Conversation
Activation reads the OAuth client id to tell an external MCP client from a first-party caller, and self-hosted mints no client id — there is no OAuth flow. SAM reaches the tools in-process rather than over this transport, so every request arriving here is external by construction. Without a stand-in, neither activation signal can ever fire on a self-hosted instance: firstMcpAuthorizedAt is written only by the hosted authorize flow, and firstMcpToolCallAt is gated on that client id. So "Connect your AI agent" stays outstanding on the dashboard forever, no matter how many tool calls succeed. Found self-hosting: organization_activation_state was still empty after dozens of tool calls from two different agents. With this, the first call writes the row and the step completes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On a self-hosted instance, the dashboard's "Connect your AI agent" step can never complete — no matter how many tool calls succeed.
Why
getStepStatusmarks themcpstep done when either activation signal is set (dashboardSteps.ts). Neither can fire when self-hosting:firstMcpAuthorizedAtis written only fromoauth-provider.ts, in the hosted authorize flow.local_noauthandcloudflare_accesshave no OAuth flow at all.firstMcpToolCallAtis written only whenauth.clientIdis truthy (instrumentation.ts).handleSelfHostedOpenSeoMcpRequestnever sets one — self-hosted mints no client id.So the interface asks the operator to do something they have already done, and the only way out is dismissing the card.
The change
The client-id gate exists to separate an external MCP client from a first-party caller. SAM reaches the tools in-process rather than over this transport, so every request arriving at the self-hosted handler is external by construction — a stand-in id is accurate, and the existing gate then works unmodified.
Verified on a self-hosted instance
Before, after dozens of tool calls from two different agents:
After, on the first call:
first_mcp_authorized_atstays null, which is correct — that signal belongs to the hosted OAuth path.The transport test already pinned the exact props object, so the invariant is recorded there rather than in a new test.