Validate vault fill inputs and pass API errors through

[rgarcia]

Summary

Four changes to the vault and browser tools, all aimed at the same problem: misshaped input was either passed through to the API verbatim or silently dropped, and the tool then layered its own guidance on top of the API's answer.

1. Strict fill inputs (manage_vault_items)

inputs for operation: "fill" was spread into the request body unvalidated. It is now parsed against a strict zod schema mirroring the API's FillVaultItemOperationRequest before any request is sent:

{ browser_id, page_url?, fields: [{ field, selector, format? }], timeout_ms? }

• browser_id non-empty; page_url an http(s) URL; fields 1–32 strict objects; format only MM/YY / MM/YYYY (the API's card-expiration option); timeout_ms 1–30000.
• Unknown keys are rejected client-side and named, e.g. unknown key "bindings" in fill inputs. expected { browser_id, page_url?, fields: [{ field, selector, format? }], timeout_ms? }.
• Only top-level keys are named in messages, consistent with the existing rule that vault validation errors never serialize values or nested keys.
• The inputs description now states the fill shape literally.

2. API errors pass through unchanged (throwVaultError)

Every vault API error previously had a fixed sentence appended, including "fill may have written some fields … so it is safe to retry", which is wrong for a request the API rejected without doing anything. Status, code, and message now pass through exactly as returned. The only added text is for a request that got no response at all (connection error, timeout, abort): no response was received from the api[ after the operation was submitted]. No retry advice.

3. Strict manage_browsers arguments

The input schema was a plain z.object, so unknown keys were dropped silently; passing vault instead of vaults created a browser with no vault attached. The schema is now strict and names the key: unknown key "vault": did you mean "vaults" (array of { id } or { name })?. This applies to every action that shares the schema; all known keys are unchanged, so update, list, get, get_telemetry, and delete behave as before.

The schema also declares an optional context string. PostHog's MCP instrumentation adds a required context argument to every tool it wraps and rejects the call if the schema doesn't accept it. Declaring it here makes PostHog skip its injection for this tool. PostHog's own intent capture only reads context for tools whose context it owns, so intent for manage_browsers is recorded from the declared field through the intentFallback option in analytics.ts ($mcp_intent_source is inferred). The value is never sent to the API: the config builders pick named fields, so context is not forwarded.

Note: prettier reindents the schema block when the object gains a second argument. git diff -w shows the real change (a helper, the context declaration, and two lines).

4. manage_vaults description

The 1password sentence said to create a browser and then request access in it. Access requests need no browser. It now matches manage_vault_items: connect the account, create the credential, request access with 1pw_create_access_request, and create a browser with the vault attached only when ready for 1pw_fill.

Tests

• bun test: 1013 pass, 0 fail (new tests for unknown fill keys, malformed fill inputs, the full fill request shape, and unknown manage_browsers keys including vault).
• browser-vaults.test.ts: a call with context set parses and succeeds for create and update, and the API request body has no context property.
• bun x tsc --noEmit: clean.
• bun x prettier --check "src/**/*.ts": clean. bun run format:check fails only on AGENTS.md, which is pre-existing on main.
• bun run lint fails on main already (next lint was removed in Next 16).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 13, 2026 9:50pm UTC

[cursor]

Stale Bugbot comment from a previous run.

[hiroTamada]

reviewed — no blocking issues found. full test suite passes (936 tests), and the TypeScript check passes.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9a0712d. Configure here.}

[vercel]

Additional Suggestion:

manage_browsers declares its own context field but is not listed in the intentFallback handler, so $mcp_intent/userIntent analytics are silently dropped for every manage_browsers call.

[hiroTamada]

reviewed — no blocking issues found. full test suite passes (941 tests), and the TypeScript check passes.