fix(mcp): bound OAuth callback steps and log each phase to pinpoint hangs

[waleedlatif1]

Summary

• The MCP OAuth callback (e.g. Gauge) can hang indefinitely after burning state — no error, no timeout, no log. The request stalls between the burn and token persistence with zero observable I/O (no socket, no active DB query), so it was undiagnosable.
• Wrap each awaited callback step (loadPreregisteredClient, mcpAuthGuarded, clearVerifier, discoverServerTools) with a per-step timeout so a stalled op surfaces as a labeled error instead of hanging forever.
• Log start/done for every step, every guarded OAuth fetch phase (validate → request → read-body), and the token-exchange DB writes (saveTokens/saveClientInformation).
• The last start/…ing log without its matching done names the exact stall point on the next reproduction — so we can root-cause and fix properly.
• App-level only: no DB/PgBouncer config touched, purely additive logging + bounds. Zero blast radius.

Type of Change

• Bug fix (diagnostic instrumentation + hang bounding)

Testing

Type-checks and biome clean. Will be validated by reproducing the Gauge OAuth connect on staging and reading the new per-step logs.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 21, 2026 7:02pm

[cursor]

PR Summary

Medium Risk
Touches the OAuth callback and token persistence path; new timeouts could fail legitimately slow connects, but limits are generous and behavior otherwise unchanged aside from observability.

Overview
Adds per-step timeouts and start/done logging on the MCP OAuth callback route so indefinite hangs after state burn surface as labeled OauthCallbackStepTimeout errors instead of silent stalls. Steps wrapped include clearState, loadPreregisteredClient, mcpAuthGuarded (120s), clearVerifier, and post-auth discoverServerTools.

OAuth HTTP and persistence tracing: createSsrfGuardedMcpFetch now logs validate → request → body-read (or streaming) per host with timing; saveTokens and saveClientInformation log before/after DB writes. Together, the last log line without a matching completion pinpoints where a reproduction stuck.

Timed steps do not cancel in-flight work—the race only stops the HTTP handler from waiting forever.

^{Reviewed by Cursor Bugbot for commit 6aa4c9c. Configure here.}

[greptile-apps]

Greptile Summary

This PR bounds and instruments the MCP OAuth callback flow. The main changes are:

• Adds labeled timeouts around callback state, token exchange, cleanup, and tool discovery steps.
• Logs OAuth fetch phases and credential persistence progress.
• Replaces resolved IP logging with a boolean pinning indicator.

Confidence Score: 5/5

This looks safe to merge.

• The resolved endpoint IP was removed from the fetch logs.
• The callback bounds and logging do not change the successful OAuth flow.
• No blocking issue was found in the updated code.

Important Files Changed

Filename	Overview
apps/sim/app/api/mcp/oauth/callback/route.ts	Adds logged timeouts around each major OAuth callback step.
apps/sim/lib/mcp/oauth/storage.ts	Adds progress logs around client information and token persistence.
apps/sim/lib/mcp/pinned-fetch.ts	Adds guarded-fetch phase logs while omitting the resolved endpoint IP.

_{Reviews (2): Last reviewed commit: "fix(mcp): widen callback step bounds and..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6aa4c9c. Configure here.}