* fix: MCP server configuration validation and schema
- Added tests to reject URLs containing environment variable references for SSE, streamable-http, and websocket types in the MCP routes.
- Introduced a new schema in the data provider to ensure user input URLs do not resolve environment variables, enhancing security against potential leaks.
- Updated existing MCP server user input schema to utilize the new validation logic, ensuring consistent handling of user-supplied URLs across the application.
* fix: MCP URL validation to reject env variable references
- Updated tests to ensure that URLs for SSE, streamable-http, and websocket types containing environment variable patterns are rejected, improving security against potential leaks.
- Refactored the MCP server user input schema to enforce stricter validation rules, preventing the resolution of environment variables in user-supplied URLs.
- Introduced new test cases for various URL types to validate the rejection logic, ensuring consistent handling across the application.
* test: Enhance MCPServerUserInputSchema tests for environment variable handling
- Introduced new test cases to validate the prevention of environment variable exfiltration through user input URLs in the MCPServerUserInputSchema.
- Updated existing tests to confirm that URLs containing environment variable patterns are correctly resolved or rejected, improving security against potential leaks.
- Refactored test structure to better organize environment variable handling scenarios, ensuring comprehensive coverage of edge cases.
* 🔧 refactor: move `processMCPEnv` from `librechat-data-provider` and move to `@librechat/api`
* 🔧 refactor: Update resolveHeaders import paths
* 🔧 refactor: Enhance resolveHeaders to support user and custom variables
- Updated resolveHeaders function to accept user and custom user variables for placeholder replacement.
- Modified header resolution in multiple client and controller files to utilize the enhanced resolveHeaders functionality.
- Added comprehensive tests for resolveHeaders to ensure correct processing of user and custom variables.
* 🔧 fix: Update user ID placeholder processing in env.ts
* 🔧 fix: Remove arguments passing this.user rather than req.user
- Updated multiple client and controller files to call resolveHeaders without the user parameter
* 🔧 refactor: Enhance processUserPlaceholders to be more readable / less nested
* 🔧 refactor: Update processUserPlaceholders to pass all tests in mpc.spec.ts and env.spec.ts
* chore: remove legacy ChatGPTClient
* chore: remove LLM initialization code
* chore: initial deprecation removal of `gptPlugins`
* chore: remove cohere-ai dependency from package.json and package-lock.json
* chore: update brace-expansion to version 2.0.2 and add license information
* chore: remove PluginsClient test file
* chore: remove legacy
* ci: remove deprecated sendMessage/getCompletion/chatCompletion tests
---------
Co-authored-by: Dustin Healy <54083382+dustinhealy@users.noreply.github.com>
* 🗝️ feat: Per-User Credentials for MCP Servers
chore: add aider to gitignore
feat: fill custom variables to MCP server
feat: replace placeholders with custom user MCP variables
feat: handle MCP install/uninstall (uses pluginauths)
feat: add MCP custom variables dialog to MCPSelect
feat: add MCP custom variables dialog to the side panel
feat: do not require to fill MCP credentials for in tools dialog
feat: add translations keys (en+cs) for custom MCP variables
fix: handle LIBRECHAT_USER_ID correctly during MCP var replacement
style: remove unused MCP translation keys
style: fix eslint for MCP custom vars
chore: move aider gitignore to AI section
* feat: Add Plugin Authentication Methods to data-schemas
* refactor: Replace PluginAuth model methods with new utility functions for improved code organization and maintainability
* refactor: Move IPluginAuth interface to types directory for better organization and update pluginAuth schema to use the new import
* refactor: Remove unused getUsersPluginsAuthValuesMap function and streamline PluginService.js; add new getPluginAuthMap function for improved plugin authentication handling
* chore: fix typing for optional tools property with GenericTool[] type
* chore: update librechat-data-provider version to 0.7.88
* refactor: optimize getUserMCPAuthMap function by reducing variable usage and improving server key collection logic
* refactor: streamline MCP tool creation by removing customUserVars parameter and enhancing user-specific authentication handling to avoid closure encapsulation
* refactor: extract processSingleValue function to streamline MCP environment variable processing and enhance readability
* refactor: enhance MCP tool processing logic by simplifying conditions and improving authentication handling for custom user variables
* ci: fix action tests
* chore: fix imports, remove comments
* chore: remove non-english translations
* fix: remove newline at end of translation.json file
---------
Co-authored-by: Aleš Kůtek <kutekales@gmail.com>
* chore: linting in mcp.spec.ts
* chore: linting in mcp.ts
* feat(mcp): support dynamic user field placeholders in MCP environment variables
- Added user object handling in MCP options, allowing for dynamic user field processing in environment variables, headers, and URLs.
- Updated `processMCPEnv` to utilize user fields for more flexible configurations.
* chore: update backend review workflow to include unit tests for @librechat/data-schemas
* Fix: Prevent side effects in `processMCPEnv` by deep cloning MCPOptions
The `processMCPEnv` function was modifying the original `MCPOptions` object, leading to unintended side effects where `LIBRECHAT_USER_ID` could be incorrectly shared across different users. This commit addresses this issue by performing a deep clone of the `MCPOptions` object before processing, ensuring that modifications are isolated and do not affect other users.
* ci: Add tests for processMCPEnv to ensure deep cloning, user ID isolation and environment variable processing
---------
Co-authored-by: Alex C <viennadd@users.noreply.github.com>
* refactor: use new image output format for agents using DALL-E tools
* refactor: Enhance image fetching with proxy support and adjust logging placement in DALL-E 3 integration
* refactor: Enhance StableDiffusionAPI to support agent-specific return values and display message for generated images
* refactor: Add unit test execution for librechat-mcp in backend review workflow
* refactor: Update environment variable extraction logic, export from serpate module to avoid circular refs, and remove deprecated tests
* refactor: Add unit tests for environment variable extraction and enhance StdioOptionsSchema to process env variables
