improvement(mcp): bound pool create-invalidation + document DCR match

[waleedlatif1]

Summary

Two follow-ups to the MCP connection pool (#5760) flagged in review:

• Bound the pool's create-invalidation state. Replaces the per-server serverGenerations counter Map (grew one entry per distinct evicted server, forever) with a per-in-flight-create invalidation flag that lives in pending and is cleared in finally — naturally bounded, no unbounded growth, and no serverGenerations.clear() needed on dispose. evictServer now flags matching in-flight creates directly instead of bumping a counter they re-read.
  • Note: Greptile's suggested fix (serverGenerations.delete() after retirement) was unsafe — it reintroduced the evict-mid-create race the counter guarded (get() ?? 0 returns 0 after delete, colliding with a fresh create's captured 0). The flag design removes that bug class entirely.
• Document the DCR string-match. The MCP SDK throws a plain Error (no typed class/code) when an auth server lacks a registration_endpoint, so string-matching is the only available signal. Added a comment pinning it to @modelcontextprotocol/sdk v1.29.0 registerClient so a version bump that rephrases the message is easy to spot.

Type of Change

• Improvement (code quality / robustness; no behavior change)

Testing

• Full MCP suite green (426 tests, incl. the evict-mid-create one-shot and recreate-race guards)
• Adversarial concurrency audit of the redesign: confirmed the invalidation flag is at least as safe as the generation counter — pending.set runs synchronously before the create's post-await check, and both evictServer and the create's post-await section are await-free, so an eviction racing a create always sees the record
• tsc clean, boundary audit at baseline

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 20, 2026 8:55pm

[cursor]

PR Summary

Low Risk
Pool invalidation semantics are preserved with bounded state; OAuth change is comment-only with no runtime behavior change.

Overview
MCP connection pool no longer keeps a per-server serverGenerations counter that could grow without bound. In-flight connection creates are tracked as PendingCreate records with a shared invalidated flag; evictServer sets that flag on matching pending creates instead of bumping a generation, so a connect racing a config edit/delete still one-shots (retired, not pooled) with the same semantics. Pending state is cleared when the create settles, so invalidation bookkeeping stays bounded and dispose no longer needs a separate generations map.

MCP OAuth start adds a comment on isDynamicClientRegistrationUnsupported documenting why it relies on a substring match against the MCP SDK’s plain Error message, pinned to SDK v1.29.0, and that rephrasing on upgrade would drop the 422 path in favor of a generic 500.

^{Reviewed by Cursor Bugbot for commit 009ef06. Configure here.}

[greptile-apps]

Greptile Summary

This PR bounds MCP connection-create invalidation state and documents the dynamic-registration error match. The main changes are:

• Replaces persistent server-generation counters with per-create invalidation flags.
• Clears pending-create records after each connection attempt settles.
• Documents the SDK-specific error text used to detect unsupported registration.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• Pending records are registered before control yields, and eviction marks them without yielding.
• Identity-checked cleanup cannot remove a newer pending record.
• In-flight creates after disposal are retired instead of pooled.

Important Files Changed

Filename	Overview
apps/sim/lib/mcp/connection-pool.ts	Uses bounded pending-create records to invalidate connection attempts that race server eviction.
apps/sim/app/api/mcp/oauth/start/route.ts	Documents the existing SDK error-message match without changing runtime behavior.

_{Reviews (1): Last reviewed commit: "improvement(mcp): bound pool create-inva..." | Re-trigger Greptile}