feat: Add global variable support for MCP server headers by stevehaertel · Pull Request #11300 · langflow-ai/langflow

stevehaertel · 2026-01-14T17:05:47Z

Description

Adds support for using global variables (both GENERIC and CREDENTIAL types) in MCP server headers, allowing users to securely reference API keys and other sensitive values without hardcoding them.

Changes

Frontend

Created new IOKeyPairInputWithVariables component extending key-pair input with global variable dropdown
Updated addMcpServerModal to use the new component for HTTP headers
Displays green badges for existing global variables in header values

Backend

Added _resolve_global_variables_in_headers() utility function for exact-match variable resolution
Updated /api/v2/mcp/settings/test endpoint to load and decrypt global variables
Updated MCPComponent to load variables from graph context or database with decryption fallback
Both GENERIC and CREDENTIAL variable types are decrypted using auth_utils.decrypt_api_key()

Testing

Added 11 comprehensive unit tests in test_mcp_util.py
All tests passing (3249 total)
Code quality checks passed (linting, formatting, pre-commit hooks)

How It Works

Users select global variables from dropdown when configuring MCP server headers
Variable names are stored in header values (e.g., x-api-key: MY_API_KEY)
At runtime, variable names are resolved to their decrypted values
Resolution uses exact string matching (not substring replacement)

Testing Done

✅ Manual testing with CREDENTIAL variables
✅ MCP server successfully connects using global variables
✅ Green badges display correctly for existing variables
✅ All unit tests passing
✅ Code quality checks passed

Summary by CodeRabbit

Release Notes

New Features
- Global variables can now be referenced directly in MCP server HTTP headers for secure credential and configuration management without hardcoding sensitive values.
- Configuration interface enhanced with an integrated global variable selector for streamlined header field assignment during server setup.
- Improved error handling with fallback mechanisms ensures reliable variable resolution during server initialization.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2026-01-14T17:06:08Z

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

This PR adds global variable support to MCP server configurations. It enables runtime retrieval and decryption of global variables from the database, then resolves them in HTTP headers during MCP server initialization across frontend and backend layers.

Changes

Cohort / File(s)	Summary
Backend MCP Variable Resolution `src/backend/base/langflow/api/v2/mcp.py`, `src/lfx/src/lfx/base/mcp/util.py`	Adds runtime loading and decryption of global variables from database; introduces `_resolve_global_variables_in_headers()` utility to replace header values with decrypted variable values; extends `update_tools()` to accept and pass `request_variables` through header processing pipeline with fallback to plaintext on decryption failure.
MCP Component Integration `src/lfx/src/lfx/components/models_and_agents/mcp_component.py`	Loads global variables from database for the current user, decrypts them via auth utilities, builds `request_variables` map, and passes it to `update_tools()` call; adds logging for decryption and loading failures.
Frontend Global Variable Component `src/frontend/src/modals/IOModal/components/IOFieldView/components/key-pair-input-with-variables.tsx`	Introduces new `IOKeyPairInputWithVariables` component for managing dynamic key/value pairs with optional global variable selection per row; handles validation, state management, and integrates variable fetching with automatic initialization.
Modal Integration & Error Handling `src/frontend/src/modals/addMcpServerModal/index.tsx`	Replaces `IOKeyPairInput` with `IOKeyPairInputWithVariables` for HTTP headers with `enableGlobalVariables={true}`; improves error handling from `any` to `unknown` type with `instanceof Error` guards; strengthens `queryClient.setQueryData()` calls with defensive array checks.
Test Coverage `src/backend/tests/unit/base/mcp/test_mcp_util.py`	Adds comprehensive unit tests for `_resolve_global_variables_in_headers()` and `_process_headers()` validating variable resolution, header normalization, case-sensitive matching, edge cases, and injection safety.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant Frontend
    participant API
    participant Database
    participant Utility
    participant Tools

    User->>Frontend: Selects global variable for header value
    Frontend->>Frontend: Stores selection with key-pair data
    Frontend->>API: Sends MCP server config with header key-pairs
    API->>Database: Query global variables for user
    Database-->>API: Return encrypted variable records
    API->>API: Decrypt variables via auth_utils
    API->>Utility: Call update_tools with request_variables
    Utility->>Utility: Resolve header values against request_variables
    Utility-->>Tools: Pass resolved headers to tool initialization
    Tools-->>API: Return initialized tools

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 2 warnings)

Check name	Status	Explanation	Resolution
Test Coverage For New Implementations	❌ Error	PR includes comprehensive backend unit tests (527 lines, 90 methods) but lacks corresponding frontend test coverage for the new IOKeyPairInputWithVariables React component.	Create frontend unit tests at src/frontend/src/modals/IOModal/components/IOFieldView/components/tests/key-pair-input-with-variables.test.tsx covering rendering, adding/removing rows, duplicate key validation, and variable selection modes.
Test Quality And Coverage	⚠️ Warning	Significant testing gaps exist: modified API endpoint lacks explicit tests, MCPComponent variable loading has minimal placeholder test, IOKeyPairInputWithVariables React component has no unit tests, decryption fallback behavior and error scenarios not tested.	Add integration/unit tests for /api/v2/mcp/settings/test endpoint, expand mcp_component integration test, create unit tests for IOKeyPairInputWithVariables component, add async tests for update_tools, and test error handling paths including decryption failures.
Test File Naming And Structure	⚠️ Warning	PR adds 195 lines for IOKeyPairInputWithVariables and 39 lines to addMcpServerModal without corresponding frontend unit tests, violating codebase pattern.	Add frontend unit tests for React components in tests/ directories following established codebase patterns for test coverage.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main feature addition: global variable support for MCP server headers, which is the primary focus of all changes across backend, frontend, and testing.
Docstring Coverage	✅ Passed	Docstring coverage is 82.61% which is sufficient. The required threshold is 80.00%.
Excessive Mock Usage Warning	✅ Passed	Test file demonstrates balanced mock usage: session management tests properly mock external dependencies while utility function tests use real data for pure functions. Overall mock density of 1.17 mocks per test is reasonable.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

stevehaertel · 2026-01-14T17:29:43Z

@coderabbitai how does the review look now with the latest changes?

coderabbitai · 2026-01-14T17:30:02Z

@stevehaertel, I'll review the latest changes in your PR now to provide comprehensive feedback on the implementation of global variable support for MCP server headers.

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

- Add IOKeyPairInputWithVariables component for header inputs with global variable dropdown - Integrate global variable selection in MCP Server modal - Add variable resolution in MCP server headers (_resolve_global_variables_in_headers) - Add variable loading and decryption in MCP API endpoint and component - Add unit tests for variable resolution utility function

…mponent - Add 15 test cases covering rendering, user interactions, and edge cases - Test global variable dropdown functionality and selection - Test row addition/removal and input validation - Test duplicate key detection and error handling - Test initialization from existing values with variable badges - Addresses CodeRabbit review feedback for frontend test coverage

- Added proper mocks for IconComponent, InputComponent, and Input - Used explicit TypeScript types instead of 'any' for mock props - Fixed test assertions to match actual component structure (Type key.../Type a value... placeholders) - All 8 tests now pass without console warnings - Tests cover: rendering, onChange callbacks, add/delete buttons, global variables toggle

The session_scope import was moved inside _process_headers method, which broke unit tests that mock it at the module level. Restored it to module-level imports with noqa comment to prevent ruff from removing it, and removed the duplicate import from inside the method. Fixes: test_database_config_used_when_no_value_config

…hangs - Update GlobalVariableModal to handle None credential values - Allow credential updates without re-entering value - Fix userSettings test by using dispatchEvent for clicks - Add waitForTimeout after clicks to prevent hangs - Use .first() for Fields selectors to avoid strict mode violations

- Resolved conflicts in userSettings.spec.ts by adopting upstream's trySelectAvailableField() approach and .ag-cell locators - Removed duplicate useEffect in GlobalVariableModal.tsx, keeping upstream's [initialData] dependency version - Upstream already includes the conditional value inclusion logic we implemented

stevehaertel · 2026-01-16T14:46:39Z

🍏

src/backend/base/langflow/services/auth/utils.py

src/backend/base/langflow/api/v2/mcp.py

src/backend/base/langflow/services/auth/mcp_encryption.py

src/backend/base/langflow/services/variable/service.py

Address code review feedback: 1. Increase log level from debug to warning when decryption fails in auth/utils.py. Returning empty string silently could cause issues, so warning level makes failures more visible. 2. Follow established pattern in mcp.py for variable decryption: - Only decrypt CREDENTIAL type variables (encrypted in storage) - Use GENERIC type variables as-is (stored as plaintext) - Change from silent fallback (adebug) to explicit error (aerror) - This matches the pattern in get_all_decrypted_variables() These changes make error handling more explicit and consistent across the codebase.

Resolved conflict in component_index.json by accepting upstream version.

…bles

stevehaertel · 2026-01-20T17:31:08Z