[kernel-internal]

Summary

• Update @onkernel/sdk to 0.148.0.

Coverage

MCP coverage report for @onkernel/sdk 0.148.0

Review basis

• MCP checkout: /home/runner/work/kernel-node-sdk/kernel-node-sdk/mcp
• Exact comparison base: dbecf093f5601415c5c5a726d32782cda67c2c84 ($MAIN_SHA)
• SDK version: 0.148.0, pinned exactly in both package.json and bun.lock
• Runtime/package manager: Bun 1.3.3
• SDK audit inputs:
  • ../sdk/CHANGELOG.md, ../sdk/api.md, and generated resource sources
  • complete generated method/parameter inventory: /home/runner/work/_temp/sdk-method-params.md
  • SDK and OpenAPI release diffs, including /home/runner/work/_temp/sdk-diff.patch, /home/runner/work/_temp/openapi-diff.patch, and the v0.140.0..v0.148.0 SDK comparison
• Final tracked diff reviewed from $MAIN_SHA: /home/runner/work/_temp/mcp-final-main.diff
• New untracked test reviewed separately: /home/runner/work/_temp/mcp-final-untracked.diff

Result

The MCP server now has user-facing treatment for the SDK 0.141.0 through 0.148.0 changes while retaining the branch's existing 0.133.0 through 0.140.0 coverage. New capabilities are mapped into existing grouped tools rather than creating unnecessary one-off tools. Sensitive or unbounded SDK surfaces are either represented by a safer MCP workflow or deliberately excluded below.

No production API calls were made. Tests use injected clients or mocked HTTP responses.

Coverage added or synchronized for SDK 0.141.0-0.148.0

0.141.0

• VGS customer-managed payments
  • Safe metadata for existing VGS provider configurations is now projected by manage_vault_provider_configs list/get, including environment and vault_id, without returning secrets.
  • Existing API-created VGS wallets remain inspectable with manage_vault_items.
  • Existing API-created VGS cards remain inspectable, preserve card_mode, can be authorized through manage_vault_cards with no browser inputs, and can use their advertised fill operation through manage_vault_items.
  • VGS aliases are never projected. Guidance explains the broad payment-window egress boundary, isolated-browser requirement, full versus cvc_only, expiry, and merchant-outcome reconciliation.
  • VGS configuration, wallet, and card creation remains deliberately unavailable through MCP because the usable flow requires write-only PAN/CVC aliases. Creating only the config or wallet would expose a partial, unusable flow. A trusted backend must provision these through the direct API/SDK.
• GPU browser VRAM migration
  • Existing branch coverage accepts current 3GiB/6GiB values, preserves deprecated 2GiB/4GiB aliases only for compatibility, upgrades them, and returns a warning.
• Search provider removals
  • Search provider selection remains driven by the live provider list rather than hard-coding removed serpapi or valyu values.
• Customer-refreshed Link grants
  • Existing guidance covers access_token_rejected, trusted-backend token replacement, and refusal to accept secret token updates through MCP.

0.142.0 — reserved ISP IPs

manage_proxies now covers:

• ISP create pinning through nested config.ip_address
• exact proxy-list filtering by primary ISP ip_address
• moving an ISP proxy to a reserved IP
• listing reserved IPs with country/status/limit/offset
• retrieving one reserved IP and its current-project proxy references
• strict IPv4 validation
• action-specific validation so reserved-IP fields are not silently ignored
• explicit false/zero/pagination behavior in mocked tests
• no automatic SDK retry for the move operation, preserving the API's read-and-retry handling for conflicts

Config-registry recommendations that contain proxy.create.config.ip_address are preserved and documented as input to manage_proxies create.

0.143.0

No new user-facing SDK API surface required an MCP tool change.

0.144.0 — server-to-server Kernel card ingest

• add_payment_method accepts optional enrollment: "hosted" | "server" through both manage_vault_wallets and generic advertised invocation.
• Hosted enrollment keeps the 30-minute cardholder flow.
• Server enrollment returns only the safe card_ingest action URL and 5-minute expiry guidance for the trusted issuer backend.
• capture_token remains omitted.
• Payment-method projection now includes safe issuer_reference and valid_until metadata.
• The hidden raw card-ingest endpoint is not exposed as an MCP tool because it accepts card number/CVC and is specifically a trusted backend-to-vault contract.

0.145.0

• API-key tool guidance now states that delete and expire_in_days=0 rotation asynchronously end attributed browser sessions and discard unsaved profile changes, while grace-period/natural expiry does not.
• Link card/payment-request state.credential_type is projected and guidance distinguishes link_pay_token from virtual-card fill. Absence on an older ready item is treated as card behavior.

0.146.0 — replay auto-start

• manage_browsers create forwards start_replay, including explicit false, and preserves returned replay metadata.
• manage_browser_pools covers create/update defaults plus acquire-only override, including explicit false and replay metadata in compact summaries.
• manage_apps list_invocation_browsers now preserves invocation-browser replay metadata.
• Existing browser get/update/list pass-through responses retain SDK replay metadata.

0.147.0 — native OAuth preparation

The SDK changes are transport/authentication infrastructure, not model-facing resource operations. They remain in the MCP OAuth/transport layer rather than being exposed as tools. Existing auth/project selection and relay security are preserved and covered by the full test suite.

0.148.0

• Scoped live views
  • Added manage_browsers action create_live_view with read/control scope and optional bounded TTL.
  • Requires a browser selector and documents the headful-browser requirement.
  • Returns the bearer URL only to the caller with explicit handling guidance.
  • Uses maxRetries: 0; a lost response cannot mint a second unknown capability.
  • Documents that the URL cannot be revoked before browser deletion, pool release, or TTL expiry.
• Managed-auth locale
  • browser.location.locale is supported on connection create/update.
  • null is update-only and clears the locale; omission preserves/defaults correctly.
  • Per-login location overrides are rejected locally because the SDK/API does not support them.
• 1Password pacing and approval reference
  • 1pw_access_request_status accepts bounded timeout_seconds (0..120, default server behavior when omitted), forwards significant zero, and uses bounded no-retry request options.
  • Guidance describes immediate/2-second checks, later 10/20-second pacing, retry-after handling, and the 3-minute approval window.
  • expired and unknown states are described correctly.
  • access_request_reference is intentionally omitted because it carries the same sensitive request capability as the native approval URL. Mobile applications that need it must use the direct API/SDK.
• Description parity
  • Browser and pool viewport descriptions now mention the headful minimum of 64 pixels while retaining API-side validation.

Existing branch coverage retained from SDK 0.133.0-0.140.0

The pre-existing 9f2d990 branch changes remain part of the final diff and were included in review:

• mid-session save_profile with bounded wait/no-retry semantics and restart guidance
• browser naming/tags, region, location, memory/VRAM compatibility, fingerprint beta, network routes/private hosts/allowlists, conditional revisions, telemetry and archived telemetry handling
• managed-auth human-in-the-loop checkpoints, wait behavior, challenge handling, browser telemetry/settings, and safe state projection
• API-key last-use fields and sorting
• app deployment/invocation inspection, async invocation, pagination, and browser cleanup
• WebMCP custom tools, exact invocation outcomes, large input bounds, no-retry behavior, and tool_page_unloaded/unknown-outcome handling
• vault managed-auth credentials, passkey operations, 1Password account/request/fill flows, stored-token boundaries, duplicate-page selection, and safe status guidance
• Link customer-managed grants and token-refresh ownership
• Shop Pay wallet/card flows and transaction reporting
• Kernel wallets with multiple payment methods, payment requests, single-use-card read/fill support, authorization, verification recovery, fill, and transaction reporting
• safe vault response projections, hints, API diagnostics, capability-URL redaction, and no-retry write/operation behavior

Full SDK resource treatment

SDK resource family	MCP treatment
API keys	CRUD/list/rotate through manage_api_keys; one-time plaintext responses remain secret-handling responsibilities.
Apps, deployments, invocations	App discovery/invoke, deployment list/get/delete, invocation list/get, invocation browsers, and browser cleanup through manage_apps. Deployment creation and invocation update are deployment/runtime control-plane operations, not agent tools. Follow streams use bounded list/get workflows.
Audit logs/export destinations	Deliberately excluded: organization-wide security exports, binary downloads, and external destination configuration are administrative/data-export surfaces.
Auth connections/context	Connection CRUD/list/login/submit/timeline/wait through manage_auth_connections; context through get_connection_context. SSE follow is represented by bounded wait/timeline behavior. Native OAuth remains transport infrastructure.
Browser pools	Create/get/update/list/delete/acquire/release/flush through manage_browser_pools, including profiles, extensions, network, telemetry, location, replay, false/zero values, and pagination.
Browsers	Lifecycle, settings, telemetry reads, live views, and profile saves through manage_browsers; curl/fetch through browser utilities; computer, files, REPL, Playwright, shell, WebMCP, and replays through grouped tools.
Browser streams/watches/processes	Unbounded logs/watch/telemetry/process streams are deliberately represented by bounded reads or synchronous execution. Interactive process spawn/stdin/resize/status and mid-session extension loading remain direct API/SDK surfaces; extension IDs are supported at browser creation.
Computer	Batch mouse/keyboard/scroll/cursor/sleep plus clipboard, screenshot, and mouse-position coverage through computer_action.
Browser filesystem	File/dir list/info/read/write/upload/download/move/delete/permissions through manage_browser_files, with binary data converted to MCP-safe content.
Config registry	Lookup/resolve, config list, analysis list/get/cancel through manage_config_registry; SDK waitForResult is represented by explicit bounded polling.
Credential providers	CRUD/list-items/test through manage_credential_providers.
Credentials	CRUD/list/get/TOTP code through manage_credentials; vault-backed secret values remain projected or filled under vault-specific controls.
Extensions	Safe metadata list/get/delete through manage_extensions; upload/download/store-download binary/package operations are direct API/SDK workflows.
Limits/projects	Project CRUD/list and project limits get/update through manage_projects; organization entitlement/limit administration is not exposed as an agent tool.
Profiles	Setup/create, list/get/rename/delete through profile tools; binary archive download remains direct API/SDK.
Proxies/reserved IPs	Full public proxy CRUD/check/list plus reserved-IP list/get/pin/move/filter through manage_proxies.
Search	Search creation/retrieval/content fetch/provider discovery through web_search; provider slugs come from live discovery.
OTLP destinations	Deliberately excluded because endpoint/header configuration is an organization-level telemetry export and can contain credentials.
Vaults/provider configs/items	Safe vault/provider-config CRUD and item list/get/update/delete/events/advertised operations through grouped vault tools. Runtime operation names remain forward-compatible but are rechecked against available_operations.
Vault encryption key	Deliberately excluded because it is cryptographic key material.
Replay download	Start/stop/list/view metadata are exposed; binary replay download remains direct API/SDK.

Security and behavior decisions

• SDK debug logging remains disabled so request bodies containing vault secrets are not logged.
• Model-facing JSON remains compact.
• Capability URLs are returned only where they are the intended result, with recipient-specific guidance; they are not copied into logs or error text.
• capture_token, 1Password access_request_reference, provider paths/identities, resolved secret references, raw provider data, and VGS aliases remain omitted.
• Live-view minting, proxy moves, vault writes/operations, WebMCP actions, and other uncertain side effects use no automatic retry where duplicate or hidden outcomes would be unsafe.
• Project selection continues through the shared auth context and projectForOperation; organization-scoped provider-config write restrictions remain enforced.
• Entitlement/capability decisions remain server-authoritative; MCP descriptions explain gated behavior without bypassing it.
• Action-only inputs are rejected before SDK calls instead of being silently dropped.
• Significant false, 0, omitted fields, nullable update clears, pagination, and unknown outcomes are covered by mocked tests.

Deliberate exclusions

1. Raw VGS provisioning inputs — VGS provider-config/wallet/card creation requires provider credentials and PAN/CVC aliases. MCP exposes safe metadata and use of already provisioned cards, but not alias-bearing writes.
2. Raw card-ingest endpoint — accepts card number/CVC and is hidden from generated clients; only the safe issuer action URL is returned.
3. 1Password access_request_reference and direct token/reference operations — sensitive capability/token material stays in native/direct integrations.
4. Vault encryption keys and raw card/credential secrets — never model-facing.
5. Unbounded SSE/streaming and binary downloads — replaced by bounded reads or left to direct API/SDK clients.
6. Organization security exports, OTLP destinations, and organization limit administration — broad administrative/export scope with potential credential-bearing configuration.
7. Deployment creation/runtime callback updates — deployment-pipeline/server responsibilities rather than end-user agent actions.

Tests added or extended

Mocked coverage now includes:

• browser replay creation, explicit false, live-view scope/TTL/default omission/action validation/no retry
• pool replay defaults/override/metadata
• invocation-browser replay metadata
• managed-auth locale create/update/null/login rejection
• reserved-IP pin/move/list/get/filter/pagination/IPv4/action validation/no-retry move
• config-registry nested reserved-IP recommendation preservation
• hosted/server payment-method enrollment, card_ingest, safe issuer fields, capture-token omission, malformed responses, generic invocation
• Link credential_type projection
• 1Password status timeout zero/bounds/pacing/reference omission
• VGS write rejection, safe config metadata, existing wallet read, existing-card authorization, generic authorize-input rejection, cvc_only, alias omission, and egress guidance
• API-key cleanup description parity

Final diff review

• Compared against the exact $MAIN_SHA, not a moving branch.
• Tracked diff: 46 files, 4,845 insertions and 262 deletions.
• One new relevant mocked test file: src/lib/mcp/tools/config-registry.test.ts (61 lines).
• Dependency changes are limited to the expected SDK pin in package.json and bun.lock.
• No generated SDK files, unrelated package-manager locks, commits, pushes, production calls, or unrelated source edits were introduced.
• git diff --check "$MAIN_SHA" passes.

Validation

Required checks, final state:

• bun run check:managed-auth-app — passed
• bunx tsc --noEmit --incremental false — passed
• bun test — passed: 1,284 tests, 0 failures, 5,814 assertions across 83 files

Additional checks:

• git diff --check — passed
• bunx prettier --check src/lib/mcp/tools/config-registry.test.ts — passed
• Repository-wide bun run format:check — not clean due to a pre-existing repository baseline issue: it reports 191 files, including untouched src/lib/cn.ts; that file has no diff from $MAIN_SHA and independently fails the same Prettier check. No broad formatting rewrite was made.
• The documented Next.js 16 lint-script issue remains pre-existing; TypeScript and the complete Bun test suite were used for final code validation.

Validation

• Frozen Bun install
• Managed-auth App bundle check
• TypeScript type check
• Bun tests
• OAuth Redis recording check

---

Note

Medium Risk
Touches payment vault authorization, unrevokable live-view URLs, browser restarts on profile save, and no-retry proxy/vault writes—areas where duplicate or mishandled calls can have real side effects.

Overview
Bumps @onkernel/sdk from 0.141.0 to 0.148.0 and expands the MCP tool surface to match the new API: reserved ISP proxy pinning/moves/listing, browser save_profile and scoped create_live_view, replay start_replay on browsers/pools/apps, managed-auth HITL and locale, API-key last_used_at sorting, and richer vault flows (Shop Pay, payment_request items, managed_auth credentials).

manage_vault_payment_requests is added and entitlement-gated alongside other vault tools. manage_browsers gains create-only fingerprint (macOS beta), leased_at / replay metadata pass-through, and telemetry docs for payment_window_expired. manage_proxies and manage_config_registry document nested config.ip_address for reserved exits. Vault card/wallet tooling is tightened around what must not be created via MCP (VGS aliases, raw single-use card ingest, etc.) while still supporting safe read/authorize/fill paths where the API allows.

Tests and registration/annotation expectations are updated across the affected tools.

^{Reviewed by Cursor Bugbot for commit cabb8fd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Nov 12, 2026 9:17pm UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 6a89cbd. Configure here.}

[rgarcia]

cc @hiroTamada

[bmsaadat]

Smoke tested the Shop Pay changes against the prod API with a local build of this branch: wallet connect, card create, spec refusals, authorize at checkout, Shop approval, fill, a real $1 purchase on Kernel's Stripe link, and confirm_transaction (card consumed). All passed.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​onkernel/​sdk@​0.141.0 ⏵ 0.148.0	-5		+1	+1

View full report