fix(mcp): keep a legacy server row from blanking the whole server list

The server-list response validated transport/authType/connectionStatus with
strict enums, but those columns are free text and can hold legacy values
(e.g. transport 'http'/'sse' from before the streamable-http consolidation,
including rows copied verbatim by workspace fork). Since the client strict-
parses the whole array with retry:false, a single off-enum row blanked the
entire workspace's MCP list.

- Tolerate off-enum values in the response via Zod .catch() (request bodies
  stay strict): transport -> streamable-http, authType/connectionStatus -> undefined
- Stop the workspace-fork copy from propagating legacy transport values
- Reset connection status on a headers->OAuth flip in the create/upsert path,
  mirroring the update path (kills a false "connected" state)
- Drop the positive tool cache on OAuth-pending in bulk discovery, matching
  the single-server path (no stale tools after re-auth is required)

Author: waleedlatif1

apps/sim/ee/workspace-forking/lib/copy/copy-resources.ts

@@ -395,6 +395,9 @@ export async function copyForkResourceContainers(
         createdBy: userId,
         url: typeof row.url === 'string' ? rewriteEnv(row.url) : row.url,
         headers,
+        // Normalize legacy `http`/`sse` transports to the only supported value so a
+        // forked row never carries a transport the API contract would reject.
+        transport: 'streamable-http',
         connectionStatus: 'disconnected',
         lastConnected: null,
         lastError: null,

apps/sim/lib/api/contracts/mcp.ts

@@ -26,7 +26,12 @@ const optionalNumberFromNullableSchema = z.preprocess(
 
 const optionalConnectionStatusFromNullableSchema = z.preprocess(
   (value) => (value === null ? undefined : value),
-  z.enum(['connected', 'disconnected', 'error']).optional()
+  // `connection_status` is a free-text column; tolerate an off-enum value as undefined
+  // rather than failing the whole list's validation.
+  z
+    .enum(['connected', 'disconnected', 'error'])
+    .optional()
+    .catch(undefined)
 )
 
 const optionalHeadersFromNullableSchema = z.preprocess(
@@ -36,6 +41,16 @@ const optionalHeadersFromNullableSchema = z.preprocess(
 
 export const mcpTransportSchema = z.enum(['streamable-http'])
 
+/**
+ * Transport as read back from storage. The `transport` column is free text, and
+ * rows predating the Streamable HTTP consolidation (or copied verbatim by an
+ * older fork) may still hold legacy `http`/`sse` values. Every server is operated
+ * over Streamable HTTP regardless, so any non-canonical value normalizes to the
+ * supported transport — this stops a single legacy row from failing the entire
+ * server list's response validation.
+ */
+const mcpTransportResponseSchema = mcpTransportSchema.catch('streamable-http')
+
 export const mcpAuthTypeSchema = z.enum(['none', 'headers', 'oauth'])
 
 const consecutiveFailuresSchema = z.preprocess(
@@ -98,8 +113,10 @@ export const mcpServerSchema = z
     workspaceId: z.string(),
     name: z.string(),
     description: optionalStringFromNullableSchema,
-    transport: mcpTransportSchema,
-    authType: mcpAuthTypeSchema.optional(),
+    transport: mcpTransportResponseSchema,
+    // Response-side tolerance: `auth_type` is a free-text column, so a value outside
+    // the enum normalizes to undefined rather than failing the whole list's validation.
+    authType: mcpAuthTypeSchema.optional().catch(undefined),
     url: optionalStringFromNullableSchema,
     timeout: optionalNumberFromNullableSchema,
     retries: optionalNumberFromNullableSchema,

apps/sim/lib/mcp/orchestration/server-lifecycle.ts

@@ -169,7 +169,10 @@ export async function performCreateMcpServer(
         currentEncryptedClientSecret: existingServer.oauthClientSecret,
       })
       const isRevival = existingServer.deletedAt !== null
-      const shouldClearOauth = urlChanged || credsChanged || isRevival
+      const authTypeChanged = existingServer.authType !== resolvedAuthType
+      // Turning OAuth off orphans its tokens; revoke and delete them, mirroring the update path.
+      const oauthDisabled = existingServer.authType === 'oauth' && resolvedAuthType !== 'oauth'
+      const shouldClearOauth = urlChanged || credsChanged || isRevival || oauthDisabled
 
       if (shouldClearOauth) await revokeMcpOauthTokens(serverId)
 
@@ -191,9 +194,13 @@ export async function performCreateMcpServer(
           deletedAt: null,
         }
         if (resolvedAuthType === 'oauth') {
-          if (shouldClearOauth) {
+          // A flip to OAuth (headers→OAuth carries no tokens to clear) or an OAuth URL/creds
+          // change leaves no valid session: reset to disconnected so the UI shows
+          // "authorization required" instead of a stale connected state until the flow completes.
+          if (authTypeChanged || shouldClearOauth) {
             updateValues.connectionStatus = 'disconnected'
             updateValues.lastConnected = null
+            updateValues.lastError = null
           }
         } else {
           updateValues.connectionStatus = 'connected'

apps/sim/lib/mcp/service.ts

@@ -760,11 +760,20 @@ class McpService {
           return
         }
         if (outcome.kind === 'oauth-pending') {
-          // Mark disconnected so the UI surfaces the re-auth button.
+          // Mark disconnected so the UI surfaces the re-auth button, and drop the positive
+          // tool cache so a follow-up force-refresh can't serve tools for a server that now
+          // needs re-auth (mirrors the single-server discovery path).
           logger.info(`[${requestId}] Skipping server ${server.name}: OAuth authorization pending`)
           deferredSideEffects.push(
             this.markServerOauthPending(server.id, workspaceId, discoveryStartedAt).then(
-              () => undefined
+              async (statusApplied) => {
+                if (!statusApplied) return
+                await this.cacheAdapter
+                  .delete(serverCacheKey(workspaceId, server.id))
+                  .catch((err) =>
+                    logger.warn(`[${requestId}] Cache delete failed for ${server.name}:`, err)
+                  )
+              }
             )
           )
           return