agentic-community / agentic-community/mcp-gateway-registry
Revert temporary health check status workaround after credentials manager implementation
- Dominant language
- Python
- Stars
- 912
- Forks
- 234
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 62
Description
# Revert Temporary Health Check Status Workaround After Credentials Manager Implementation
## Context
Currently, servers with authentication requirements (like `customer-support-assistant` using Bedrock AgentCore OAuth) are marked as **"healthy"** instead of **"healthy-auth-expired"** when they respond to MCP ping but authentication fails.
This is a **temporary workaround** implemented in [`registry/health/service.py:555`](registry/health/service.py#L555) to avoid confusing users when servers are registered with auth requirements but no credentials management system is in place.
## Current Behavior (Temporary)
When a health check detects 401/403 auth failures:
1. Try MCP ping without auth headers
2. If ping succeeds → Mark server as **"healthy"** ✅ (TEMPORARY)
3. Server appears healthy in UI even though live operations (tool fetching) will fail
## Desired Behavior (After Credentials Manager)
When a health check detects 401/403 auth failures:
1. Try MCP ping without auth headers
2. If ping succeeds → Mark server as **"healthy-auth-expired"** ⚠️
3. UI shows auth warning indicator
4. Credentials manager automatically refreshes tokens
## Related Work
- **Credentials Manager Design**: See https://github.com/agentic-community/mcp-gateway-registry/issues/168
- **Affected Code**: `registry/health/service.py` line 555
- **Marker Comment**: Search for "TEMPORARY WORKAROUND - TODO: REVERT"
## Tasks
- [ ] Implement credentials manager container (Phase 1-3 from design doc)
- [ ] Integrate credentials manager with health check service
- [ ] Revert health check to return `HealthStatus.HEALTHY_AUTH_EXPIRED` for auth failures
- [ ] Test with customer-support-assistant and other authenticated servers
- [ ] Update UI to properly display auth-expired status
- [ ] Remove temporary workaround comment
## Impact
**Before revert (current):**
- Servers with auth issues show as healthy (misleading)
- Users may be confused when tools don't work despite "healthy" status
- No automatic token refresh
**After revert:**
- Servers accurately show auth status
- UI can display appropriate warnings/indicators
- Credentials manager automatically maintains valid tokens
- Better operational visibility
## Code Location
```python
# registry/health/service.py:555
if await self._try_ping_without_auth(client, endpoint):
# TODO: Change back to HEALTHY_AUTH_EXPIRED after credentials manager
return True, HealthStatus.HEALTHY # Should be: HEALTHY_AUTH_EXPIRED
```
## Priority
Medium - This is functioning as intended for the interim, but should be addressed when implementing the credentials manager to provide accurate operational status.
## Labels
- `enhancement`
- `credentials-management`
- `health-checks`
- `technical-debt`
Contributor guide
Assessment
This issue has not been assessed yet.