Support credential collection and browser fill through MCP

[rgarcia]

Summary

• Support the credential flow entirely through MCP: create a per-user vault, bind a browser, create credential definitions, collect privately, observe readiness, and fill browser fields.
• Add manage_vault_credentials for creation and version-guarded updates, including optional immutable expected_item_id, initial values, and null/empty clearing. Definitions remain immutable.
• Add manage_vault_items invocation of fill with a typed, value-free fill object. Fetch current advertised operations before writing. Preserve ordered fill outcomes; failed/unknown outcomes return tool errors with explicit no-retry guidance. Pre-write API errors preserve HTTP status and allowlisted codes with actionable explanations; the API owns destination/format validation. Transport loss and malformed responses are treated as unconfirmed, never replayed.
• Preserve credential/preparation metadata and explicitly non-sensitive text/email values; omit sensitive values and TOTP seeds. Non-sensitive input values are not used as global redaction patterns, preserving collection links and hints. Apply the existing entitlement, project-scoping, sanitized-error, and secret-redaction boundaries to the new tool.
• Align descriptions and documentation with the executable flow, browser exposure, collection version semantics, and per-user ownership.

prepare_checkout remains API/CLI-only. Fill supports credentials and advertised Link cards, not AgentCard. Form submission remains a separate authorized browser action.

SDK

The existing dependency and frozen lockfile already use the latest published Node SDK verified for this work: @onkernel/sdk 0.104.0. No dependency churn.

Validation

• bun test: 603 passed.
• bunx tsc --noEmit: passed.
• Prettier on changed files and git diff --check: passed.
• MCP transport + real SDK/mock HTTP flow covers vault/browser creation, credential creation, collection, readiness, and fill; additional tests cover updates, TOTP bindings, card restrictions, redaction, malformed inputs/results, and one write attempt on 409/429/500/transport loss.
• Full local build remains unverified: the earlier build compiled/typechecked but page-data collection stopped on missing KERNEL_CLI_PROD_CLIENT_ID.
• No live browser login, human collection, or payment was exercised. No live API writes or deployment commands were performed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Sep 16, 2026 1:46am UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 58601b0. Configure here.}

[masnwilliams]

reviewed at 58601b0. no blocking findings.

The revised implementation keeps the new credential write surface focused, isolates fill validation/result handling in vault-fill.ts, rechecks API-advertised availability before invoking, and treats uncertain outcomes conservatively. The secret/public-value projection and error paths have strong boundary coverage. No production file crosses the 1k-line threshold.

Non-blocking follow-ups:

• The tool description could spell out action: "invoke" + operation: "collect" instead of referring to "collect" alone.
• If wildcard record projection expands beyond these credential maps, replace the "*" sentinel with an explicit typed record node. Its current localized use does not justify blocking this PR.

Validated locally: 599 tests, TypeScript, changed-file Prettier, and git diff --check pass.

[rgarcia]

Addressed the collection guidance in 0e74a2d: both tool descriptions and credential response guidance now spell out action: "invoke" and operation: "collect". Added discovery assertions; all 603 tests and TypeScript pass. Kept the wildcard record projection localized as suggested; an explicit typed record node can replace it if usage expands.