feat: embedded MCP server with user-scoped token authentication (#15383)

.github/workflows/ad-hoc-docker-image.yml

@@ -48,8 +48,15 @@ jobs:
     with:
       branch: ${{ inputs.branch }}
 
+  mcp-build:
+    name: mcp-build
+    uses: ./.github/workflows/mcp-build.yml
+    secrets: inherit
+    with:
+      branch: ${{ inputs.branch }}
+
   package:
-    needs: [server-build, client-build, rts-build]
+    needs: [server-build, client-build, rts-build, mcp-build]
     runs-on: ubuntu-latest
     # Set permissions since we're using OIDC token authentication between Depot and GitHub
     permissions:
@@ -94,6 +101,18 @@ jobs:
           echo "Cleaning up the tar files"
           rm app/client/packages/rts/dist/rts-dist.tar
 
+      - name: Download the MCP build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: mcp-dist
+          path: app/client/packages/mcp/dist
+
+      - name: Untar the MCP folder
+        run: |
+          tar -xvf app/client/packages/mcp/dist/mcp-dist.tar -C app/client/packages/mcp/
+          echo "Cleaning up the MCP tar files"
+          rm app/client/packages/mcp/dist/mcp-dist.tar
+
       - name: Generate info.json
         id: info_json
         run: |

.github/workflows/build-client-server-count.yml

@@ -147,8 +147,17 @@ jobs:
     with:
       pr: ${{fromJson(needs.file-check.outputs.pr)}}
 
+  mcp-build:
+    name: mcp-build
+    needs: [file-check]
+    if: success() && needs.file-check.outputs.runId == 0
+    uses: ./.github/workflows/mcp-build.yml
+    secrets: inherit
+    with:
+      pr: ${{fromJson(needs.file-check.outputs.pr)}}
+
   build-docker-image:
-    needs: [file-check, client-build, server-build, rts-build]
+    needs: [file-check, client-build, server-build, rts-build, mcp-build]
     # Only run if the build step is successful
     if: success() && needs.file-check.outputs.runId == '0'
     name: build-docker-image

.github/workflows/build-client-server.yml

@@ -115,8 +115,17 @@ jobs:
     with:
       pr: ${{fromJson(needs.file-check.outputs.pr)}}
 
+  mcp-build:
+    name: mcp-build
+    needs: [file-check]
+    if: success() && needs.file-check.outputs.runId == '0'
+    uses: ./.github/workflows/mcp-build.yml
+    secrets: inherit
+    with:
+      pr: ${{fromJson(needs.file-check.outputs.pr)}}
+
   build-docker-image:
-    needs: [file-check, client-build, server-build, rts-build]
+    needs: [file-check, client-build, server-build, rts-build, mcp-build]
     # Only run if the build step is successful
     if: success() && needs.file-check.outputs.runId == '0'
     name: build-docker-image

.github/workflows/build-docker-image.yml

@@ -80,6 +80,19 @@ jobs:
           echo "Cleaning up the tar files"
           rm app/client/packages/rts/dist/rts-dist.tar
 
+      - name: Download the MCP build artifact
+        if: steps.run_result.outputs.run_result != 'success'
+        uses: actions/download-artifact@v4
+        with:
+          name: mcp-dist
+          path: app/client/packages/mcp/dist
+
+      - name: Un-tar the MCP folder
+        run: |
+          tar -xvf app/client/packages/mcp/dist/mcp-dist.tar -C app/client/packages/mcp/
+          echo "Cleaning up the MCP tar files"
+          rm app/client/packages/mcp/dist/mcp-dist.tar
+
       - name: Generate info.json
         id: info_json
         run: |

.github/workflows/docs/test-build-docker-image.md

@@ -32,9 +32,13 @@ The `client-build` job builds the client-side codebase. It uses the configuratio
 
 The `rts-build` job builds the "rts" (real-time suggestions) package of the client-side codebase. It uses the configuration defined in `.github/workflows/rts-build.yml` and inherits secrets from the repository.
 
+### `mcp-build`
+
+This job builds and tests the MCP service, then supplies its bundled artifact to the Docker-image jobs.
+
 ### `build-docker-image`
 
-This job, named `build-docker-image`, creates and pushes the Docker image for the application. It is dependent on the success of the `client-build`, `server-build`, and `rts-build` jobs. The Docker image is built with two platforms: `linux/arm64` and `linux/amd64`.
+This job, named `build-docker-image`, creates and pushes the Docker image for the application. It is dependent on the success of the `client-build`, `server-build`, `rts-build`, and `mcp-build` jobs. The Docker image is built with two platforms: `linux/arm64` and `linux/amd64`.
 
 ### `ci-test`
 

.github/workflows/github-release.yml

@@ -202,8 +202,16 @@ jobs:
           path: app/client/packages/rts/rts-dist.tar
           overwrite: true
 
+  mcp-build:
+    needs:
+      - prelude
+    uses: ./.github/workflows/mcp-build.yml
+    secrets: inherit
+    with:
+      branch: ${{ github.ref }}
+
   package:
-    needs: [prelude, client-build, server-build, rts-build]
+    needs: [prelude, client-build, server-build, rts-build, mcp-build]
 
     runs-on: ubuntu-latest
     permissions:
@@ -248,6 +256,18 @@ jobs:
           echo "Cleaning up the tar files"
           rm app/client/packages/rts/dist/rts-dist.tar
 
+      - name: Download the MCP build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: mcp-dist
+          path: app/client/packages/mcp/dist
+
+      - name: Untar the MCP folder
+        run: |
+          tar -xvf app/client/packages/mcp/dist/mcp-dist.tar -C app/client/packages/mcp/
+          echo "Cleaning up the MCP tar files"
+          rm app/client/packages/mcp/dist/mcp-dist.tar
+
       - name: Generate info.json
         id: info_json
         run: |

.github/workflows/mcp-build.yml

@@ -0,0 +1,142 @@
+name: Build MCP Workflow
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      pr:
+        description: "PR number when building a pull-request merge commit"
+        required: false
+        type: number
+      skip-tests:
+        description: "Skip unit tests for image-only builds"
+        required: false
+        type: string
+        default: "false"
+      branch:
+        description: "Branch to build when pr is 0"
+        required: false
+        type: string
+
+  pull_request:
+    branches: [release, master]
+    paths:
+      - "app/client/packages/mcp/**"
+
+defaults:
+  run:
+    working-directory: app/client/packages/mcp
+    shell: bash
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository ||
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'repository_dispatch' ||
+      github.event_name == 'schedule' ||
+      github.event_name == 'release'
+    # Mongo + Redis back the governance store's distributed-lock / confirmation-atomicity safety net. Without these
+    # service containers store.integration.test.ts stays describe.skip and that safety net never runs in CI.
+    services:
+      mongodb:
+        image: mongo:6.0
+        ports:
+          - 27017:27017
+        options: >-
+          --health-cmd "mongosh --quiet --eval 'db.runCommand({ ping: 1 }).ok'"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - name: Checkout the merged pull-request commit
+        if: inputs.pr != 0
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+          persist-credentials: false
+          ref: refs/pull/${{ inputs.pr }}/merge
+
+      - name: Checkout the specified branch
+        if: inputs.pr == 0 && inputs.branch != ''
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+          persist-credentials: false
+          ref: ${{ inputs.branch }}
+
+      - name: Checkout the head commit
+        if: inputs.pr == 0 && inputs.branch == ''
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+          persist-credentials: false
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: app/client/package.json
+
+      # actions/setup-node@v4 does not restore Yarn 3 caches from a subdirectory.
+      - name: Restore Yarn cache
+        uses: actions/cache@v4
+        with:
+          path: app/client/.yarn/cache
+          key: v1-yarn3-${{ hashFiles('app/client/yarn.lock') }}
+          restore-keys: |
+            v1-yarn3-
+
+      - name: Install dependencies
+        run: |
+          corepack enable
+          yarn install --immutable
+
+      - name: Check types
+        run: yarn check-types
+
+      - name: Lint
+        run: yarn lint
+
+      - name: Check formatting
+        run: yarn prettier
+
+      - name: Run unit tests
+        if: inputs.skip-tests != 'true'
+        run: yarn test:unit
+
+      # Runs ONLY the governance integration suite against the mongo+redis service containers (kept separate so the
+      # unit run above stays fast). With these env vars set, store.integration.test.ts's describe.skip flips to
+      # describe and the Redis-lock / confirmation-atomicity assertions actually execute.
+      - name: Run governance integration tests
+        if: inputs.skip-tests != 'true'
+        env:
+          APPSMITH_MONGODB_URI: mongodb://127.0.0.1:27017
+          APPSMITH_REDIS_URL: redis://127.0.0.1:6379
+          # Forces the anti-silent-no-op guard: if the mongo/redis wiring ever drifts, the step FAILS instead of the
+          # suite reverting to describe.skip and exiting 0 green.
+          MCP_REQUIRE_INTEGRATION: "1"
+        run: yarn test:unit src/governance/store.integration.test.ts
+
+      - name: Build
+        run: yarn build
+
+      - name: Tar the MCP bundle
+        run: tar -cvf mcp-dist.tar dist
+
+      - name: Upload MCP build bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: mcp-dist
+          path: app/client/packages/mcp/mcp-dist.tar
+          overwrite: true

.github/workflows/on-demand-build-docker-image-deploy-preview.yml

@@ -148,8 +148,18 @@ jobs:
               body: bodyLines.join("\n"),
             })
 
+  mcp-build:
+    needs: [resolve-params]
+    name: mcp-build
+    if: github.event.client_payload.slash_command.args.named.env != 'release'
+    uses: ./.github/workflows/mcp-build.yml
+    secrets: inherit
+    with:
+      pr: ${{ fromJSON(needs.resolve-params.outputs.pr_number) }}
+      skip-tests: ${{ github.event.client_payload.slash_command.args.named.skip-tests }}
+
   push-image:
-    needs: [resolve-params, client-build, rts-build, server-build]
+    needs: [resolve-params, client-build, rts-build, mcp-build, server-build]
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -201,6 +211,18 @@ jobs:
           echo "Cleaning up the tar files"
           rm app/client/packages/rts/dist/rts-dist.tar
 
+      - name: Download the MCP build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: mcp-dist
+          path: app/client/packages/mcp/dist
+
+      - name: Untar the MCP folder
+        run: |
+          tar -xvf app/client/packages/mcp/dist/mcp-dist.tar -C app/client/packages/mcp/
+          echo "Cleaning up the MCP tar files"
+          rm app/client/packages/mcp/dist/mcp-dist.tar
+
       - name: Generate info.json
         id: info_json
         run: |

.github/workflows/playwright-e2e.yml

@@ -141,8 +141,17 @@ jobs:
       pr: ${{ fromJSON(format('{0}', inputs.pr)) }}
       branch: ${{ inputs.branch }}
 
+  mcp-build:
+    needs: path-filter
+    if: success() && needs.path-filter.outputs.not-ci == 'true' && inputs.docker_image_name == ''
+    uses: ./.github/workflows/mcp-build.yml
+    secrets: inherit
+    with:
+      pr: ${{ fromJSON(format('{0}', inputs.pr)) }}
+      branch: ${{ inputs.branch }}
+
   build-docker-image:
-    needs: [client-build, server-build, rts-build, path-filter]
+    needs: [client-build, server-build, rts-build, mcp-build, path-filter]
     if: success() && needs.path-filter.outputs.not-ci == 'true' && inputs.docker_image_name == ''
     uses: ./.github/workflows/build-docker-image.yml
     secrets: inherit
@@ -151,7 +160,7 @@ jobs:
       branch: ${{ inputs.branch }}
 
   playwright-e2e:
-    needs: [path-filter, client-build, server-build, rts-build, build-docker-image]
+    needs: [path-filter, client-build, server-build, rts-build, mcp-build, build-docker-image]
     if: |
       always() &&
       needs.path-filter.result == 'success' &&

.github/workflows/pr-cypress.yml

@@ -58,8 +58,16 @@ jobs:
       pr: ${{ github.event.number }}
       is-pg-build: ${{ github.event.pull_request.base.ref == 'pg' }}
 
+  mcp-build:
+    if: success()
+    name: mcp-build
+    uses: ./.github/workflows/mcp-build.yml
+    secrets: inherit
+    with:
+      pr: ${{ github.event.number }}
+
   build-docker-image:
-    needs: [client-build, server-build, rts-build]
+    needs: [client-build, server-build, rts-build, mcp-build]
     # Only run if the build step is successful
     if: success()
     name: build-docker-image