DottaandPaperclip
8781f06a87
## Thinking Path > - Paperclip helps people manage AI agents for work. > - Connections let those agents use external services with explicit access rules. > - Zapier, Arcade, Composio Connect, and Executor already have setup and runtime support. > - Their experimental switch still blocks discovery and setup by default. > - This pull request removes those gates and the Settings toggle. > - Users can connect these providers without enabling an experiment. ## Linked Issues or Issue Description Refs #13755. Refs #13941. **What existing behavior does this improve?** Apps browsing, inline setup, and agent connection search for the four MCP aggregators. **Current behavior** An instance must enable the MCP aggregators experiment before users or agents can start setup. **Proposed behavior** All four providers are available by default on local and managed instances. Old stored and managed values still parse but cannot disable them. ## What Changed - Remove the aggregator gates from Apps, inline setup, server setup, and agent search. - Remove the Settings toggle and its UI hook. - Retain the old setting key only for upgrade compatibility. Normalize it to true and ignore managed overrides, as Apps already does. - Replace opt-in fixtures with default-on coverage. Test old false values, all four setup flows, provider choice, and the removed toggle. - Update current connector guidance and remove the opt-in from the runner acceptance fixture. ## Verification - 306 focused tests passed across eight files: shared remote MCP contracts; server remote MCP lifecycle, aggregator fallback, settings normalization, and managed overlay; UI Apps browsing, setup, and experimental settings. - Server and UI TypeScript checks passed. - UI token gates and `git diff --check` passed. - The full local suite was not run, per the maintainer's instruction. All 54 CI checks passed; two checks were skipped. One unrelated workspace-preview readiness timeout passed on one failed-shard retry. - The setup fixtures use simulated MCP responses. This change does not claim new live provider acceptance. ## Risks - Existing instances now show all four providers, even if the old flag was false. This is intentional. - External provider choice, credentials, company isolation, agent grants, and tool policies still apply. Showing a connector does not authorize an external account. - No data migration is required. The compatibility key keeps old managed configuration documents valid. - Historical Zapier live acceptance remains incomplete in the existing evidence report. The maintainer explicitly requested the default-on rollout for all four existing providers; the report records that scoped exception. ## Model Used OpenAI GPT-6 (`gpt-6-astra`) through Codex, with reasoning, repository tools, and test execution. The context window size is not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
3.5 KiB
Composio broker retirement
September 21, 2026
Composio now has one Paperclip catalog method: direct MCP. Connect with Composio Connect or an externally configured MCP session URL and headers. The existing Access → Connect setup, OAuth, permissions, per-action Test, and gateway execution are unchanged. Connect underlying apps in Composio; Paperclip does not create per-app child connections.
The project API-key method, toolkit-management API routes, Services tab, connected-account synchronization, and session-minting broker have been removed. There is no automatic credential or grant migration.
Previously saved broker and child records are retained for inspection and explicit removal. They appear as Retired with replacement guidance, are absent from gateway discovery, and cannot execute or refresh tools, reconnect, or start OAuth. Add a new Composio MCP connection and choose its access rules. Remove each obsolete record using the normal removal action to delete its credentials and revoke its grants. Removing a legacy parent does not automatically remove other saved records.
No database migration or new tables are required. Direct MCP connections are identified separately from the old REST API parent and provider: composio child markers, so their existing vault secrets, grants, catalogs, and permissions remain in place.
Verification
Focused fixtures cover removal of the API-key catalog method and toolkit routes, retirement of stored parent/child records without upstream calls, explicit credential cleanup, rejection of previously discovered child tools, and direct MCP catalog refresh/reconnect with preserved Off/Ask choices and company isolation. Browser acceptance is recorded below after testing the existing live Composio Connect account.
Live browser regression
Used the existing isolated connector lab with fresh development data, rebuilt UI, and server on the cleanup branch. Opened Connectors → saved Composio → Permissions. Refresh actions returned the same 11 tools with access intact. The ordinary Test dialog ran COMPOSIO_MANAGE_CONNECTIONS with GitHub's list operation as the test agent; it returned successful: true, no provider error, and the account list in 2.0 seconds. No new sign-in or credentials were needed. This exercises the retained OAuth grant and direct MCP gateway, not a mocked provider.
Functional result: catalog refresh and real gateway Test passed. UX result: the existing Permissions/Test flow remained usable and no broker Services tab appeared. This focused regression does not repeat every provider's original acceptance matrix or claim new account authorization.
A fresh real-agent follow-up also passed: COMPOSIO_SEARCH_TOOLS discovered DEEPWIKI_MCP_READ_WIKI_STRUCTURE, then COMPOSIO_MULTI_EXECUTE_TOOL returned the Paperclip documentation hierarchy (13 top-level sections, 62 subsections; one success, zero errors). The gateway audit independently records both invocations as succeeded on the new run. No provider accounts were modified. Server/UI typechecks, token gates, UI build, Storybook build, and the focused tests passed; the full local suite was intentionally not run.
The retired-record UI was also exercised with a disposable, credential-free legacy fixture in the isolated lab. The list showed Retired rather than Paused; details displayed replacement/removal guidance without obsolete runtime controls. Add Composio MCP connection opened the normal Access → Connect flow with the direct MCP URL and authentication fields. The fixture was removed through the normal confirmation UI afterward.