[rutvij-menavlikar]

Summary

return_to on GET /api/v1/mcp-servers/{name}/authorize was already optional in the schema, but in TrueFoundry mode the store always sent a redirectURL to the MCP gateway, falling back to the TrueForge UI home when return_to was missing. As a result, OAuth-based agents landed on the agent creation page after authentication instead of the gateway's "Authentication successful" page.

When return_to is omitted, no redirectURL is now sent to the gateway. An empty return_to is rejected with 400.

Linear: AGE-2694

Changes

• TrueFoundryMcpServerStore.authorize only builds and forwards redirectURL when return_to is given. It also skips the tenant control-plane URL lookup in that case. This also covers the invoke-time authorize call made from resolveInvokeHeaders, which never passes return_to.
• resolveAuthorizeRedirectURL now requires returnTo.
• The return_to query description now states that omitting it requests no post-consent redirect.
• The self-hosted DCR path needed no change: without return_to it already stores no landing path, and the callback returns JSON.
• Added a patch changeset for @truefoundry/trueforge.

How was this tested?

• Added unit tests for omitted return_to (TrueFoundryMcpServerStore.test.ts) and for the 400 on an empty return_to (mcpServers.test.ts).
• pnpm test -- tests/unit/truefoundry/TrueFoundryMcpServerStore.test.ts tests/unit/apis/mcpServers.test.ts passes (49 tests).
• pnpm typecheck, ESLint, and Prettier pass on the changed files.

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally (only the targeted tests, typecheck, and lint were run)
• Tests added/updated where it makes sense
• No hand-edits to generated code
• Docs / .env.example updated if configuration or behavior changed (n/a)

  

---

Note

Medium Risk
Changes default post-OAuth redirect when return_to is omitted and rejects empty return_to with 400; clients or flows that relied on implicit TrueForge redirects need verification.

^{Reviewed by Cursor Bugbot for commit 4d5449c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d5449c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[qodex-ai]

Qodex review

Reviewed units u1. The SDK OpenAPI document requires nonempty return_to values and documents omitted-value behavior.

Effort: ●●●○○ (3/5) · No findings worth raising. The diff reads clean.

Since last review: 0 addressed, 0 new.

Scope: the changes since the last review (delta: only what changed since the previously reviewed commit 165139c is reviewed; findings are anchored on the whole change).

Walkthrough

What Qodex checked

Lenses (openqodex review with checked answers, all dimensions)

• Bugs and correctness
• Security (auth, injection, SSRF, secrets, headers)
• Performance regressions
• Maintainability
• Style and consistency

Scanners

• actionlint did not run
• bandit did not run
• brakeman did not run
• cargo-deny did not run
• checkov did not run
• gitleaks 8.21.2
• golangci did not run
• hadolint did not run
• kube-linter did not run
• kubeconform did not run
• osv-scanner 2.6.0
• oxlint did not run
• rubocop did not run
• ruff did not run
• semgrep 1.94.0
• shellcheck did not run
• sqlfluff did not run
• sqllint did not run
• squawk did not run
• tflint did not run
• trivy did not run
• zizmor did not run
• 0 scanner candidates raised or dropped by the reviewer

Quality filters

• PR description: adequate (present: length, checklist; missing: issue link)
• Repo card last refreshed 8 days ago — may not reflect very recent code structure changes
• Per-category confidence floor (bug/security/performance 0.7, maintainability 0.71, style 0.75)
• Severity threshold from .qodex.yaml: minor
• Path excludes (none configured in .qodex.yaml)
• Disabled rules (none configured in .qodex.yaml)

Verification (M1b probes against PR preview)

• Preview deployment discovered (no successful deploy for this commit)
• Probes (skipped, no preview to probe)

Cross-review dedup

• Delta review: delta: only what changed since the previously reviewed commit 165139c is reviewed; findings are anchored on the whole change
• Carry-overs (no findings from earlier reviews still present)

Output

• Walkthrough comment posted
• Inline comments (no in-diff findings to attach)

---

Reviewer: shown 2 of 2 changed hunks, opened 4 files (2 changed files never opened), 16 tool calls served, 11 model calls, 0 correction rounds, 36.1s. The library does not report tool calls asked apart from those it served, or a step cap.
Reviewed by Qodex · 59.3s

Every dimension is reviewed. Bugs, security, and performance post inline; low-severity style and convention notes are collected in the group above rather than dropped. Mark a finding resolved or flag a false positive in the Qodex Pull Requests view.