Description
The COMPOSIO_MANAGE_CONNECTIONS MCP tool only advertised three input fields — toolkits, reinitiate_all, and session_id — so MCP clients had no way to specify which auth config to use when initiating a link. Toolkits that lack a Composio-managed default (e.g. Spotify) hit the failure path in getOrCreateRelevantAuthConfig and returned:
Composio does not manage auth for toolkit spotify and no auth config without required fields is available. Please create an auth config manually or specify one in auth_config_override.
The error message already pointed at auth_config_override, but the parameter was never exposed at the MCP layer, so the strict-mode MCP client stripped it before it reached Apollo.
This PR adds auth_config_override: Record<toolkit_slug, auth_config_id> (e.g. {"spotify": "ac_abc123"}) as an optional top-level parameter to both the single-account and multi-account variants of the tool. It threads the override end-to-end:
ToolRouterManageConnectionsRequestSchema + ManageConnectionsRequestSchema (Zod) — new optional auth_config_override field, validated as Record<string, string>.request_schema.properties in both getManageConnectionsDefinition() and getMultiAccountDefinition() — exposes the field to MCP clients with a description that calls out the Spotify use case.ManageConnectionsAction.execute() — reads request.auth_config_override, stores it on ActionContext, and forwards it through createConnectionLink() to createLinkForToolRouterSession().createLinkForToolRouterSession() — accepts the new authConfigOverride param and merges it over session.config.authConfigs before handing the combined map to getOrCreateRelevantAuthConfig(). Per-call override wins over the session-level map, matching the existing priority semantics (override → tool-router-marked config → auto-create).
The deeper validation (auth config must exist in the project, must not be deleted/disabled, must match the toolkit slug) is already implemented in getOrCreateRelevantAuthConfig and now applies to MCP callers for free.
How did I test this PR
- Scoped unit tests —
vitest run src/lib/composio_actions/actions/toolRouter/__tests__/manageConnections.unit.test.ts → 35 passed (added 2 new tests: one for single-account, one for multi-account, both assert createLinkForToolRouterSession receives authConfigOverride as expected).
- Legacy tests —
vitest run src/lib/composio_actions/actions/manageConnections.test.ts → 16 passed (no regressions on the non-tool-router path).
- Apollo typecheck —
pnpm check-types → clean.
- Lint —
pnpm lint on changed files → no new findings (one pre-existing unrelated warning at schemas.ts:1187).
- Apollo health —
curl http://localhost:9900/api/healthz → {"status":"ok"} (Zod schema accepts the new field without breaking validation of existing requests).
End-to-end Spotify connect against a live session was not exercised because it requires a project that has a real manually-created Spotify auth config + a session created for it — outside the scope of a sandbox smoke test. The override validation path (InvalidAuthConfigOverrideForLink) is already covered by link_edge_cases.test.ts for the session-level auth_config_override; my request-level field flows into the exact same validator.
Triggered by: uday@composio.dev | Source: slack
Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-6cd8fff2b8da
@zen-agent
