[AUTO] Adding MCP Servers docs update - #1191
Closed
github-actions[bot] wants to merge 10 commits into
Closed
github-actions[bot] wants to merge 10 commits into
github-actions[bot] wants to merge 10 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
5 tasks
* docs: add AWS MCP Server remote connection guide Mirrors the other remote MCP server guides. AWS's setup is DCR-based like Atlassian: no manual OAuth app, Client ID/Secret, Authorization URL, and Token URL all stay empty in Arcade. Access is governed entirely by IAM: authorizing an agent grants no additional AWS permissions, every tool call runs under the authorizing identity's existing IAM policies, and the guide leads with this since it's the whole security model. No Arcade AWS toolkit exists today, so this is framed as a fixed-surface, currently-only-path guide (same tier as Dynamics 365 and Atlassian), not a customer-extensible one. Does not document the non-interactive SigV4/client-credentials path (single shared machine identity, doesn't fit Arcade's per-user OAuth model) by design. BLOCKED ON AWS: Arcade's redirect URI is not yet on AWS Sign-In's DCR allowlist as of this commit (verified against AWS's live docs). This PR is opened as a draft until AWS completes that change; see PR description for the verification method and result. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * 🤖 Regenerate LLMs.txt * docs: drop the DCR-allowlist setup step from the AWS guide This step only made sense while Arcade wasn't yet on AWS Sign-In's DCR allowlist. Once that gate clears, there's nothing for a reader to confirm here, so it becomes dead weight in Set up AWS. The troubleshooting entry for the same failure mode stays, since that's a standard "if you see this error, here's why" reference regardless of when it occurs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: correct the AWS MCP Server region example and DCR troubleshooting The guide used us-west-2 as its worked example, inherited from AWS's own CloudTrail samples, but that endpoint does not resolve. Only us-east-1 and eu-central-1 are served today, so a reader following the example verbatim got a DNS failure rather than anything the guide accounted for. Point the example at a region that resolves and name the unserved-region failure mode. AWS's published Supported Redirect URIs table also lags their actual DCR allowlist: Arcade is approved and working, but absent from that table. The troubleshooting entry told readers to verify against it, which now fails for someone whose setup is correct. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: stop pointing readers at AWS's redirect URI table AWS's published table lags their actual DCR allowlist, so sending a reader there to verify Arcade's redirect URI gives a misleading answer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: drop semicolon in AWS DCR troubleshooting entry Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * 🤖 Regenerate LLMs.txt --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: arcade-docs-bot[bot] <321924871+arcade-docs-bot[bot]@users.noreply.github.com>
arcade-docs-bot
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 15, 2026 11:18
6e24bdb to
7fb526c
Compare
* docs: document all 11 Salesforce MCP custom OAuth scopes The toolkit requests four write/read scopes that were missing from the auth provider page, and the samples told people to pass only read_account. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: mark Salesforce org subdomain as a placeholder in auth endpoints Co-authored-by: Cursor <cursoragent@cursor.com> * docs: keep Salesforce subdomain placeholders visible in MDX Angle brackets were parsed as HTML tags, so the preview dropped them from the auth endpoint URLs. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Valerie Fanelle <valeriefanelle@mac.local.meter> Co-authored-by: Cursor <cursoragent@cursor.com>
arcade-docs-bot
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 16, 2026 11:19
62ec9c4 to
4ff96be
Compare
* docs: tell admins to keep Claude's detected connector defaults Claude's Add custom connector dialog now shows Authentication and OAuth client options. The Detected values already match Arcade Auth, so operators should leave them selected. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: replace Claude connector screenshot and capitalize Authenticate Use the full Add custom connector dialog (api.arcade.dev, request headers visible) and sentence-case the auth step heading. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: crop leftover chrome from the Claude connector screenshot Co-authored-by: Cursor <cursoragent@cursor.com> * docs: rename Claude connector screenshot to bust the image cache Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Valerie Fanelle <valeriefanelle@Valeries-MacBook-Pro.local> Co-authored-by: Cursor <cursoragent@cursor.com>
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 16, 2026 20:42
96ec7b1 to
c75c0f1
Compare
* ci: open automation PRs with GITHUB_TOKEN instead of Docs Bot Drop the GitHub App token helper and generate llms.txt in the toolkit docs workflow so automation PRs no longer depend on a second workflow starting from the bot push. Co-authored-by: Anirudh Kamath <kamath@users.noreply.github.com> * fix: avoid Biome noTemplateCurlyInString in workflow test The assertion for github.token used a GitHub Actions expression inside a regular string, which Ultracite flagged as a leftover template placeholder. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Anirudh Kamath <kamath@users.noreply.github.com>
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 17, 2026 11:18
c75c0f1 to
b8b6f88
Compare
) * docs: add the reference topology diagram to the architecture page Adds a "Reference topology" section to Platform architecture with the Whimsical topology export, so readers see the whole deployment before the page walks through each service. The export has a baked-in white background, so it keeps a light canvas in both themes rather than inverting, which would wreck the node fills. The card border, ring, and caption are theme-aware instead, which frames the white panel as deliberate in dark mode. The diagram is too dense to read at the prose column width, so it links to the full-size PNG and breaks out of the article padding on md and up. ~ 🎹 Evanescence, Evan's Agent * docs: add padding around the topology diagram Bumps the figure's inner padding from p-3 to p-4, and to p-6 at md and up, so the diagram has room to breathe inside the white card. ~ 🎹 Evanescence, Evan's Agent
Swaps in the new export, which adds the diagram title and a key marking the tool calling hot path and the arcade deploy path. The file is JPEG data despite the .png name it arrived with, so it lands as .jpg rather than lying about its format. Re-encoding it to real PNG was the other option, but that doubles the file to 3.8MB and recovers no detail, since the JPEG artifacts are already baked in. Intrinsic dimensions go to 7800x4280. Same aspect ratio as before, so the layout is unchanged. The alt text picks up the application and worker plane split and the key. ~ 🎹 Evanescence, Evan's Agent
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 18, 2026 11:17
b8b6f88 to
f2d1ee9
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit f2d1ee9. Configure here.
| token: ${{ steps.app-token.outputs.token }} | ||
| author: ${{ steps.app-token.outputs.committer }} | ||
| committer: ${{ steps.app-token.outputs.committer }} | ||
| token: ${{ github.token }} |
There was a problem hiding this comment.
Auto-PRs skip required CI checks
High Severity
Replacing the GitHub App token with github.token stops Test from running on the automation/toolkit-docs PR. Generated JSON, sidebar _meta.tsx, and llms.txt skip lint, typecheck, and build, and required status checks will block merge. The design-system workflow already gates on a local build for this reason.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit f2d1ee9. Configure here.
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 19, 2026 11:15
f2d1ee9 to
249a04c
Compare
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 20, 2026 11:15
249a04c to
6c2d6da
Compare
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 21, 2026 11:18
6c2d6da to
9845299
Compare
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 22, 2026 11:18
9845299 to
465774d
Compare
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 22, 2026 21:40
465774d to
4f64bcc
Compare
* docs(cli): document installation contexts The CLI can now sign in to more than one Arcade installation and switch between them, and nothing in the reference said so. Neither page mentioned contexts or `arcade login --url` at all. The login section explains signing in to a self-hosted installation by URL, and logout now says that it signs out of the active context rather than all of them. A new `arcade context` section covers the noun itself and each of its subcommands, plus the `--context` flag and `ARCADE_CONTEXT` for targeting one installation from a script without changing which is active. The cheat sheet gains a contexts section and two environment variables, with the caveat that both are read at startup and so cannot come from a project's `.env` file. The existing section tells readers to put variables there, which is right for the others and wrong for these two. Command output is copied from --help rather than written by hand, matching how the rest of the page is built. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(cli): refresh the help output for context-aware commands The reference page carries --help output verbatim, and seven commands had changed since it was captured. deploy no longer shows --host at all, and secret, server, show, dashboard, org and project now say the active context supplies the default. A reader following the old page would pass a host to commands that no longer need one, and look for a flag deploy no longer advertises. The cheat sheet's global flags listed --host as the way to reach the Engine with no mention of contexts. It now names --context and says --host falls back to the active one. Left alone: 'arcade configure --host local|arcade', which selects which server to configure, and 'arcade mcp --host', which is a bind address. Same spelling, different flags. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Update wording --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 23, 2026 11:18
4f64bcc to
4d9706a
Compare
* docs(contextual-access): document group-based tool access Adds the public configuration page for the group_access extension, alongside the existing rate-limiting page: how visibility gating is enforced, tool matcher precedence, the three identity backends, Dashboard and API setup, the staleness model, and fail-closed behavior. Two things get more space than their size suggests, because both fail silently rather than loudly: - identity matching. The backend looks a caller up by the identity the request carries, so an Arcade user ID that does not equal the directory login matches nothing, and fail-closed turns that into tools quietly missing. - SailPoint's API client rights. `idn:access-profiles:read` and `idn:roles:read` sound correct and are not sufficient; they authorize reading definitions rather than assignments, so a client with only those authenticates and then fails every lookup. Also records that a tool no rule matches stays visible, so a mistyped matcher governs nothing instead of hiding everything. Refs PLT-3234. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * 🤖 Regenerate LLMs.txt * docs(contextual-access): how to name an Entra group in a rule The page said a required group is a group name for both Okta and Entra ID. That is no longer accurate for Entra: a rule may carry the group's object ID, and a display name is honoured only for a security group that is not a Microsoft 365 group. The reason is worth an operator's attention rather than a footnote. Entra does not require display names to be unique and many tenants let ordinary members create groups, so a display-name rule can be satisfied by someone who creates a group with that name and joins it. Restricting the match to ordinary security groups removes the surface most members can add to but is not a guarantee, so the page recommends the object ID for anything sensitive and says where to copy it from. Also notes that this does not apply to Okta or SailPoint, where creating a group, access profile, or role is an administrative action. Refs PLT-3234. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(contextual-access): a SailPoint access profile is named by its ID The page said rules match access profile and role names. That is right for a role and wrong for an access profile, and wrong in a way that would send an operator to configure something that cannot work. SailPoint's access-items response documents `displayName` as the role display name on a role, but as the identity's display name on an access profile, and it carries no access profile name at all. There is nothing for a profile-name rule to match, so the rule carries the profile's ID. The page now states which value each rule shape matches, says where to copy the ID from, and explains why we do not resolve names for you: it would need `idn:access-profiles:read`, which the required-rights section deliberately excludes. Refs PLT-3234. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(contextual-access): a SailPoint role or access profile can be named or ID'd An earlier revision said an access profile had to be named by its ID, on the strength of SailPoint's SDK documenting `displayName` as the identity's display name on an access-profile row. Checked against a live tenant, that field carries the access profile's own name and varies from row to row, so profiles are nameable and requiring an ID was stricter than the product needs. Both kinds can now be named either way, with IDs recommended for anything sensitive because they cannot collide and survive a rename. The callout explains the one rule that keeps both tenant behaviours safe: a name equal to the caller's own identity display name is never a match. Also drops the note about `idn:access-profiles:read`, which is no longer relevant now that no name-to-ID resolution is needed. Refs PLT-3234. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(contextual-access): mark group-based tool access as Early Access The feature ships off by default behind a per-organization flag, so the page has to say so: without it a reader follows the Dashboard steps and finds no group access type in the picker, or calls the API and gets a 403, with nothing telling them why. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(group-access): stop presenting the caller identity as an email The page described caller matching in terms of an email differing "in case or domain from the directory login", which reads as though Arcade expects an email and compares it. It does neither: the value is passed to the directory untouched, and the directory decides what it matches against. Adds a table of what each backend actually does with it, including that SailPoint tries the identity's email or its alias — which of those carries a login is a property of how a directory was populated, not of SailPoint. Also documents two things operators could previously only discover by experiment: - group names match exactly, including case, while tool matchers do not. A mis-cased matcher governs nothing, whereas a loosely matched group widens who satisfies the rule, so the asymmetry is deliberate. Group IDs fold case, because an ID is opaque. - every backend accepts a name or an ID for a required group. Okta previously took only a name, so the page said so; it now takes either. * 🤖 Regenerate LLMs.txt * docs(group-access): tone pass, and correct permissions and editing behavior Rewrite in the voice of the neighboring rate-limiting page: state behavior plainly, drop the rationale asides and internal implementation detail, and cut the page by about a quarter. Corrections: - Add Okta and Entra ID permission sections. Entra needs GroupMember.Read.All; User.Read.All alone returns groups without names, so name rules never match. - SailPoint needs exactly two rights; access-profile and role reads are not needed. - Remove the claim that the membership cache TTL can be lowered. It is fixed at five minutes (configurability tracked in PLT-3702). - Editing now requires the secret again when the backend, a URL, the tenant ID or the client ID changes. - Document the Dashboard toggle for allow_on_unavailable. - Drop the unverified timing claim and the provisioned-groups recommendation. Refs PLT-3234. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: arcade-docs-bot[bot] <321924871+arcade-docs-bot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
github-actions
Bot
force-pushed
the
automation/toolkit-docs
branch
from
September 24, 2026 11:19
4d9706a to
25e6f81
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was generated after a Porter deploy succeeded.
Note
Medium Risk
CI changes how automated PRs authenticate and bundle llms.txt generation; misconfiguration could break the toolkit docs pipeline or omit llms.txt from auto-PRs. English-only removal of translation workflows is a behavioral change for localized URLs, though redirects mitigate breakage.
Overview
This automation PR makes the docs site English-only, refreshes toolkit/MCP documentation, and simplifies GitHub Actions around doc generation.
Localization: Removes Spanish and Brazilian Portuguese dictionaries, the translation banner, client dictionary loading, and the
translate-docsworkflow pluspnpm translate.getDictionaryalways loads English; legacy/esand/pt-BRpaths still redirect to/enviaproxy.ts.CI/CD: Deletes the shared
app-tokenaction and Context7 refresh workflow. Toolkit doc generation now runspnpm llmstxtin the same job (needsOPENAI_API_KEY) so automation PRs stay self-contained whenGITHUB_TOKENdoes not trigger other workflows. PR/commit steps usegithub.tokenandgithub-actions[bot]instead of the docs GitHub App. Manual runs can passpublic_catalog_url; Anthropic model names are pinned in the workflow.New and updated docs: Adds Group-Based Tool Access, AWS remote MCP Server, and a reference topology figure on platform architecture. Expands Claude Desktop / gateway guidance (Detected auth defaults, CIMD). Updates Arcade CLI reference and cheat sheet for installation contexts and
login --url. Tightens Salesforce custom OAuth scopes. Sidebar adds Calendly and Workday integrations.Also regenerates
public/llms.txt, updates README env copy to.env.local.example, and dropscontext7.json.Reviewed by Cursor Bugbot for commit 25e6f81. Bugbot is set up for automated code reviews on this repo. Configure here.