[kernel-internal]

Summary

• Update @onkernel/sdk to 0.148.0.

Coverage

MCP coverage report for @onkernel/sdk 0.148.0

Review basis

• MCP checkout: /home/runner/work/kernel-node-sdk/kernel-node-sdk/mcp
• Exact comparison base: dbecf093f5601415c5c5a726d32782cda67c2c84 ($MAIN_SHA)
• SDK version: 0.148.0, pinned exactly in both package.json and bun.lock
• Runtime/package manager: Bun 1.3.3
• SDK audit inputs:
  • ../sdk/CHANGELOG.md, ../sdk/api.md, and generated resource sources
  • complete generated method/parameter inventory: /home/runner/work/_temp/sdk-method-params.md
  • SDK and OpenAPI release diffs, including /home/runner/work/_temp/sdk-diff.patch, /home/runner/work/_temp/openapi-diff.patch, and the v0.140.0..v0.148.0 SDK comparison
• Final tracked diff reviewed from $MAIN_SHA: /home/runner/work/_temp/mcp-final-main.diff
• New untracked test reviewed separately: /home/runner/work/_temp/mcp-final-untracked.diff

Result

The MCP server now has user-facing treatment for the SDK 0.141.0 through 0.148.0 changes while retaining the branch's existing 0.133.0 through 0.140.0 coverage. New capabilities are mapped into existing grouped tools rather than creating unnecessary one-off tools. Sensitive or unbounded SDK surfaces are either represented by a safer MCP workflow or deliberately excluded below.

No production API calls were made. Tests use injected clients or mocked HTTP responses.

Coverage added or synchronized for SDK 0.141.0-0.148.0

0.141.0

• VGS customer-managed payments
  • Safe metadata for existing VGS provider configurations is now projected by manage_vault_provider_configs list/get, including environment and vault_id, without returning secrets.
  • Existing API-created VGS wallets remain inspectable with manage_vault_items.
  • Existing API-created VGS cards remain inspectable, preserve card_mode, can be authorized through manage_vault_cards with no browser inputs, and can use their advertised fill operation through manage_vault_items.
  • VGS aliases are never projected. Guidance explains the broad payment-window egress boundary, isolated-browser requirement, full versus cvc_only, expiry, and merchant-outcome reconciliation.
  • VGS configuration, wallet, and card creation remains deliberately unavailable through MCP because the usable flow requires write-only PAN/CVC aliases. Creating only the config or wallet would expose a partial, unusable flow. A trusted backend must provision these through the direct API/SDK.
• GPU browser VRAM migration
  • Existing branch coverage accepts current 3GiB/6GiB values, preserves deprecated 2GiB/4GiB aliases only for compatibility, upgrades them, and returns a warning.
• Search provider removals
  • Search provider selection remains driven by the live provider list rather than hard-coding removed serpapi or valyu values.
• Customer-refreshed Link grants
  • Existing guidance covers access_token_rejected, trusted-backend token replacement, and refusal to accept secret token updates through MCP.

0.142.0 — reserved ISP IPs

manage_proxies now covers:

• ISP create pinning through nested config.ip_address
• exact proxy-list filtering by primary ISP ip_address
• moving an ISP proxy to a reserved IP
• listing reserved IPs with country/status/limit/offset
• retrieving one reserved IP and its current-project proxy references
• strict IPv4 validation
• action-specific validation so reserved-IP fields are not silently ignored
• explicit false/zero/pagination behavior in mocked tests
• no automatic SDK retry for the move operation, preserving the API's read-and-retry handling for conflicts

Config-registry recommendations that contain proxy.create.config.ip_address are preserved and documented as input to manage_proxies create.

0.143.0

No new user-facing SDK API surface required an MCP tool change.

0.144.0 — server-to-server Kernel card ingest

• add_payment_method accepts optional enrollment: "hosted" | "server" through both manage_vault_wallets and generic advertised invocation.
• Hosted enrollment keeps the 30-minute cardholder flow.
• Server enrollment returns only the safe card_ingest action URL and 5-minute expiry guidance for the trusted issuer backend.
• capture_token remains omitted.
• Payment-method projection now includes safe issuer_reference and valid_until metadata.
• The hidden raw card-ingest endpoint is not exposed as an MCP tool because it accepts card number/CVC and is specifically a trusted backend-to-vault contract.

0.145.0

• API-key tool guidance now states that delete and expire_in_days=0 rotation asynchronously end attributed browser sessions and discard unsaved profile changes, while grace-period/natural expiry does not.
• Link card/payment-request state.credential_type is projected and guidance distinguishes link_pay_token from virtual-card fill. Absence on an older ready item is treated as card behavior.

0.146.0 — replay auto-start

• manage_browsers create forwards start_replay, including explicit false, and preserves returned replay metadata.
• manage_browser_pools covers create/update defaults plus acquire-only override, including explicit false and replay metadata in compact summaries.
• manage_apps list_invocation_browsers now preserves invocation-browser replay metadata.
• Existing browser get/update/list pass-through responses retain SDK replay metadata.

0.147.0 — native OAuth preparation

The SDK changes are transport/authentication infrastructure, not model-facing resource operations. They remain in the MCP OAuth/transport layer rather than being exposed as tools. Existing auth/project selection and relay security are preserved and covered by the full test suite.

0.148.0

• Scoped live views
  • Added manage_browsers action create_live_view with read/control scope and optional bounded TTL.
  • Requires a browser selector and documents the headful-browser requirement.
  • Returns the bearer URL only to the caller with explicit handling guidance.
  • Uses maxRetries: 0; a lost response cannot mint a second unknown capability.
  • Documents that the URL cannot be revoked before browser deletion, pool release, or TTL expiry.
• Managed-auth locale
  • browser.location.locale is supported on connection create/update.
  • null is update-only and clears the locale; omission preserves/defaults correctly.
  • Per-login location overrides are rejected locally because the SDK/API does not support them.
• 1Password pacing and approval reference
  • 1pw_access_request_status accepts bounded timeout_seconds (0..120, default server behavior when omitted), forwards significant zero, and uses bounded no-retry request options.
  • Guidance describes immediate/2-second checks, later 10/20-second pacing, retry-after handling, and the 3-minute approval window.
  • expired and unknown states are described correctly.
  • access_request_reference is intentionally omitted because it carries the same sensitive request capability as the native approval URL. Mobile applications that need it must use the direct API/SDK.
• Description parity
  • Browser and pool viewport descriptions now mention the headful minimum of 64 pixels while retaining API-side validation.

Existing branch coverage retained from SDK 0.133.0-0.140.0

The pre-existing 9f2d990 branch changes remain part of the final diff and were included in review:

• mid-session save_profile with bounded wait/no-retry semantics and restart guidance
• browser naming/tags, region, location, memory/VRAM compatibility, fingerprint beta, network routes/private hosts/allowlists, conditional revisions, telemetry and archived telemetry handling
• managed-auth human-in-the-loop checkpoints, wait behavior, challenge handling, browser telemetry/settings, and safe state projection
• API-key last-use fields and sorting
• app deployment/invocation inspection, async invocation, pagination, and browser cleanup
• WebMCP custom tools, exact invocation outcomes, large input bounds, no-retry behavior, and tool_page_unloaded/unknown-outcome handling
• vault managed-auth credentials, passkey operations, 1Password account/request/fill flows, stored-token boundaries, duplicate-page selection, and safe status guidance
• Link customer-managed grants and token-refresh ownership
• Shop Pay wallet/card flows and transaction reporting
• Kernel wallets with multiple payment methods, payment requests, single-use-card read/fill support, authorization, verification recovery, fill, and transaction reporting
• safe vault response projections, hints, API diagnostics, capability-URL redaction, and no-retry write/operation behavior

Full SDK resource treatment

SDK resource family	MCP treatment
API keys	CRUD/list/rotate through manage_api_keys; one-time plaintext responses remain secret-handling responsibilities.
Apps, deployments, invocations	App discovery/invoke, deployment list/get/delete, invocation list/get, invocation browsers, and browser cleanup through manage_apps. Deployment creation and invocation update are deployment/runtime control-plane operations, not agent tools. Follow streams use bounded list/get workflows.
Audit logs/export destinations	Deliberately excluded: organization-wide security exports, binary downloads, and external destination configuration are administrative/data-export surfaces.
Auth connections/context	Connection CRUD/list/login/submit/timeline/wait through manage_auth_connections; context through get_connection_context. SSE follow is represented by bounded wait/timeline behavior. Native OAuth remains transport infrastructure.
Browser pools	Create/get/update/list/delete/acquire/release/flush through manage_browser_pools, including profiles, extensions, network, telemetry, location, replay, false/zero values, and pagination.
Browsers	Lifecycle, settings, telemetry reads, live views, and profile saves through manage_browsers; curl/fetch through browser utilities; computer, files, REPL, Playwright, shell, WebMCP, and replays through grouped tools.
Browser streams/watches/processes	Unbounded logs/watch/telemetry/process streams are deliberately represented by bounded reads or synchronous execution. Interactive process spawn/stdin/resize/status and mid-session extension loading remain direct API/SDK surfaces; extension IDs are supported at browser creation.
Computer	Batch mouse/keyboard/scroll/cursor/sleep plus clipboard, screenshot, and mouse-position coverage through computer_action.
Browser filesystem	File/dir list/info/read/write/upload/download/move/delete/permissions through manage_browser_files, with binary data converted to MCP-safe content.
Config registry	Lookup/resolve, config list, analysis list/get/cancel through manage_config_registry; SDK waitForResult is represented by explicit bounded polling.
Credential providers	CRUD/list-items/test through manage_credential_providers.
Credentials	CRUD/list/get/TOTP code through manage_credentials; vault-backed secret values remain projected or filled under vault-specific controls.
Extensions	Safe metadata list/get/delete through manage_extensions; upload/download/store-download binary/package operations are direct API/SDK workflows.
Limits/projects	Project CRUD/list and project limits get/update through manage_projects; organization entitlement/limit administration is not exposed as an agent tool.
Profiles	Setup/create, list/get/rename/delete through profile tools; binary archive download remains direct API/SDK.
Proxies/reserved IPs	Full public proxy CRUD/check/list plus reserved-IP list/get/pin/move/filter through manage_proxies.
Search	Search creation/retrieval/content fetch/provider discovery through web_search; provider slugs come from live discovery.
OTLP destinations	Deliberately excluded because endpoint/header configuration is an organization-level telemetry export and can contain credentials.
Vaults/provider configs/items	Safe vault/provider-config CRUD and item list/get/update/delete/events/advertised operations through grouped vault tools. Runtime operation names remain forward-compatible but are rechecked against available_operations.
Vault encryption key	Deliberately excluded because it is cryptographic key material.
Replay download	Start/stop/list/view metadata are exposed; binary replay download remains direct API/SDK.

Security and behavior decisions

• SDK debug logging remains disabled so request bodies containing vault secrets are not logged.
• Model-facing JSON remains compact.
• Capability URLs are returned only where they are the intended result, with recipient-specific guidance; they are not copied into logs or error text.
• capture_token, 1Password access_request_reference, provider paths/identities, resolved secret references, raw provider data, and VGS aliases remain omitted.
• Live-view minting, proxy moves, vault writes/operations, WebMCP actions, and other uncertain side effects use no automatic retry where duplicate or hidden outcomes would be unsafe.
• Project selection continues through the shared auth context and projectForOperation; organization-scoped provider-config write restrictions remain enforced.
• Entitlement/capability decisions remain server-authoritative; MCP descriptions explain gated behavior without bypassing it.
• Action-only inputs are rejected before SDK calls instead of being silently dropped.
• Significant false, 0, omitted fields, nullable update clears, pagination, and unknown outcomes are covered by mocked tests.

Deliberate exclusions

1. Raw VGS provisioning inputs — VGS provider-config/wallet/card creation requires provider credentials and PAN/CVC aliases. MCP exposes safe metadata and use of already provisioned cards, but not alias-bearing writes.
2. Raw card-ingest endpoint — accepts card number/CVC and is hidden from generated clients; only the safe issuer action URL is returned.
3. 1Password access_request_reference and direct token/reference operations — sensitive capability/token material stays in native/direct integrations.
4. Vault encryption keys and raw card/credential secrets — never model-facing.
5. Unbounded SSE/streaming and binary downloads — replaced by bounded reads or left to direct API/SDK clients.
6. Organization security exports, OTLP destinations, and organization limit administration — broad administrative/export scope with potential credential-bearing configuration.
7. Deployment creation/runtime callback updates — deployment-pipeline/server responsibilities rather than end-user agent actions.

Tests added or extended

Mocked coverage now includes:

• browser replay creation, explicit false, live-view scope/TTL/default omission/action validation/no retry
• pool replay defaults/override/metadata
• invocation-browser replay metadata
• managed-auth locale create/update/null/login rejection
• reserved-IP pin/move/list/get/filter/pagination/IPv4/action validation/no-retry move
• config-registry nested reserved-IP recommendation preservation
• hosted/server payment-method enrollment, card_ingest, safe issuer fields, capture-token omission, malformed responses, generic invocation
• Link credential_type projection
• 1Password status timeout zero/bounds/pacing/reference omission
• VGS write rejection, safe config metadata, existing wallet read, existing-card authorization, generic authorize-input rejection, cvc_only, alias omission, and egress guidance
• API-key cleanup description parity

Final diff review

• Compared against the exact $MAIN_SHA, not a moving branch.
• Tracked diff: 46 files, 4,845 insertions and 262 deletions.
• One new relevant mocked test file: src/lib/mcp/tools/config-registry.test.ts (61 lines).
• Dependency changes are limited to the expected SDK pin in package.json and bun.lock.
• No generated SDK files, unrelated package-manager locks, commits, pushes, production calls, or unrelated source edits were introduced.
• git diff --check "$MAIN_SHA" passes.

Validation

Required checks, final state:

• bun run check:managed-auth-app — passed
• bunx tsc --noEmit --incremental false — passed
• bun test — passed: 1,284 tests, 0 failures, 5,814 assertions across 83 files

Additional checks:

• git diff --check — passed
• bunx prettier --check src/lib/mcp/tools/config-registry.test.ts — passed
• Repository-wide bun run format:check — not clean due to a pre-existing repository baseline issue: it reports 191 files, including untouched src/lib/cn.ts; that file has no diff from $MAIN_SHA and independently fails the same Prettier check. No broad formatting rewrite was made.
• The documented Next.js 16 lint-script issue remains pre-existing; TypeScript and the complete Bun test suite were used for final code validation.

Validation

• Frozen Bun install
• Managed-auth App bundle check
• TypeScript type check
• Bun tests
• OAuth Redis recording check

---

Note

Medium Risk
Touches vault payment flows, live-view bearer URLs, API-key revocation side effects, and broad MCP tool contracts; mitigated by extensive tests and no-retry semantics on sensitive calls.

Overview
Bumps @onkernel/sdk to 0.148.0 and extends MCP tool contracts, schemas, and tests to mirror the new API surface.

Browsers & pools: manage_browsers gains create_live_view, save_profile, create-time fingerprint (macOS beta), start_replay, and richer responses (leased_at, replay metadata). Telemetry docs cover payment_window_expired. manage_browser_pools forwards start_replay and surfaces lease/replay metadata on acquire.

Auth & proxies: manage_auth_connections adds hitl and connection-default browser.location.locale, with wait/get guidance for AWAITING_HUMAN_INTERVENTION. manage_proxies supports reserved ISP config.ip_address, move, list/get reserved IPs, and list filtering by exit IP; config-registry lookup text notes nested pin recommendations.

Vaults & keys: Vault tools expand for Shop Pay, managed_auth credential references, safer Kernel/VGS card flows (no MCP creation of secret single-use inputs), and entitlement gating for manage_vault_payment_requests. manage_api_keys adds last_used_at sorting and documents async session cleanup on delete/immediate rotate.

Guardrails: New tool-contract.test.ts enforces description/tools/list size budgets and destructive-action hints. Playwright/REPL copy warns against retrying webmcp.invokeTool after tool_page_unloaded or uncertain outcomes.

^{Reviewed by Cursor Bugbot for commit 508e235. Bugbot is set up for automated code reviews on this repo. Configure here.}

Follow-up changes

These are human review fixes committed on top of the updater commit cabb8fd. The bot's commits are not rewritten.

• 9746ee5 Ran prettier on 8 files from this update. No content changes.

• 15ed638, 4f1448f Shortened four tool descriptions. Per-action detail now sits in the parameter descriptions, the inputs parameter, or the response guidance and notes returned after a call.

  • save_profile success responses now carry a note, and its errors append retry guidance.
  • Live-view wording now says "read or control" instead of "read-only or control-only".

  description (chars)	main	cabb8fd	now
  manage_browsers	786	2,943	1,196
  manage_vault_wallets	2,326	5,138	2,466
  manage_vault_items	9,401	12,931	9,844
  manage_vault_cards	6,705	9,755	7,778
  tools/list payload, all toolsets	199,395	233,800	225,296

• e17fd0f fingerprint no longer requires passing headless=false and gpu=false, since both default to false. Setting either to true, setting memory, or omitting stealth=true is still rejected before the API call.

• fd87e15 create_live_view with scope control and no live_view_ttl_seconds now sends a TTL of 86,400 seconds (24 hours), because control URLs cannot be revoked. The parameter description and the result note say so. Read-scope URLs keep no default.

• 508e235 Added tool-contract.test.ts. It enforces three limits:

  • Each tool description is at most 3,000 characters. Temporary capped exceptions: manage_vault_items 10,000, manage_vault_cards 8,000, manage_vault_credentials 6,100 (consent and secret-handling rules) and browser_repl 7,200 (repl helper reference).
  • The whole tools/list payload is at most 230,000 characters.
  • Any tool with a delete or remove action sets destructiveHint: true.

destructiveHint on manage_vault_wallets stays true. Before this update the tool only had create (create or retrieve) and payment_methods (read). This update adds remove_payment_method. The MCP spec reserves false for tools that only make additive updates, and every other manage_* tool with a delete or remove action uses true. The cost is that clients which confirm destructive tools will also prompt for wallet create and payment_methods. Avoiding that would mean moving add/remove into their own tool.

Not changed: parsing of manage_vault_items invoke inputs. It was not replaced with a lookup table. Later code uses each operation's typed parsed inputs, so a table would need casts or a new union type. Also, only 4 of the 9 parsed operations have tests that pin their invalid-input errors.

Open question for the vault owner: manage_vault_wallets add_payment_method with enrollment: "server" returns a single-use card_ingest bearer URL into the model's context. The guidance says to send it only to the issuer's backend, but in an MCP chat the model or the user is the only way to deliver it. Should server enrollment be exposed through MCP at all? This PR does not change it.

Validation: bunx tsc --noEmit passes; bun test passes all 1,289 tests; prettier --check "src/**/*.ts" passes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Nov 13, 2026 7:15pm UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 6a89cbd. Configure here.}

[rgarcia]

cc @hiroTamada

[bmsaadat]

Smoke tested the Shop Pay changes against the prod API with a local build of this branch: wallet connect, card create, spec refusals, authorize at checkout, Shop approval, fill, a real $1 purchase on Kernel's Stripe link, and confirm_transaction (card consumed). All passed.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​onkernel/​sdk@​0.141.0 ⏵ 0.148.0	-5		+1	+1

View full report