When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

• UI deployment: https://agents-manage-8nbq498zh.preview.inkeep.com
• API deployment: https://agents-gmvk4s9kg.preview.inkeep.com

• What failed: The system can return 500 during rapid creates, and subsequent list/get/delete endpoints also return 500 because malformed JSON content has been persisted; expected behavior is a safe rejection or atomic write that never corrupts stored rows.
• Impact: A single malformed write can poison normal CRUD flows for project configuration entities, blocking management operations until manual data repair. This can disrupt admin workflows and require direct DB intervention.
• Steps to reproduce:
  1. Open the Manage UI for tenant/project default/activities-planner.
  2. Create an MCP server using escaped-string content in prompt/config fields.
  3. Trigger rapid repeated Create submits (double/triple click) for the same create flow.
  4. Call tool list/get/delete endpoints and observe repeated 500 responses after the failed create.
  5. Repeat the same rapid create pattern for a Data Component payload containing escaped sequences and verify list/get/delete also fail with 500s.
• Stub / mock context: Rapid multi-submit behavior was intentionally triggered to stress write safety, and local bypass authentication was used for deterministic API verification. No mocked backend responses or route interception were used for this test.
• Code analysis: I inspected the Manage API create handlers and data-access writes for both tools and data components. The routes forward validated request bodies directly into insert operations with no idempotency protection for rapid submits and no guard to prevent malformed JSONB persistence from cascading into read/delete failures.
• Why this is likely a bug: Production create paths can persist malformed JSON-adjacent payload states during rapid submissions, and that persisted state then deterministically breaks downstream CRUD reads/deletes with server-side 500s.

Relevant code:

agents-api/src/domains/manage/routes/tools.ts (lines 217-233)

async (c) => {
    const db = c.get('db');
    const { tenantId, projectId } = c.req.valid('param');
    const body = c.req.valid('json');
    const credentialStores = c.get('credentialStores');
    const userId = c.get('userId');

    logger.info({ body }, 'body');

    const id = body.id || generateId();

    const tool = await createTool(db)({
      ...body,
      tenantId,
      projectId,
      id,
    });

packages/agents-core/src/data-access/manage/tools.ts (lines 624-637)

export const createTool = (db: AgentsManageDatabaseClient) => async (params: ToolInsert) => {
  const now = new Date().toISOString();

  const [created] = await db
    .insert(tools)
    .values({
      ...params,
      createdAt: now,
      updatedAt: now,
    })
    .returning();

  return created;
};

packages/agents-core/src/data-access/manage/dataComponents.ts (lines 94-132)

export const createDataComponent =
  (db: AgentsManageDatabaseClient) =>
  async (params: DataComponentInsert): Promise<DataComponentSelect> => {
    if (params.props) {
      const propsValidation = validatePropsAsJsonSchema(params.props);
      if (!propsValidation.isValid) {
        const errorMessages = propsValidation.errors
          .map((e) => `${e.field}: ${e.message}`)
          .join(', ');
        throw new Error(`Invalid props schema: ${errorMessages}`);
      }
    }

    const dataComponent = await db
      .insert(dataComponents)
      .values(params as any)
      .returning();

    return dataComponent[0];
  };

• What failed: The created row leaves malformed JSON in tools.config, and subsequent GET /tools reads return 500 instead of returning tool rows.
• Impact: MCP tool management can become unavailable for affected projects after a single escaped-input create flow. Users and automation cannot reliably list or load tools until corrupted rows are repaired.
• Steps to reproduce:
  1. Open the MCP server create page for the target project.
  2. Enter prompt content with escaped path/backslash/newline patterns and create the server.
  3. Call or open the project tools list endpoint and observe the 500 response.
• Stub / mock context: Authentication and project-scope gates were locally bypassed so MCP create/list flows could run on localhost fixture projects. The tool create/list API behavior itself was exercised directly without route-level response mocking.
• Code analysis: The tools table persists raw JSONB config, create writes payloads directly, and list reads all rows directly; with the current JSONB path this allows malformed persisted config to crash list queries.
• Why this is likely a bug: The create/read production path can persist and later crash on escaped config content, which violates expected round-trip behavior for valid MCP tool input.

Relevant code:

packages/agents-core/src/db/manage/manage-schema.ts (lines 451-461)

export const tools = pgTable(
  'tools',
  {
    ...projectScoped,
    ...uiProperties,
    config: jsonb('config')
      .$type<{
        type: 'mcp';
        mcp: ToolMcpConfig;
      }>()
      .notNull(),

packages/agents-core/src/data-access/manage/tools.ts (lines 624-637)

export const createTool = (db: AgentsManageDatabaseClient) => async (params: ToolInsert) => {
  const now = new Date().toISOString();

  const [created] = await db
    .insert(tools)
    .values({
      ...params,
      createdAt: now,
      updatedAt: now,
    })
    .returning();

  return created;
};

packages/agents-core/src/data-access/manage/tools.ts (lines 604-612)

const [toolsDbResults, totalResult] = await Promise.all([
  db
    .select()
    .from(tools)
    .where(whereClause)
    .limit(limit)
    .offset(offset)
    .orderBy(desc(tools.createdAt)),
  db.select({ count: count() }).from(tools).where(whereClause),
]);

• What failed: Save path returns 500 for the required escaped path scenario, so override JSON does not remain stable across save and reload.
• Impact: Teams cannot safely store or edit valid escaped override patterns for MCP tools. Configuration updates fail and can block production tool customization workflows.
• Steps to reproduce:
  1. Open an existing MCP server edit page.
  2. Submit tool override transformation content containing escaped regex and Windows-style backslash paths.
  3. Reload the tool and observe API 500 instead of stable persisted override values.
• Stub / mock context: This test ran with local auth and tenant/project protections bypassed to exercise the MCP override edit API in a controlled localhost fixture project. No synthetic success responses were injected for the failing save/read requests.
• Code analysis: Override payloads are persisted into the same JSONB tools.config field used by MCP config, and list/read code directly re-reads that column; escaped path payloads trigger the same malformed JSON persistence and read failure mode.
• Why this is likely a bug: Production edit/read logic cannot reliably round-trip escaped override content, so valid override updates break instead of persisting deterministically.

Relevant code:

packages/agents-core/src/db/manage/manage-schema.ts (lines 456-461)

config: jsonb('config')
      .$type<{
        type: 'mcp';
        mcp: ToolMcpConfig;
      }>()
      .notNull(),

packages/agents-core/src/data-access/manage/tools.ts (lines 627-633)

const [created] = await db
    .insert(tools)
    .values({
      ...params,
      createdAt: now,
      updatedAt: now,
    })
    .returning();

packages/agents-core/src/data-access/manage/tools.ts (lines 606-612)

db
      .select()
      .from(tools)
      .where(whereClause)
      .limit(limit)
      .offset(offset)
      .orderBy(desc(tools.createdAt)),
    db.select({ count: count() }).from(tools).where(whereClause),

• What failed: The create request ends in a server 500 with Bad escaped character in JSON instead of creating and returning the component.
• Impact: Users cannot reliably create components that include common escaped-path or escape-sequence schema values. This blocks configuration workflows that depend on valid backslash-heavy JSON schema fields.
• Steps to reproduce:
  1. Open the Data Component create page in the Manage UI.
  2. Enter a valid JSON schema that includes escaped backslashes and escaped sequence literals.
  3. Submit the form with Save.
  4. Observe the request fail with a server 500 instead of creating the component.
• Stub / mock context: No stubs, mocks, or bypasses were applied for this test in the recorded run.
• Code analysis: I inspected UI validation and API create paths and found they parse JSON and pass it straight into DB JSONB insertion without any escape-safety transform, while the schema now uses native jsonb directly.
• Why this is likely a bug: Valid escaped JSON schema input should not trigger DB parser failure, and the current create path lacks the prior escape-safe handling before JSONB persistence.

Relevant code:

packages/agents-core/src/validation/extend-schemas.ts (lines 19-22)

export function transformToJson<T extends string>(value: T, ctx: z.RefinementCtx<T>) {
  try {
    return JSON.parse(value);
  } catch {

packages/agents-core/src/data-access/manage/dataComponents.ts (lines 97-129)

if (params.props) {
      const propsValidation = validatePropsAsJsonSchema(params.props);
      if (!propsValidation.isValid) {
        const errorMessages = propsValidation.errors
          .map((e) => `${e.field}: ${e.message}`)
          .join(', ');
        throw new Error(`Invalid props schema: ${errorMessages}`);
      }
    }

    const dataComponent = await db
      .insert(dataComponents)
      .values(params as any)
      .returning();

packages/agents-core/src/db/manage/manage-schema.ts (lines 356-363)

export const dataComponents = pgTable(
  'data_components',
  {
    ...projectScoped,
    ...uiProperties,
    props: jsonb('props').$type<JsonSchemaForLlmSchemaType>().notNull(),
    render: jsonb('render').$type<{

• What failed: The create request returns HTTP 500 for valid JSON payloads with escaped-pattern content; expected behavior is successful persistence (201) without server JSON parse errors.
• Impact: Admin users can fail to save valid context configuration payloads and are blocked from configuring agent context behavior. This causes reliability issues in production-like workflows whenever specific escaped sequences are present.
• Steps to reproduce:
  1. Open an agent details page at /{tenantId}/projects/{projectId}/agents/{agentId} and open the context config editor.
  2. Enter valid JSON with escaped path/token-like patterns (for example C:\temp\token and escaped token patterns) in headers schema and context variables.
  3. Save to create the context configuration.
  4. Observe the create request returning HTTP 500 instead of 201.
• Stub / mock context: No stubs, mocks, or bypasses were applied for this test in the recorded run.
• Code analysis: I traced the create flow through the manage API route and data-access layer. The route passes request JSON directly into createContextConfig, and createContextConfig writes headersSchema and contextVariables straight into JSONB columns; with the current schema using native jsonb directly, there is no protective transformation in this path for problematic escape sequences.
• Why this is likely a bug: Valid JSON inputs that should be accepted trigger server-side JSONB parse failure in the production create path, indicating a real persistence defect rather than a test harness artifact.

Relevant code:

packages/agents-core/src/db/manage/manage-schema.ts (lines 1-16)

import {
  boolean,
  doublePrecision,
  foreignKey,
  index,
  integer,
  jsonb,
  numeric,
  pgTable,
  primaryKey,
  text,
  timestamp,
  unique,
  varchar,
} from 'drizzle-orm/pg-core';

packages/agents-core/src/data-access/manage/contextConfigs.ts (lines 80-92)

const contextConfig = await db
  .insert(contextConfigs)
  .values({
    id,
    tenantId: params.tenantId,
    projectId: params.projectId,
    agentId: params.agentId,
    headersSchema: (params.headersSchema ?? null) as any,
    contextVariables: (contextVariables ?? null) as any,
    createdAt: now,
    updatedAt: now,
  })
  .returning();

agents-api/src/domains/manage/routes/contextConfigs.ts (lines 149-157)

const configData = {
  tenantId,
  projectId,
  agentId,
  ...body,
};
const contextConfig = await createContextConfig(db)(configData);

return c.json({ data: contextConfig }, 201);

These findings are unrelated to the current changes but were observed during testing.

Category	Summary	Screenshot
Adversarial	🟠 Dangerous transformation strings are accepted and saved instead of being rejected.

• What failed: The API accepts and persists dangerous transformation strings with HTTP 200 instead of rejecting them.
• Impact: Invalid or unsafe transformation expressions can be stored and later cause unstable behavior when transformations are executed. This also creates inconsistent behavior between UI validation and direct API usage.
• Steps to reproduce:
  1. Open an existing MCP tool override update flow or call the update API directly.
  2. Send transformation values containing patterns like eval(, function(, ${...}, or __proto__.
  3. Observe HTTP 200 and persisted unsafe transformation data instead of validation rejection.
• Stub / mock context: Unsafe and benign transformation payloads were submitted directly through local API flows to verify persistence behavior, which bypasses front-end form guards by design. The run used localhost auth bypass settings so only local non-production services were exercised.
• Code analysis: Server-side tool schemas allow any string/object for transformation with no dangerous-pattern guard, while UI form validation has explicit dangerous-pattern blocking; API clients can bypass UI checks and still persist unsafe values.
• Why this is likely a bug: The product enforces dangerous-pattern blocking in the UI but not in API validation, so unsafe transformations are accepted in production data paths.

Relevant code:

packages/agents-core/src/validation/schemas.ts (lines 1232-1244)

toolOverrides: z
            .record(
              z.string(),
              z.object({
                displayName: z.string().optional(),
                description: z.string().optional(),
                schema: z.any().optional(),
                transformation: z
                  .union([
                    z.string(), // JMESPath expression
                    z.record(z.string(), z.string()), // object mapping
                  ])
                  .optional(),

packages/agents-core/src/validation/schemas.ts (lines 2129-2133)

export const ToolUpdateSchema = ToolInsertSchema.partial();

export const ToolApiSelectSchema = createApiSchema(ToolSelectSchema).openapi('Tool');
export const ToolApiInsertSchema = createApiInsertSchema(ToolInsertSchema).openapi('ToolCreate');
export const ToolApiUpdateSchema = createApiUpdateSchema(ToolUpdateSchema).openapi('ToolUpdate');

agents-manage-ui/src/components/mcp-servers/form/validation.ts (lines 22-30)

const DANGEROUS_PATTERNS = [
  /\$\{.*\}/, // Template injection
  /eval\s*\(/i, // Eval calls
  /function\s*\(/i, // Function definitions
  /constructor/i, // Constructor access
  /prototype/i, // Prototype manipulation
  /__proto__/i, // Proto access
];