Support credential field labels

[masnwilliams]

summary

• accept validated optional labels on ordered credential field definitions
• preserve labels in display-safe credential metadata
• keep stable field names authoritative for updates and browser fill
• document labels in MCP discovery and guidance
• test labels, invalid display text, order preservation, and name-keyed fill/update flows

rollout

kernel/kernel#4214 is deployed, and this PR now uses the published @onkernel/sdk@^0.110.0 release.

testing

• bun test
• bunx tsc --noEmit
• bun run check:managed-auth-app
• Prettier on changed source files
• git diff --check

---

Note

Medium Risk
Changes the vault credential MCP contract and validation for user-facing collection forms; stable names still drive fill/update, but misconfigured clients could see new rejections or rely on labels incorrectly.

Overview
Adds optional human-readable labels on credential field definitions in manage_vault_credentials, alongside the existing stable name keys used for updates and browser fill.

Labels are validated in MCP input (non-empty, trimmed, ≤128 UTF-8 bytes, no control/formatting/line-separator characters). Invalid labels are covered by new create-path tests; tool discovery and returned credential metadata now expose label, with MCP guidance updated to clarify that labels are display-only.

@onkernel/sdk is bumped from 0.109.0 to 0.110.0 (lockfile included) to align with backend support for field labels.

^{Reviewed by Cursor Bugbot for commit 8b3520e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Sep 18, 2026 7:25pm UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 852316b. Configure here.}

[rgarcia]

reviewed — overall looks good. one documentation gap worth addressing:

Suggestion

• src/lib/mcp/tools/vault-credentials.ts:33-37 — consider documenting the runtime label constraints in MCP discovery: trimmed, ≤128 UTF-8 bytes, and no control/format characters. Otherwise invalid labels receive only the generic schema error.

[masnwilliams]

addressed the label-discovery suggestion in c04f44a: the MCP schema now lists the trim, UTF-8 byte limit, and disallowed-character constraints, with a discovery regression test.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​onkernel/​sdk@​0.109.0 ⏵ 0.110.0	+1		+1	+1

View full report