feat(mesh): render user names via USER_GET tool

[tlgimenes]

What

• Add USER_GET management MCP tool to fetch user profile info (name/email/avatar) behind auth and org membership checks.
• Update collection table to render created_by / updated_by via .
• Switch UI user lookup from REST to MCP tool calls (no /api/users route).

Why

Show human-friendly user info in collection tables instead of raw user ids, without exposing user data outside authenticated MCP access.

Testing

• Visited http://localhost:3000/gimenes/mcps/conn_DFUjqzmD3ErfcXAmFoofK?tab=WORKFLOW and confirmed Created by / Updated by render the correct user.

---

Summary by cubic

Show user names and avatars in collection tables via a secured USER_GET MCP tool, replacing REST user lookups. Improves readability while enforcing org-scoped access.

• New Features

  • Added USER_GET tool and UserStorage (Better Auth table) with shared-organization checks.
  • component and useUserById hook fetch profile (id/name/email/image); collections render *_by fields.
  • Registered tool in the mesh and query keys; 5-minute cache via React Query.

• Refactors

  • Wired users storage into context and tests; updated seed with auth fields.
  • Removed reliance on /api/users.

^{Written for commit fab4397. Summary will update on new commits.}

---

Note

Shows human-friendly user info in collection tables via a secure MCP tool.

• Add USER_GET tool with Zod I/O and org-shared access checks; implement UserStorage querying Better Auth user table; wire into MeshContext storage
• Register tool in tool registry/index and tests; add “Users” category/labels
• Frontend: new useUserById hook and User component; update collections list to render created_by/updated_by using User; add React Query key user
• Seed updates to Better Auth user fields (emailVerified, image, banned fields) to support lookups

^{Written by Cursor Bugbot for commit fab4397. This will update automatically on new commits. Configure here.}

[github-actions]

🧪 Benchmark

Should we run the MCP Gateway benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Should a new version be published when this PR is merged?

React with an emoji to vote on the release type:

Reaction	Type	Next Version
👍	Prerelease	1.0.18-alpha.1
🎉	Patch	1.0.18
❤️	Minor	1.1.0
🚀	Major	2.0.0

Current version: 1.0.17

Deployment

• Deploy to production (triggers ArgoCD sync after Docker image is published)

[cubic-dev-ai]

3 issues found across 18 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/mesh/src/storage/user.ts">

<violation number="1" location="apps/mesh/src/storage/user.ts:72">
P2: Type assertion `as User &amp; { image?: string }` has no effect here because the function&#39;s declared return type is `Promise&lt;User | null&gt;`. Callers won&#39;t have type-safe access to the `image` field. Either update the return type to `Promise&lt;(User &amp; { image?: string }) | null&gt;`, or define a separate `UserWithImage` type.</violation>
</file>

<file name="apps/mesh/src/web/hooks/use-user.ts">

<violation number="1" location="apps/mesh/src/web/hooks/use-user.ts:33">
P2: Query runs even when `userId` is empty. Add `enabled: !!userId` to prevent unnecessary API calls with invalid user IDs.</violation>
</file>

<file name="apps/mesh/src/web/components/user/user.tsx">

<violation number="1" location="apps/mesh/src/web/components/user/user.tsx:47">
P2: The `Avatar.Skeleton` should receive the `size` prop to match the actual avatar size and prevent layout shift when loading completes. Currently it defaults to `&quot;base&quot;` (40×40px) while the avatar uses `&quot;xs&quot;` (24×24px).</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.