LibreChat/packages/data-provider/src
Danny Avila 275af48592
🎯 fix: MCP Tool Misclassification from Action Delimiter Collision (#12512)
* fix: prevent MCP tools with `_action` in name from being misclassified as OpenAPI action tools

Add `isActionTool()` helper that checks for the `_action_` delimiter
while guarding against cross-delimiter collision with `_mcp_`. Replace
all `includes(actionDelimiter)` classification checks with the new
helper across backend and frontend.

* test: add coverage for MCP/action cross-delimiter collision

Verify that `isActionTool` correctly rejects MCP tool names containing
`_action` and that `loadAgentTools` does not filter them based on
`actionsEnabled`. Add ToolIcon and definitions test cases.

* fix: simplify isActionTool to handle all MCP name patterns

- Use `!toolName.includes('_mcp_')` instead of checking only after the
  first `_action_` occurrence, which missed MCP tools with `_action_` in
  the middle of their name (e.g. `get_action_data_mcp_myserver`).
- Reference `Constants.mcp_delimiter` value via a local const to avoid
  circular import from config.ts, with a comment explaining why.
- Remove dead `actionDelimiter` import from definitions.ts.
- Replace double-filter with single-pass partition in loadToolsForExecution.
- Add test for mid-name `_action_` collision case.

* fix: narrow MCP exclusion to delimiter position in isActionTool

Only reject when `_mcp_` appears after `_action_` (the MCP suffix
position). `_mcp_` before `_action_` is part of the operationId and
is valid — e.g. `sync_mcp_state_action_api---example---com` is a
legitimate action tool whose operationId happens to contain `_mcp_`.

* fix: document positional _mcp_ guard and known RFC-invalid domain limitation

Expand JSDoc on isActionTool to explain the action/MCP format
disambiguation and the theoretical false negative for non-RFC-compliant
domains containing `_mcp_`. Add test documenting this known edge case.
2026-04-01 22:36:21 -04:00
..
react-query 🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466) 2026-03-30 16:49:48 -04:00
types 🎯 fix: MCP Tool Misclassification from Action Delimiter Collision (#12512) 2026-04-01 22:36:21 -04:00
accessPermissions.ts 🛂 fix: Validate types Query Param in People Picker Access Middleware (#12276) 2026-03-17 02:46:11 -04:00
actions.ts 🛡️ fix: Implement TOCTOU-Safe SSRF Protection for Actions and MCP (#11722) 2026-02-11 22:09:58 -05:00
api-endpoints.ts 📁 refactor: Prompts UI (#11570) 2026-03-22 16:56:22 -04:00
artifacts.ts 🪟 fix: Windows Build (npm) (#3889) 2024-09-02 10:01:09 -04:00
azure.ts 🔃 refactor: Decouple Effects from AppService, move to data-schemas (#9974) 2025-10-05 06:37:57 -04:00
bedrock.ts 🧠 feat: Add reasoning_effort configuration for Bedrock models (#11991) 2026-02-28 15:02:09 -05:00
config.spec.ts 🛡️ refactor: Self-Healing Tenant Isolation Update Guard (#12506) 2026-04-01 19:07:52 -04:00
config.ts 🛡️ refactor: Self-Healing Tenant Isolation Update Guard (#12506) 2026-04-01 19:07:52 -04:00
createPayload.ts ⏸ refactor: Improve UX for Parallel Streams (Multi-Convo) (#11096) 2025-12-25 01:43:54 -05:00
data-service.ts 📁 refactor: Prompts UI (#11570) 2026-03-22 16:56:22 -04:00
feedback.ts 📈 feat: Chat rating for feedback (#5878) 2025-05-30 12:16:34 -04:00
file-config.spec.ts 📖 feat: Add Native ODT Document Parser Support (#12303) 2026-03-19 15:49:52 -04:00
file-config.ts 🧹 refactor: Tighten Config Schema Typing and Remove Deprecated Fields (#12452) 2026-03-29 01:10:57 -04:00
generate.ts 🪐 feat: Initial OpenAI Responses API Support (#8149) 2025-06-30 18:34:47 -04:00
headers-helpers.ts 🚪 fix: Complete OIDC RP-Initiated Logout With id_token_hint and Redirect Race Fix (#12024) 2026-03-02 21:34:13 -05:00
index.ts 🔒 fix: Request interceptor for Shared Link Page Scenarios (#12036) 2026-03-03 12:03:33 -05:00
keys.ts 🛸 feat: Remote Agent Access with External API Support (#11503) 2026-01-28 17:44:33 -05:00
mcp.ts 🧹 refactor: Tighten Config Schema Typing and Remove Deprecated Fields (#12452) 2026-03-29 01:10:57 -04:00
messages.ts 🐛 fix: String Interpolation in Messages Endpoint from #9155 (#9312) 2025-08-27 13:48:48 -04:00
models.ts 🧹 refactor: Tighten Config Schema Typing and Remove Deprecated Fields (#12452) 2026-03-29 01:10:57 -04:00
parameterSettings.ts 🎚️ feat: Add Thinking Level Parameter for Gemini 3+ Models (#11994) 2026-02-28 16:56:10 -05:00
parsers.ts 📅 refactor: Replace Numeric Weekday Index with Named Day in Date Template Variables (#12022) 2026-03-02 19:22:11 -05:00
permissions.ts 🚫 refactor: Remove Interface Config from Override Processing (#12473) 2026-03-31 11:07:31 -04:00
request.ts 🧭 fix: Subdirectory Deployment Auth Redirect Path Doubling (#12077) 2026-03-05 01:38:44 -05:00
roles.spec.ts 🎭 fix: Set Explicit Permission Defaults for USER Role in roleDefaults (#12308) 2026-03-19 14:52:06 -04:00
roles.ts 🎭 fix: Set Explicit Permission Defaults for USER Role in roleDefaults (#12308) 2026-03-19 14:52:06 -04:00
schemas.spec.ts 🤖 feat: Claude Opus 4.6 - 1M Context, Premium Pricing, Adaptive Thinking (#11670) 2026-02-06 18:35:36 -05:00
schemas.ts 🧹 refactor: Tighten Config Schema Typing and Remove Deprecated Fields (#12452) 2026-03-29 01:10:57 -04:00
types.ts 🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466) 2026-03-30 16:49:48 -04:00
utils.ts 🧯 fix: Prevent Env-Variable Exfil. via Placeholder Injection (#12260) 2026-03-16 08:48:24 -04:00