fix(mcp): use undici fetch directly in pinned-fetch for typed dispatcher

Replace `globalThis.fetch` + double-cast with `undici.fetch` so the
`dispatcher` option is part of the real type contract. This guarantees
pinning won't silently break if a future runtime swaps the underlying
fetch implementation.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/mcp/pinned-fetch.test.ts

@@ -1,43 +1,38 @@
 /**
  * @vitest-environment node
  */
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockAgent, mockCreatePinnedLookup, mockFetch, capturedAgentOptions } = vi.hoisted(() => {
-  const capturedAgentOptions: unknown[] = []
-  class MockAgent {
-    constructor(options: unknown) {
-      capturedAgentOptions.push(options)
+const { mockAgent, mockCreatePinnedLookup, mockUndiciFetch, capturedAgentOptions } = vi.hoisted(
+  () => {
+    const capturedAgentOptions: unknown[] = []
+    class MockAgent {
+      constructor(options: unknown) {
+        capturedAgentOptions.push(options)
+      }
+    }
+    return {
+      mockAgent: MockAgent,
+      mockCreatePinnedLookup: vi.fn(),
+      mockUndiciFetch: vi.fn(),
+      capturedAgentOptions,
     }
   }
-  return {
-    mockAgent: MockAgent,
-    mockCreatePinnedLookup: vi.fn(),
-    mockFetch: vi.fn(),
-    capturedAgentOptions,
-  }
-})
+)
 
-vi.mock('undici', () => ({ Agent: mockAgent }))
+vi.mock('undici', () => ({ Agent: mockAgent, fetch: mockUndiciFetch }))
 vi.mock('@/lib/core/security/input-validation.server', () => ({
   createPinnedLookup: mockCreatePinnedLookup,
 }))
 
-import { createMcpPinnedFetch } from './pinned-fetch'
+import { createMcpPinnedFetch } from '@/lib/mcp/pinned-fetch'
 
 describe('createMcpPinnedFetch', () => {
-  const originalFetch = globalThis.fetch
-
   beforeEach(() => {
     vi.clearAllMocks()
     capturedAgentOptions.length = 0
     mockCreatePinnedLookup.mockReturnValue('pinned-lookup-fn')
-    globalThis.fetch = mockFetch as unknown as typeof fetch
-    mockFetch.mockResolvedValue(new Response('ok'))
-  })
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch
+    mockUndiciFetch.mockResolvedValue(new Response('ok'))
   })
 
   it('builds an undici Agent with the pinned lookup for the resolved IP', () => {
@@ -50,8 +45,8 @@ describe('createMcpPinnedFetch', () => {
   it('forwards the dispatcher on every fetch call', async () => {
     const fetchLike = createMcpPinnedFetch('203.0.113.10')
     await fetchLike('https://example.com/mcp', { method: 'POST' })
-    expect(mockFetch).toHaveBeenCalledTimes(1)
-    const [url, init] = mockFetch.mock.calls[0]
+    expect(mockUndiciFetch).toHaveBeenCalledTimes(1)
+    const [url, init] = mockUndiciFetch.mock.calls[0]
     expect(url).toBe('https://example.com/mcp')
     expect((init as { dispatcher?: unknown }).dispatcher).toBeInstanceOf(mockAgent)
     expect((init as { method?: string }).method).toBe('POST')
@@ -65,7 +60,7 @@ describe('createMcpPinnedFetch', () => {
       headers: { 'x-test': '1' },
       signal: controller.signal,
     })
-    const init = mockFetch.mock.calls[0][1] as RequestInit & { dispatcher?: unknown }
+    const init = mockUndiciFetch.mock.calls[0][1] as RequestInit & { dispatcher?: unknown }
     expect(init.headers).toEqual({ 'x-test': '1' })
     expect(init.signal).toBe(controller.signal)
     expect(init.dispatcher).toBeInstanceOf(mockAgent)
@@ -74,7 +69,7 @@ describe('createMcpPinnedFetch', () => {
   it('handles undefined init gracefully', async () => {
     const fetchLike = createMcpPinnedFetch('203.0.113.10')
     await fetchLike('https://example.com/mcp')
-    const init = mockFetch.mock.calls[0][1] as { dispatcher?: unknown }
+    const init = mockUndiciFetch.mock.calls[0][1] as { dispatcher?: unknown }
     expect(init.dispatcher).toBeInstanceOf(mockAgent)
   })
 
@@ -83,8 +78,8 @@ describe('createMcpPinnedFetch', () => {
     await fetchLike('https://example.com/a')
     await fetchLike('https://example.com/b')
     expect(capturedAgentOptions).toHaveLength(1)
-    const d1 = (mockFetch.mock.calls[0][1] as { dispatcher: unknown }).dispatcher
-    const d2 = (mockFetch.mock.calls[1][1] as { dispatcher: unknown }).dispatcher
+    const d1 = (mockUndiciFetch.mock.calls[0][1] as { dispatcher: unknown }).dispatcher
+    const d2 = (mockUndiciFetch.mock.calls[1][1] as { dispatcher: unknown }).dispatcher
     expect(d1).toBe(d2)
   })
 })

apps/sim/lib/mcp/pinned-fetch.ts

@@ -1,5 +1,5 @@
 import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
-import { Agent } from 'undici'
+import { Agent, type RequestInit as UndiciRequestInit, fetch as undiciFetch } from 'undici'
 import { createPinnedLookup } from '@/lib/core/security/input-validation.server'
 
 /**
@@ -9,6 +9,10 @@ import { createPinnedLookup } from '@/lib/core/security/input-validation.server'
  * fetch then forces every subsequent request (initial POST, SSE GET, redirects)
  * to use that same IP, regardless of what the hostname now resolves to.
  *
+ * Uses undici's `fetch` directly so the `dispatcher` option is part of the
+ * real type contract — not a cast that would silently break if a future
+ * runtime swapped out the implementation.
+ *
  * The original hostname is preserved on the request so TLS SNI and the Host
  * header continue to match the certificate.
  */
@@ -17,9 +21,16 @@ export function createMcpPinnedFetch(resolvedIP: string): FetchLike {
     connect: { lookup: createPinnedLookup(resolvedIP) },
   })
 
-  return (url, init) =>
-    globalThis.fetch(url, {
-      ...(init ?? {}),
+  return (async (url, init) => {
+    // DOM `RequestInit` and undici's `RequestInit` are structurally compatible
+    // at runtime (Node's global fetch IS undici) but differ in TS types.
+    // Cast the init through unknown to bridge the typing without losing the
+    // critical `dispatcher` typing on the call itself.
+    const undiciInit: UndiciRequestInit = {
+      ...(init as unknown as UndiciRequestInit),
       dispatcher,
-    } as RequestInit & { dispatcher: Agent })
+    }
+    const response = await undiciFetch(url as string | URL, undiciInit)
+    return response as unknown as Response
+  }) satisfies FetchLike
 }