fix(search): reuse managed MCP sessions within operations

[waleedlatif1]

Summary

• Reuse one unpooled MCP connection for each authorized Search or document-read operation, then close it on completion or failure.
• Preserve current grant/configuration checks before and after every call, complete tool discovery, read-only schemas, request limits, cancellation and final document verification.
• Clarify that keyword-only Lucid and Notion search cannot enumerate an account; ask for a title or topic instead of guessing keywords.

Type of Change

• Bug fix

Testing

• Full root test gate passed: 19 workspace tasks, including 34,595 app tests; 25 existing app skips.
• 43 real Postgres/Redis integration checks across managed Search sessions, managed OAuth and outbound organization scope. The new suite uses actual MCP SDK HTTP transport and authorized Search/read operations.
• A controlled complete search/read failed the connection-count check before the fix (8 initializations) and passed afterward (2). Initial samples with a 150 ms initialization delay were 1.75 s and 0.66 s; these are fixture measurements, not live-provider latency claims.
• Seven independent guard-removal controls failed their intended tests; sources restored. Coverage includes revocation, token rotation, separate member grants, cancellation, incomplete discovery and cleanup failures. The concurrent-query case returns distinct documents through one connection and rejects a serialized-query mutation.
• 26 workspace type checks, lint, 57 audits, generators and registry/docs checks passed. Global pooling, workflow MCP execution and deadlines are unchanged.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 2, 2026 9:04am UTC

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Fix all with cubic | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High risk] Refactors MCP session lifecycle and connection pooling.

The PR appears safe to merge; the prior concurrent-query coverage gap is resolved and no new actionable issue was found.

Summary

The PR reuses an operation-owned managed MCP session for Search and document reads, then closes it when the operation finishes. Since the previous review, it adds concurrent-query integration coverage and closes each HubSpot live-test session. The previously reported coverage gap is addressed; its thread is resolved.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Authorized Search or read] --> B[Open managed MCP session]
  B --> C[Discover tools]
  C --> D[Run operation calls]
  D --> E[Verify current access and results]
  E --> F[Close session]

Loading

_{Reviews (2) · Last reviewed commit: "fix(search): close acceptance sessions a..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}