Add securing MCP sample use case and refactor docs#3027
Merged
Conversation
thiva-k
requested review from
DonOmalVindula,
brionmario and
jeradrutnam
as code owners
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughConsolidates Wayfinder sample into a single backend serving REST and MCP, implements an MCP handler with per-tool OAuth scope enforcement and protected-resource discovery, adds Securing MCP documentation and sidebar navigation, updates agent OBO/tool wiring, sample configs, scripts, diagrams, UI, and spellchecker vocab. ChangesMCP Authorization & Wayfinder Backend Consolidation
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
thiva-k
force-pushed
the
add-mcp-usecase-doc
branch
from
d6c11f1 to
7c758ac
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/use-cases/ai-agents/configure-it-yourself.mdx`:
- Line 253: Replace the hardcoded GitHub URL
"https://github.com/asgardeo/thunder/tree/main/samples/apps/wayfinder-sample#readme"
with the RepoLink component: use RepoLink with path set to
"samples/apps/wayfinder-sample#readme" and keep the visible link text "README"
so the MDX follows the docs guideline for repository links.
In
`@docs/content/use-cases/ai-agents/mcp-authorization/configure-it-yourself.mdx`:
- Line 38: Replace the hardcoded GitHub URL in the sentence with the RepoLink
MDX component: locate the sentence mentioning the Wayfinder sample README and
replace the literal URL string with a <RepoLink> component using the same path
(e.g., path="/samples/apps/wayfinder-sample#readme") and keep the link text
unchanged; ensure the JSX uses <RepoLink path="...">link text</RepoLink> so the
rendered text and anchor behave identically.
In `@docs/content/use-cases/ai-agents/mcp-authorization/try-it-out.mdx`:
- Line 56: The heading "Allow Inspector in Thunder CORS" hardcodes the product
name; update the .mdx heading in try-it-out.mdx to use the ProductName component
instead (e.g., change the heading to use <ProductName /> where "Thunder"
appears) so that docs/** contains no literal "Thunder"/"ThunderID" in
prose/headings and the rendered heading reads correctly with the product
component.
- Line 3: The frontmatter in try-it-out.mdx currently hardcodes the product name
"ThunderID" in the description; update that frontmatter field to use the product
token {{ProductName}} (e.g., change "signed in through ThunderID" to "signed in
through {{ProductName}}") and scan this file (and other docs/** MDX frontmatter)
for any other occurrences of "Thunder" or "ThunderID" to replace with the
appropriate {{ProductName}} token so the docs follow the guideline.
- Line 76: The description string currently hardcodes "ThunderID" inside JSX
string content; replace that literal with the ProductName component by switching
the description prop value to JSX (e.g., description={<>{/* text before
*/}<ProductName />{/* text after */}</>}) so the component renders <ProductName
/> instead of the hardcoded brand; update the description prop in the same MDX
block where description="Authorize an external MCP client against ThunderID,
list Wayfinder's tools..." to use JSX and ensure all occurrences of "Thunder" /
"ThunderID" in this file's JSX content are replaced with <ProductName />.
In
`@docs/content/use-cases/ai-agents/mcp-authorization/try-it-out/connect-via-inspector.mdx`:
- Line 3: The frontmatter description for connect-via-inspector.mdx currently
hardcodes the brand name "ThunderID"; replace that literal with the frontmatter
placeholder {{ProductName}} so the description reads using {{ProductName}}
(e.g., change "through ThunderID" to "through {{ProductName}}") to comply with
docs/** guidelines and .mdx frontmatter requirements.
In `@docs/src/components/WayfinderDiagrams.tsx`:
- Around line 867-869: Replace the hardcoded "ThunderID" string in
WayfinderDiagrams.tsx with the product name read from Docusaurus site config:
import and call useDocusaurusContext(), get the product name from siteConfig
(e.g. siteConfig.customFields?.productName or fallback to siteConfig.title), and
render that value inside the <text> element with className
"uc-agent-wayfinder-arch__idp-title" instead of the literal "ThunderID".
In `@samples/apps/wayfinder-sample/backend/src/server.js`:
- Around line 65-73: sendJson now determines CORS via corsOrigin(request) but
many route handlers call sendJson without passing the request, causing
Access-Control-Allow-Origin to fall back to FRONTEND_ORIGIN; update every call
site that returns JSON (all route handlers that call sendJson, including the
handlers for GET/POST/DELETE/OPTIONS) to pass the incoming request object as the
fourth argument so sendJson can echo the caller origin, and verify any helper
wrappers around sendJson (if present) are similarly updated to forward the
request to sendJson and to corsOrigin.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f1f89f3f-8182-4418-84f7-c0d4a875b215
⛔ Files ignored due to path filters (2)
samples/apps/wayfinder-sample/api/package-lock.jsonis excluded by!**/package-lock.jsonsamples/apps/wayfinder-sample/backend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (51)
.vale/styles/config/vocabularies/vocab/accept.txtREADME.mddocs/content/use-cases/ai-agents/_category_.jsondocs/content/use-cases/ai-agents/configure-it-yourself.mdxdocs/content/use-cases/ai-agents/identity-concepts.mdxdocs/content/use-cases/ai-agents/mcp-authorization.mdxdocs/content/use-cases/ai-agents/mcp-authorization/_category_.jsondocs/content/use-cases/ai-agents/mcp-authorization/configure-it-yourself.mdxdocs/content/use-cases/ai-agents/mcp-authorization/identity-concepts.mdxdocs/content/use-cases/ai-agents/mcp-authorization/overview.mdxdocs/content/use-cases/ai-agents/mcp-authorization/solution-patterns.mdxdocs/content/use-cases/ai-agents/mcp-authorization/try-it-out.mdxdocs/content/use-cases/ai-agents/mcp-authorization/try-it-out/_category_.jsondocs/content/use-cases/ai-agents/mcp-authorization/try-it-out/connect-via-inspector.mdxdocs/content/use-cases/ai-agents/overview.mdxdocs/content/use-cases/ai-agents/solution-patterns.mdxdocs/content/use-cases/ai-agents/try-it-out.mdxdocs/content/use-cases/ai-agents/try-it-out/act-on-behalf-of-user.mdxdocs/content/use-cases/ai-agents/try-it-out/act-on-its-own.mdxdocs/content/use-cases/ai-agents/try-it-out/protect-the-agent.mdxdocs/content/use-cases/b2c/configure-it-yourself.mdxdocs/content/use-cases/b2c/identity-concepts.mdxdocs/content/use-cases/b2c/try-it-out/add-login.mdxdocs/sidebars.tsdocs/src/components/DocsGetStarted.tsxdocs/src/components/WayfinderDiagrams.tsxfrontend/apps/console/src/features/welcome/pages/WelcomePage.tsxfrontend/packages/i18n/src/locales/en-US.tssamples/apps/wayfinder-sample/README.mdsamples/apps/wayfinder-sample/ai-agent/.env.examplesamples/apps/wayfinder-sample/ai-agent/agent.tssamples/apps/wayfinder-sample/api/.env.examplesamples/apps/wayfinder-sample/api/README.mdsamples/apps/wayfinder-sample/backend/.env.examplesamples/apps/wayfinder-sample/backend/README.mdsamples/apps/wayfinder-sample/backend/openapi.yamlsamples/apps/wayfinder-sample/backend/package.jsonsamples/apps/wayfinder-sample/backend/scripts/seed.jssamples/apps/wayfinder-sample/backend/src/auth.jssamples/apps/wayfinder-sample/backend/src/db.jssamples/apps/wayfinder-sample/backend/src/mcp.jssamples/apps/wayfinder-sample/backend/src/server.jssamples/apps/wayfinder-sample/frontend/src/App.jsxsamples/apps/wayfinder-sample/mcp/README.mdsamples/apps/wayfinder-sample/mcp/package.jsonsamples/apps/wayfinder-sample/mcp/server.tssamples/apps/wayfinder-sample/mcp/tsconfig.jsonsamples/apps/wayfinder-sample/package.jsonsamples/apps/wayfinder-sample/start.ps1samples/apps/wayfinder-sample/start.shsamples/apps/wayfinder-sample/thunderid-config/thunderid-config.yaml
💤 Files with no reviewable changes (7)
- samples/apps/wayfinder-sample/mcp/README.md
- samples/apps/wayfinder-sample/api/README.md
- samples/apps/wayfinder-sample/mcp/package.json
- docs/content/use-cases/ai-agents/mcp-authorization.mdx
- samples/apps/wayfinder-sample/mcp/server.ts
- samples/apps/wayfinder-sample/mcp/tsconfig.json
- samples/apps/wayfinder-sample/api/.env.example
thiva-k
force-pushed
the
add-mcp-usecase-doc
branch
2 times, most recently
from
0f1c24c to
04902be
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
docs/src/components/WayfinderDiagrams.tsx (1)
203-203:⚠️ Potential issue | 🟠 Major | ⚡ Quick winReplace remaining hardcoded
ThunderIDlabels in legacy diagrams.I still see hardcoded brand literals in JSX content and aria-labels at Line 203, Line 283, Line 519, and Line 589. Is this hardcoded brand name intentional? Please derive these labels from config (same pattern already used in
WayfinderMcpArchitecture) instead of raw strings.As per coding guidelines:
**/*.tsxmust flag hardcodedThunder/ThunderID, and.tsxfiles underdocs/src/must read product name from Docusaurus site config rather than hardcoded literals.Also applies to: 283-283, 519-519, 589-589
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/src/components/WayfinderDiagrams.tsx` at line 203, The JSX in WayfinderDiagrams (component WayfinderDiagrams) contains hardcoded brand literals like "ThunderID" in attributes such as the aria-label and inline labels; replace these by reading the product name from Docusaurus site config (reuse the same pattern used in WayfinderMcpArchitecture, e.g., obtain product/siteConfig via useDocusaurusContext() and derive productName) and interpolate that variable into the aria-label and any JSX text nodes instead of the string "ThunderID" (search for occurrences of "ThunderID" in WayfinderDiagrams and update the aria-label prop and inline labels to use the productName variable).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@docs/src/components/WayfinderDiagrams.tsx`:
- Line 203: The JSX in WayfinderDiagrams (component WayfinderDiagrams) contains
hardcoded brand literals like "ThunderID" in attributes such as the aria-label
and inline labels; replace these by reading the product name from Docusaurus
site config (reuse the same pattern used in WayfinderMcpArchitecture, e.g.,
obtain product/siteConfig via useDocusaurusContext() and derive productName) and
interpolate that variable into the aria-label and any JSX text nodes instead of
the string "ThunderID" (search for occurrences of "ThunderID" in
WayfinderDiagrams and update the aria-label prop and inline labels to use the
productName variable).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6882c2c8-44e4-445b-b2a9-7931a9665d55
⛔ Files ignored due to path filters (2)
samples/apps/wayfinder-sample/api/package-lock.jsonis excluded by!**/package-lock.jsonsamples/apps/wayfinder-sample/backend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (53)
.vale/styles/config/vocabularies/vocab/accept.txtREADME.mdbuild.ps1build.shdocs/content/use-cases/ai-agents/_category_.jsondocs/content/use-cases/ai-agents/configure-it-yourself.mdxdocs/content/use-cases/ai-agents/identity-concepts.mdxdocs/content/use-cases/ai-agents/mcp-authorization.mdxdocs/content/use-cases/ai-agents/mcp-authorization/_category_.jsondocs/content/use-cases/ai-agents/mcp-authorization/configure-it-yourself.mdxdocs/content/use-cases/ai-agents/mcp-authorization/identity-concepts.mdxdocs/content/use-cases/ai-agents/mcp-authorization/overview.mdxdocs/content/use-cases/ai-agents/mcp-authorization/solution-patterns.mdxdocs/content/use-cases/ai-agents/mcp-authorization/try-it-out.mdxdocs/content/use-cases/ai-agents/mcp-authorization/try-it-out/_category_.jsondocs/content/use-cases/ai-agents/mcp-authorization/try-it-out/connect-via-inspector.mdxdocs/content/use-cases/ai-agents/overview.mdxdocs/content/use-cases/ai-agents/solution-patterns.mdxdocs/content/use-cases/ai-agents/try-it-out.mdxdocs/content/use-cases/ai-agents/try-it-out/act-on-behalf-of-user.mdxdocs/content/use-cases/ai-agents/try-it-out/act-on-its-own.mdxdocs/content/use-cases/ai-agents/try-it-out/protect-the-agent.mdxdocs/content/use-cases/b2c/configure-it-yourself.mdxdocs/content/use-cases/b2c/identity-concepts.mdxdocs/content/use-cases/b2c/try-it-out/add-login.mdxdocs/sidebars.tsdocs/src/components/DocsGetStarted.tsxdocs/src/components/WayfinderDiagrams.tsxfrontend/apps/console/src/features/welcome/pages/WelcomePage.tsxfrontend/packages/i18n/src/locales/en-US.tssamples/apps/wayfinder-sample/README.mdsamples/apps/wayfinder-sample/ai-agent/.env.examplesamples/apps/wayfinder-sample/ai-agent/agent.tssamples/apps/wayfinder-sample/api/.env.examplesamples/apps/wayfinder-sample/api/README.mdsamples/apps/wayfinder-sample/backend/.env.examplesamples/apps/wayfinder-sample/backend/README.mdsamples/apps/wayfinder-sample/backend/openapi.yamlsamples/apps/wayfinder-sample/backend/package.jsonsamples/apps/wayfinder-sample/backend/scripts/seed.jssamples/apps/wayfinder-sample/backend/src/auth.jssamples/apps/wayfinder-sample/backend/src/db.jssamples/apps/wayfinder-sample/backend/src/mcp.jssamples/apps/wayfinder-sample/backend/src/server.jssamples/apps/wayfinder-sample/frontend/src/App.jsxsamples/apps/wayfinder-sample/mcp/README.mdsamples/apps/wayfinder-sample/mcp/package.jsonsamples/apps/wayfinder-sample/mcp/server.tssamples/apps/wayfinder-sample/mcp/tsconfig.jsonsamples/apps/wayfinder-sample/package.jsonsamples/apps/wayfinder-sample/start.ps1samples/apps/wayfinder-sample/start.shsamples/apps/wayfinder-sample/thunderid-config/thunderid-config.yaml
💤 Files with no reviewable changes (7)
- samples/apps/wayfinder-sample/api/.env.example
- samples/apps/wayfinder-sample/api/README.md
- samples/apps/wayfinder-sample/mcp/README.md
- samples/apps/wayfinder-sample/mcp/server.ts
- samples/apps/wayfinder-sample/mcp/package.json
- docs/content/use-cases/ai-agents/mcp-authorization.mdx
- samples/apps/wayfinder-sample/mcp/tsconfig.json
✅ Files skipped from review due to trivial changes (19)
- docs/content/use-cases/ai-agents/category.json
- docs/content/use-cases/b2c/identity-concepts.mdx
- docs/content/use-cases/ai-agents/mcp-authorization/try-it-out/category.json
- docs/content/use-cases/ai-agents/mcp-authorization/try-it-out/connect-via-inspector.mdx
- docs/content/use-cases/ai-agents/mcp-authorization/solution-patterns.mdx
- samples/apps/wayfinder-sample/backend/src/db.js
- .vale/styles/config/vocabularies/vocab/accept.txt
- docs/content/use-cases/b2c/configure-it-yourself.mdx
- docs/content/use-cases/ai-agents/identity-concepts.mdx
- docs/content/use-cases/ai-agents/try-it-out/protect-the-agent.mdx
- samples/apps/wayfinder-sample/backend/README.md
- samples/apps/wayfinder-sample/backend/.env.example
- docs/content/use-cases/ai-agents/mcp-authorization/category.json
- docs/content/use-cases/ai-agents/mcp-authorization/try-it-out.mdx
- docs/content/use-cases/ai-agents/configure-it-yourself.mdx
- docs/content/use-cases/ai-agents/solution-patterns.mdx
- docs/content/use-cases/ai-agents/mcp-authorization/overview.mdx
- samples/apps/wayfinder-sample/README.md
- docs/content/use-cases/ai-agents/mcp-authorization/identity-concepts.mdx
🚧 Files skipped from review as they are similar to previous changes (18)
- docs/content/use-cases/ai-agents/try-it-out/act-on-behalf-of-user.mdx
- docs/content/use-cases/b2c/try-it-out/add-login.mdx
- samples/apps/wayfinder-sample/package.json
- README.md
- samples/apps/wayfinder-sample/backend/package.json
- samples/apps/wayfinder-sample/ai-agent/.env.example
- samples/apps/wayfinder-sample/backend/src/auth.js
- frontend/apps/console/src/features/welcome/pages/WelcomePage.tsx
- docs/src/components/DocsGetStarted.tsx
- docs/content/use-cases/ai-agents/overview.mdx
- samples/apps/wayfinder-sample/start.sh
- samples/apps/wayfinder-sample/backend/src/mcp.js
- samples/apps/wayfinder-sample/backend/src/server.js
- frontend/packages/i18n/src/locales/en-US.ts
- docs/sidebars.ts
- samples/apps/wayfinder-sample/thunderid-config/thunderid-config.yaml
- docs/content/use-cases/ai-agents/try-it-out.mdx
- samples/apps/wayfinder-sample/ai-agent/agent.ts
thiva-k
force-pushed
the
add-mcp-usecase-doc
branch
from
04902be to
fe88904
Compare
sahandilshan
previously approved these changes
May 27, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
thiva-k
force-pushed
the
add-mcp-usecase-doc
branch
2 times, most recently
from
cbe7d73 to
4d51079
Compare
ThaminduDilshan
previously approved these changes
May 27, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
thiva-k
force-pushed
the
add-mcp-usecase-doc
branch
from
4d51079 to
598d245
Compare
ThaminduDilshan
approved these changes
May 28, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Add a new Securing MCP use case to the documentation that demonstrates how authorizes external MCP clients calling an OAuth-protected MCP server. Restructure the AI agent documentation to live under a shared Agent Identity parent section alongside it.
Approach
Configure It YourselfandIdentity Conceptspages for parity with the B2C structure. Consolidatebooking-api→wayfinder-bookingresource server naming across B2C, AI Agents, and MCP.samples/apps/wayfinder-sample/backend/(renamed fromapi/), add theEXTERNAL-MCP-CLIENTOAuth application, enforce Thunder JWT validation on the backend by default, and fix a LangChainresponseFormat: "content_and_artifact"tuple bug in the agent that caused successful bookings to surface as errors with weaker LLMs.README.mdand the Console Welcome Page alongside the existing B2C and AI Agent entries.Summary by CodeRabbit
New Features
Documentation
Chores
Style