[kernel-internal]

Summary

• Update @onkernel/sdk to 0.132.0.

Coverage

MCP coverage report

Added or updated coverage

• Audited the complete SDK 0.132.0 surface: 178 public methods across 39 resource files. The release diff adds only APIKey.last_used_at; it contains no method, request-parameter, nested-option, enum, pagination, streaming, or signature changes.
• manage_api_keys actions list and get already return SDK API-key objects without field projection, so last_used_at is now exposed automatically through APIKeys.list and APIKeys.retrieve responses.
• Added a mocked MCP test proving both a timestamp and null survive list pagination and get response handling in compact JSON.
• The complete method/parameter audit found no missing user-facing coverage in the registered tool families. The existing matrix remains 137 represented methods or intentional MCP equivalents and 41 deliberate exclusions.

Description updates

• Updated the manage_api_keys tool description for OpenAPI schema field ApiKey.last_used_at: list/get responses carry an approximate last-authentication timestamp accurate within about 20 minutes, or null when the key has not authenticated a request since last-use tracking began.
• No other OpenAPI summary or description changed in this release.

Intentional exclusions

The prior deliberate exclusions remain unchanged because SDK 0.132.0 adds no methods or request parameters:

• Organization compliance/observability/limit administration (15): audit-log listing, all audit export-destination methods, model-facing entitlement retrieval, organization-limit retrieval/update, and all OTLP destination methods. These require an explicit organization-admin/security product decision and separate secret-safe toolsets.
• Binary/archive/raw transport or secret material (11): audit export/download, raw browser fetch, multipart browser extension loading, replay download, deployment authoring, extension archive upload/download paths, profile archive download, and vault encryption-key retrieval.
• Streaming or interactive subsystems (14): managed-auth follow, filesystem watch, browser logs, the six interactive process methods beyond one-shot exec, browser telemetry stream, deployment follow, and invocation follow. MCP uses bounded reads or one-shot operations instead.
• Internal lifecycle callback (1): invocation update is for app-runtime state completion, not an end-user control.

Validation

• Bun: 1.3.3.
• bun run check:managed-auth-app: passed.
• bunx tsc --noEmit --incremental false: passed.
• bun test: passed — 1110 tests, 0 failures, 4921 expectations across 77 files.
• Changed TypeScript files pass targeted Prettier checking, and git diff --check is clean.
• Reviewed the complete diff against origin/main. No production API calls or real resources were used.
• Validation limitations: none for the requested checks.

Validation

• Frozen Bun install
• Managed-auth App bundle check
• TypeScript type check
• Bun tests
• OAuth Redis recording check

---

Note

Medium Risk
Broad exposure of security-sensitive controls (API key policy/rotate, vault passkeys, network allowlist mutations) with validation layers, but behavior delegates to the Kernel SDK rather than new server-side auth logic.

Overview
Bumps @onkernel/sdk from 0.126.0 to 0.132.0 and expands the MCP tool layer so agents can use the newer API surface with stricter Zod validation and action-scoped parameter guards.

API keys gain rotate, policy-scoped create, expiry options, richer list/get filters, and documented last_used_at on responses. Browsers and pools add memory/region (including us-west), multi-extension extensions arrays, full telemetry (plus platform in the catalog), location overrides, get_telemetry event_types, and conditional allowlist updates. Apps add list_invocations, delete_invocation_browsers, async invoke timeout, and location on invocation browsers. Managed auth adds login-only skill_mode and expanded browser telemetry (storage). Smaller parity updates cover proxies (id_or_name), extensions get, list query/name filters across resources, exec_command env/as_user, vault passkey / add_fields / remove_fields, and rejecting deprecated max_pooled_sessions.

Several tools adopt injectable McpDependencies for tests; coverage is expanded with SDK-parity unit tests across the touched tools.

^{Reviewed by Cursor Bugbot for commit 3c43e48. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 27, 2026 2:18pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​onkernel/​sdk@​0.126.0 ⏵ 0.132.0	+6		+1	+1

View full report

[cursor]

Stale Bugbot comment from a previous run.

[meliaj]

reviewed the sdk 0.131.0 parity changes. three things worth a look, the first two are the ones i'd fix before merging:

Bugs

• src/lib/mcp/tools/api-keys.ts:211-222 — rotate accepts expires_at and policy but never forwards them, and returns success.

  • repro: rotate {api_key_id: "k1", expires_at: "2027-01-01T00:00:00Z", policy: {...}} returns a new plaintext key, and the sdk is called as rotate("k1", {}).
  • the sdk's rotate only takes days_to_expire and expire_in_days, so the replacement key silently reuses the old key's lifetime (or never expires), and policy is dropped.
  • fix: return an error when expires_at or policy is set on any action other than create, and when expire_in_days is set on any action other than rotate. a test for each would cover it.

• src/lib/mcp/tools/browser-pools.ts:136 — region is only read in the create builder, and tags is only read in the acquire path, so both are silently ignored on the other actions.

  • repro: update {id_or_name: "p", region: "us-west", size: 5} succeeds and the sdk gets {size: 5}. update with region alone fails with "at least one update field is required", which hides the real cause. tags is dropped the same way on create and update.
  • fix: reject region on update and tags on create/update the same way expected_network and save_profile_changes already are in buildPoolCreateParams / buildPoolUpdateParams, with tests.
  • nit: memory, video_memory and region in manage_browsers have the same problem on update, so worth fixing in the same pass.

Compatibility

• src/lib/mcp/vault-responses.ts:257 — the new field !== null check changes the output for existing fields, not just agent_wallet_step_up.action_url.
  • repro: projecting {type: "card", action: {name: "x", url: null}} gives action: {name: "x"} on main and action: {name: "x", url: null} on this branch.
  • any item response with a null url-class field now has "key": null where the key used to be omitted. i didn't find a test that pins the old shape.
  • consider scoping the null passthrough to the new action_url field, or adding a test that documents the shape change if it's intended.

[vercel]

Additional Suggestion:

The manage_browsers update action silently ignores the create-only fields memory, video_memory, and region instead of rejecting them, hiding the real cause behind a misleading "at least one update field is required" error.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a8c8036. Configure here.}

[rgarcia]

@meliaj thanks. All three are addressed in the latest commit on this branch:

• rotate dropping expires_at / policy: manage_api_keys now returns error: expires_at and policy are create-only. for those on any action other than create, and error: expire_in_days is rotate-only. for expire_in_days outside rotate. Tests cover rotate, update and create, and check the SDK isn't called.
• Ignored region / tags on pools: tags is rejected on create and update (acquire-only), and region on update, including region alone, which used to report "at least one update field is required". manage_browsers update now rejects memory, video_memory and region as creation-only.
• Null URL passthrough: scoped to action_url. A null action.url is omitted again, as on main. A new test pins both shapes.

The 12 new tests fail without the fixes. bun test (1122 pass), tsc and Prettier pass locally.

[meliaj]

approving at e975199. it fixes the three issues from my earlier review.

fixed

• manage_api_keys: expires_at and policy are rejected unless the action is create, and expire_in_days unless it is rotate. rotate no longer returns a key with a different lifetime than the caller asked for.
• manage_browser_pools: tags is rejected on create and update, and region on update. a lone region on update now gets a clear error instead of "at least one update field is required".
• manage_browsers: memory, video_memory and region are rejected on update.
• vault responses: a null URL is only passed through for action_url, so other null URL fields are omitted as before.

how i tested

• read the commit diff and its tests. each new test asserts the SDK is not called.
• bunx tsc --noEmit is clean and bun test src/lib/mcp passes (995 tests, 0 failures). i did not run the full bun test or read the CI logs.
• ran probes against the real code on this head: the link card schema accepts amount: 50000 and rejects 50001 and 500000, and the vault projection drops unknown keys and an unsafe action_url while keeping the allowlisted fields.
• checked the passkey result schema and the link user-info allowlist against the 0.132.0 SDK types. both match.

scope

this approval covers the fix commit and the earlier findings only. i did not re-review the rest of the diff against 0.132.0.

non-blocking follow-ups

• docs/vault-payments.md:595 still describes a separate pay-token amount limit, but the schema now caps all link card amounts at 50000. worth rewording, and worth a changelog note since 50001–500000 is now rejected.
• smaller gaps of the same kind: days_to_expire and project_id on non-create api-key actions, tags and region on other pool actions, and gpu on browser update are still silently ignored.
• the passkey parse-failure message could add "if this was arm_passkey, invoke disarm_passkey".