Sync MCP managed auth options

[masnwilliams]

Summary

• update the Kernel SDK from 0.90.0 to 0.97.0 and the managed-auth React package from 0.4.1 to 0.5.1
• expose current managed-auth connection update, timeline, health-check, automatic re-auth, browser, proxy, telemetry, search, and canonical interaction submission options through manage_auth_connections
• send managed-auth browser configuration through the current nested API shape and regenerate the secure MCP App with canonical interaction support

Verification

• CLERK_SECRET_KEY=test-secret-key bun test (266 passing)
• bunx tsc --noEmit --incremental false
• bun run check:managed-auth-app
• bun run build with local placeholder build-time OAuth/Clerk values
• Prettier check on all changed source and documentation files

bun run format:check still reports the pre-existing formatting mismatch in AGENTS.md; this PR does not modify that file.

---

Note

Medium Risk
Dependency upgrades on the managed-auth stack can change API behavior for login flows and telemetry; risk is mainly integration drift rather than broad refactors in this diff.

Overview
Bumps @onkernel/sdk to ^0.97.0 and @onkernel/managed-auth-react to 0.5.1 (with matching bun.lock entries) so the MCP server tracks the current Kernel managed-auth APIs.

README now describes the expanded manage_auth_connections surface—update, timeline inspection, health-check and automatic re-auth settings, managed-auth browser configuration, and canonical interaction-bound submissions—and notes that programmatic create, update, and login route browser telemetry through the nested browser.telemetry API shape while keeping defaults when MCP omits those parameters.

^{Reviewed by Cursor Bugbot for commit 5e5976c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Sep 1, 2026 2:29am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​onkernel/​sdk@​0.90.0 ⏵ 0.97.0	+1		+1	+1
	@​onkernel/​managed-auth-react@​0.4.1 ⏵ 0.5.1	+7			+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3595eeb. Configure here.}

[rgarcia]

reviewed — overall looks solid. two input-contract issues worth addressing:

Findings

• src/lib/mcp/tools/auth-connections.ts:78-100 — credential updates are supported by the new update handler, but all four credential parameter descriptions still say (create). change them to (create, update) so MCP clients know the update capability exists.

• src/lib/mcp/tools/auth-connections.ts:477-527 — submit validation is partial: canonical input can still be combined with legacy parameters, and interaction_id can accompany legacy-only input, both of which the API rejects. complete these canonical-vs-legacy shape checks and add parameterized tests; leave flow-state and value validation to the API.

[masnwilliams]

addressed both review findings in 1a53248: credential inputs now advertise update support, and MCP submit validation mirrors the API’s canonical/legacy shape contract with parameterized coverage. full suite passes (277 tests), and BugBot is green on the latest commit.