75b3aaa

Consolidate multi-line shadow values to single lines to match Biome formatting rules. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

claude Bot reviewed Jun 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

MCP Revamp#1120

MCP Revamp#1120
Prasanna721 wants to merge 10 commits into
mainfrom
Prasanna721/dalat-v1

Prasanna721 commented Jun 15, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Prasanna721 commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

claude Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: MCP Revamp

Summary

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Code Review: MCP Revamp

Security & Auth Analysis

Config Notes

Code Quality

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Prasanna721 commented Jun 15, 2026 •

edited

Loading

socket-security Bot commented Jun 15, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 15, 2026 •

edited

Loading

claude Bot commented Jun 30, 2026 •

edited

Loading