refactor: Use HTTP transport for MCP to properly pass authInfo

[sweetmantech]

Summary

• Replace InMemoryTransport with StreamableHTTPClientTransport for MCP tool calls
• Forward auth token from original request to MCP endpoint via Authorization header
• Ensures MCP tool handlers receive proper authInfo through the withMcpAuth middleware flow

Changes

• Added authToken to ChatRequestBody type
• Extract auth token from request headers in validateChatRequest
• Modified setupToolsForRequest to use HTTP transport to /api/mcp with Authorization header
• Updated tests to include authToken in request bodies

Test plan

• Verify MCP tools receive authInfo when called via /api/chat
• Test with both API key and JWT bearer token authentication
• Verify existing tool functionality is not broken

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
recoup-api	Ready	Preview	Jan 20, 2026 6:21pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[vercel]

Suggested change

	* - MCP server (via HTTP transport to /api/mcp for proper auth)
	* - MCP server (via HTTP transport to /mcp for proper auth)

Documentation comment references incorrect MCP endpoint path /api/mcp instead of /mcp

View Details

📝 Patch Details

diff --git a/lib/chat/setupToolsForRequest.ts b/lib/chat/setupToolsForRequest.ts
index 1574630..b15adde 100644
--- a/lib/chat/setupToolsForRequest.ts
+++ b/lib/chat/setupToolsForRequest.ts
@@ -7,7 +7,7 @@ import { getMcpTools } from "@/lib/mcp/getMcpTools";
 /**
  * Sets up and filters tools for a chat request.
  * Aggregates tools from:
- * - MCP server (via HTTP transport to /api/mcp for proper auth)
+ * - MCP server (via HTTP transport to /mcp for proper auth)
  * - Google Sheets (via Composio integration)
  *
  * @param body - The chat request body

Analysis

Bug Explanation:
The comment at line 10 of lib/chat/setupToolsForRequest.ts contains an inaccurate reference to the MCP endpoint. The comment states "via HTTP transport to /api/mcp for proper auth", but the actual endpoint is /mcp, not /api/mcp.

This was confirmed by examining:

1. The file structure shows app/mcp/route.ts (not app/api/mcp/route.ts), which in Next.js app router maps to the /mcp endpoint
2. The actual implementation in lib/mcp/getMcpTools.ts at line 14 constructs the URL as ${getBaseUrl()}/mcp, confirming the endpoint is /mcp

While this is a documentation comment and doesn't affect runtime behavior, it creates confusion for developers reading the code who might think the endpoint should be at /api/mcp.

Fix Applied:
Changed line 10 from:

- MCP server (via HTTP transport to /api/mcp for proper auth)

to:

- MCP server (via HTTP transport to /mcp for proper auth)

This ensures the comment accurately reflects the actual endpoint being used throughout the codebase.