Merge remote-tracking branch 'origin/main' into feat/tool-plugin-oauth

# Conflicts:
#	api/controllers/console/workspace/tool_providers.py
#	api/core/tools/entities/api_entities.py
#	api/core/tools/tool_manager.py
#	api/core/tools/utils/configuration.py
#	api/services/tools/tools_transform_service.py

api/services/account_service.py

@@ -16,7 +16,7 @@ from configs import dify_config
 from constants.languages import language_timezone_mapping, languages
 from events.tenant_event import tenant_was_created
 from extensions.ext_database import db
-from extensions.ext_redis import redis_client
+from extensions.ext_redis import redis_client, redis_fallback
 from libs.helper import RateLimiter, TokenManager
 from libs.passport import PassportService
 from libs.password import compare_password, hash_password, valid_password
@@ -495,6 +495,7 @@ class AccountService:
         return account
 
     @staticmethod
+    @redis_fallback(default_return=None)
     def add_login_error_rate_limit(email: str) -> None:
         key = f"login_error_rate_limit:{email}"
         count = redis_client.get(key)
@@ -504,6 +505,7 @@ class AccountService:
         redis_client.setex(key, dify_config.LOGIN_LOCKOUT_DURATION, count)
 
     @staticmethod
+    @redis_fallback(default_return=False)
     def is_login_error_rate_limit(email: str) -> bool:
         key = f"login_error_rate_limit:{email}"
         count = redis_client.get(key)
@@ -516,11 +518,13 @@ class AccountService:
         return False
 
     @staticmethod
+    @redis_fallback(default_return=None)
     def reset_login_error_rate_limit(email: str):
         key = f"login_error_rate_limit:{email}"
         redis_client.delete(key)
 
     @staticmethod
+    @redis_fallback(default_return=None)
     def add_forgot_password_error_rate_limit(email: str) -> None:
         key = f"forgot_password_error_rate_limit:{email}"
         count = redis_client.get(key)
@@ -530,6 +534,7 @@ class AccountService:
         redis_client.setex(key, dify_config.FORGOT_PASSWORD_LOCKOUT_DURATION, count)
 
     @staticmethod
+    @redis_fallback(default_return=False)
     def is_forgot_password_error_rate_limit(email: str) -> bool:
         key = f"forgot_password_error_rate_limit:{email}"
         count = redis_client.get(key)
@@ -542,11 +547,13 @@ class AccountService:
         return False
 
     @staticmethod
+    @redis_fallback(default_return=None)
     def reset_forgot_password_error_rate_limit(email: str):
         key = f"forgot_password_error_rate_limit:{email}"
         redis_client.delete(key)
 
     @staticmethod
+    @redis_fallback(default_return=False)
     def is_email_send_ip_limit(ip_address: str):
         minute_key = f"email_send_ip_limit_minute:{ip_address}"
         freeze_key = f"email_send_ip_limit_freeze:{ip_address}"

api/services/audio_service.py

@@ -1,13 +1,17 @@
 import io
 import logging
 import uuid
+from collections.abc import Generator
 from typing import Optional
 
+from flask import Response, stream_with_context
 from werkzeug.datastructures import FileStorage
 
 from constants import AUDIO_EXTENSIONS
 from core.model_manager import ModelManager
 from core.model_runtime.entities.model_entities import ModelType
+from extensions.ext_database import db
+from models.enums import MessageStatus
 from models.model import App, AppMode, AppModelConfig, Message
 from services.errors.audio import (
     AudioTooLargeServiceError,
@@ -16,6 +20,7 @@ from services.errors.audio import (
     ProviderNotSupportTextToSpeechServiceError,
     UnsupportedAudioTypeServiceError,
 )
+from services.workflow_service import WorkflowService
 
 FILE_SIZE = 30
 FILE_SIZE_LIMIT = FILE_SIZE * 1024 * 1024
@@ -74,35 +79,36 @@ class AudioService:
         voice: Optional[str] = None,
         end_user: Optional[str] = None,
         message_id: Optional[str] = None,
+        is_draft: bool = False,
     ):
-        from collections.abc import Generator
-
-        from flask import Response, stream_with_context
-
         from app import app
-        from extensions.ext_database import db
 
-        def invoke_tts(text_content: str, app_model: App, voice: Optional[str] = None):
+        def invoke_tts(text_content: str, app_model: App, voice: Optional[str] = None, is_draft: bool = False):
             with app.app_context():
-                if app_model.mode in {AppMode.ADVANCED_CHAT.value, AppMode.WORKFLOW.value}:
-                    workflow = app_model.workflow
-                    if workflow is None:
-                        raise ValueError("TTS is not enabled")
+                if voice is None:
+                    if app_model.mode in {AppMode.ADVANCED_CHAT.value, AppMode.WORKFLOW.value}:
+                        if is_draft:
+                            workflow = WorkflowService().get_draft_workflow(app_model=app_model)
+                        else:
+                            workflow = app_model.workflow
+                        if (
+                            workflow is None
+                            or "text_to_speech" not in workflow.features_dict
+                            or not workflow.features_dict["text_to_speech"].get("enabled")
+                        ):
+                            raise ValueError("TTS is not enabled")
 
-                    features_dict = workflow.features_dict
-                    if "text_to_speech" not in features_dict or not features_dict["text_to_speech"].get("enabled"):
-                        raise ValueError("TTS is not enabled")
+                        voice = workflow.features_dict["text_to_speech"].get("voice")
+                    else:
+                        if not is_draft:
+                            if app_model.app_model_config is None:
+                                raise ValueError("AppModelConfig not found")
+                            text_to_speech_dict = app_model.app_model_config.text_to_speech_dict
 
-                    voice = features_dict["text_to_speech"].get("voice") if voice is None else voice
-                else:
-                    if app_model.app_model_config is None:
-                        raise ValueError("AppModelConfig not found")
-                    text_to_speech_dict = app_model.app_model_config.text_to_speech_dict
+                            if not text_to_speech_dict.get("enabled"):
+                                raise ValueError("TTS is not enabled")
 
-                    if not text_to_speech_dict.get("enabled"):
-                        raise ValueError("TTS is not enabled")
-
-                    voice = text_to_speech_dict.get("voice") if voice is None else voice
+                            voice = text_to_speech_dict.get("voice")
 
                 model_manager = ModelManager()
                 model_instance = model_manager.get_default_model_instance(
@@ -132,18 +138,18 @@ class AudioService:
             message = db.session.query(Message).filter(Message.id == message_id).first()
             if message is None:
                 return None
-            if message.answer == "" and message.status == "normal":
+            if message.answer == "" and message.status == MessageStatus.NORMAL:
                 return None
 
             else:
-                response = invoke_tts(message.answer, app_model=app_model, voice=voice)
+                response = invoke_tts(text_content=message.answer, app_model=app_model, voice=voice, is_draft=is_draft)
                 if isinstance(response, Generator):
                     return Response(stream_with_context(response), content_type="audio/mpeg")
                 return response
         else:
             if text is None:
                 raise ValueError("Text is required")
-            response = invoke_tts(text, app_model, voice)
+            response = invoke_tts(text_content=text, app_model=app_model, voice=voice, is_draft=is_draft)
             if isinstance(response, Generator):
                 return Response(stream_with_context(response), content_type="audio/mpeg")
             return response

api/services/file_service.py

@@ -18,6 +18,7 @@ from core.file import helpers as file_helpers
 from core.rag.extractor.extract_processor import ExtractProcessor
 from extensions.ext_database import db
 from extensions.ext_storage import storage
+from libs.helper import extract_tenant_id
 from models.account import Account
 from models.enums import CreatorUserRole
 from models.model import EndUser, UploadFile
@@ -61,11 +62,7 @@ class FileService:
         # generate file key
         file_uuid = str(uuid.uuid4())
 
-        if isinstance(user, Account):
-            current_tenant_id = user.current_tenant_id
-        else:
-            # end_user
-            current_tenant_id = user.tenant_id
+        current_tenant_id = extract_tenant_id(user)
 
         file_key = "upload_files/" + (current_tenant_id or "") + "/" + file_uuid + "." + extension
 

api/services/ops_service.py

@@ -34,6 +34,24 @@ class OpsService:
         )
         new_decrypt_tracing_config = OpsTraceManager.obfuscated_decrypt_token(tracing_provider, decrypt_tracing_config)
 
+        if tracing_provider == "arize" and (
+            "project_url" not in decrypt_tracing_config or not decrypt_tracing_config.get("project_url")
+        ):
+            try:
+                project_url = OpsTraceManager.get_trace_config_project_url(decrypt_tracing_config, tracing_provider)
+                new_decrypt_tracing_config.update({"project_url": project_url})
+            except Exception:
+                new_decrypt_tracing_config.update({"project_url": "https://app.arize.com/"})
+
+        if tracing_provider == "phoenix" and (
+            "project_url" not in decrypt_tracing_config or not decrypt_tracing_config.get("project_url")
+        ):
+            try:
+                project_url = OpsTraceManager.get_trace_config_project_url(decrypt_tracing_config, tracing_provider)
+                new_decrypt_tracing_config.update({"project_url": project_url})
+            except Exception:
+                new_decrypt_tracing_config.update({"project_url": "https://app.phoenix.arize.com/projects/"})
+
         if tracing_provider == "langfuse" and (
             "project_key" not in decrypt_tracing_config or not decrypt_tracing_config.get("project_key")
         ):
@@ -76,6 +94,16 @@ class OpsService:
                 new_decrypt_tracing_config.update({"project_url": project_url})
             except Exception:
                 new_decrypt_tracing_config.update({"project_url": "https://wandb.ai/"})
+
+        if tracing_provider == "aliyun" and (
+            "project_url" not in decrypt_tracing_config or not decrypt_tracing_config.get("project_url")
+        ):
+            try:
+                project_url = OpsTraceManager.get_trace_config_project_url(decrypt_tracing_config, tracing_provider)
+                new_decrypt_tracing_config.update({"project_url": project_url})
+            except Exception:
+                new_decrypt_tracing_config.update({"project_url": "https://arms.console.aliyun.com/"})
+
         trace_config_data.tracing_config = new_decrypt_tracing_config
         return trace_config_data.to_dict()
 
@@ -107,7 +135,9 @@ class OpsService:
             return {"error": "Invalid Credentials"}
 
         # get project url
-        if tracing_provider == "langfuse":
+        if tracing_provider in ("arize", "phoenix"):
+            project_url = OpsTraceManager.get_trace_config_project_url(tracing_config, tracing_provider)
+        elif tracing_provider == "langfuse":
             project_key = OpsTraceManager.get_trace_config_project_key(tracing_config, tracing_provider)
             project_url = "{host}/project/{key}".format(host=tracing_config.get("host"), key=project_key)
         elif tracing_provider in ("langsmith", "opik"):

api/services/tools/mcp_tools_mange_service.py

@@ -0,0 +1,231 @@
+import hashlib
+import json
+from datetime import datetime
+from typing import Any
+
+from sqlalchemy import or_
+from sqlalchemy.exc import IntegrityError
+
+from core.helper import encrypter
+from core.mcp.error import MCPAuthError, MCPError
+from core.mcp.mcp_client import MCPClient
+from core.tools.entities.api_entities import ToolProviderApiEntity
+from core.tools.entities.common_entities import I18nObject
+from core.tools.entities.tool_entities import ToolProviderType
+from core.tools.mcp_tool.provider import MCPToolProviderController
+from core.tools.utils.configuration import ProviderConfigEncrypter
+from extensions.ext_database import db
+from models.tools import MCPToolProvider
+from services.tools.tools_transform_service import ToolTransformService
+
+UNCHANGED_SERVER_URL_PLACEHOLDER = "[__HIDDEN__]"
+
+
+class MCPToolManageService:
+    """
+    Service class for managing mcp tools.
+    """
+
+    @staticmethod
+    def get_mcp_provider_by_provider_id(provider_id: str, tenant_id: str) -> MCPToolProvider:
+        res = (
+            db.session.query(MCPToolProvider)
+            .filter(MCPToolProvider.tenant_id == tenant_id, MCPToolProvider.id == provider_id)
+            .first()
+        )
+        if not res:
+            raise ValueError("MCP tool not found")
+        return res
+
+    @staticmethod
+    def get_mcp_provider_by_server_identifier(server_identifier: str, tenant_id: str) -> MCPToolProvider:
+        res = (
+            db.session.query(MCPToolProvider)
+            .filter(MCPToolProvider.tenant_id == tenant_id, MCPToolProvider.server_identifier == server_identifier)
+            .first()
+        )
+        if not res:
+            raise ValueError("MCP tool not found")
+        return res
+
+    @staticmethod
+    def create_mcp_provider(
+        tenant_id: str,
+        name: str,
+        server_url: str,
+        user_id: str,
+        icon: str,
+        icon_type: str,
+        icon_background: str,
+        server_identifier: str,
+    ) -> ToolProviderApiEntity:
+        server_url_hash = hashlib.sha256(server_url.encode()).hexdigest()
+        existing_provider = (
+            db.session.query(MCPToolProvider)
+            .filter(
+                MCPToolProvider.tenant_id == tenant_id,
+                or_(
+                    MCPToolProvider.name == name,
+                    MCPToolProvider.server_url_hash == server_url_hash,
+                    MCPToolProvider.server_identifier == server_identifier,
+                ),
+            )
+            .first()
+        )
+        if existing_provider:
+            if existing_provider.name == name:
+                raise ValueError(f"MCP tool {name} already exists")
+            elif existing_provider.server_url_hash == server_url_hash:
+                raise ValueError(f"MCP tool {server_url} already exists")
+            elif existing_provider.server_identifier == server_identifier:
+                raise ValueError(f"MCP tool {server_identifier} already exists")
+        encrypted_server_url = encrypter.encrypt_token(tenant_id, server_url)
+        mcp_tool = MCPToolProvider(
+            tenant_id=tenant_id,
+            name=name,
+            server_url=encrypted_server_url,
+            server_url_hash=server_url_hash,
+            user_id=user_id,
+            authed=False,
+            tools="[]",
+            icon=json.dumps({"content": icon, "background": icon_background}) if icon_type == "emoji" else icon,
+            server_identifier=server_identifier,
+        )
+        db.session.add(mcp_tool)
+        db.session.commit()
+        return ToolTransformService.mcp_provider_to_user_provider(mcp_tool, for_list=True)
+
+    @staticmethod
+    def retrieve_mcp_tools(tenant_id: str, for_list: bool = False) -> list[ToolProviderApiEntity]:
+        mcp_providers = (
+            db.session.query(MCPToolProvider)
+            .filter(MCPToolProvider.tenant_id == tenant_id)
+            .order_by(MCPToolProvider.name)
+            .all()
+        )
+        return [
+            ToolTransformService.mcp_provider_to_user_provider(mcp_provider, for_list=for_list)
+            for mcp_provider in mcp_providers
+        ]
+
+    @classmethod
+    def list_mcp_tool_from_remote_server(cls, tenant_id: str, provider_id: str):
+        mcp_provider = cls.get_mcp_provider_by_provider_id(provider_id, tenant_id)
+
+        try:
+            with MCPClient(
+                mcp_provider.decrypted_server_url, provider_id, tenant_id, authed=mcp_provider.authed, for_list=True
+            ) as mcp_client:
+                tools = mcp_client.list_tools()
+        except MCPAuthError as e:
+            raise ValueError("Please auth the tool first")
+        except MCPError as e:
+            raise ValueError(f"Failed to connect to MCP server: {e}")
+        mcp_provider.tools = json.dumps([tool.model_dump() for tool in tools])
+        mcp_provider.authed = True
+        mcp_provider.updated_at = datetime.now()
+        db.session.commit()
+        user = mcp_provider.load_user()
+        return ToolProviderApiEntity(
+            id=mcp_provider.id,
+            name=mcp_provider.name,
+            tools=ToolTransformService.mcp_tool_to_user_tool(mcp_provider, tools),
+            type=ToolProviderType.MCP,
+            icon=mcp_provider.icon,
+            author=user.name if user else "Anonymous",
+            server_url=mcp_provider.masked_server_url,
+            updated_at=int(mcp_provider.updated_at.timestamp()),
+            description=I18nObject(en_US="", zh_Hans=""),
+            label=I18nObject(en_US=mcp_provider.name, zh_Hans=mcp_provider.name),
+            plugin_unique_identifier=mcp_provider.server_identifier,
+        )
+
+    @classmethod
+    def delete_mcp_tool(cls, tenant_id: str, provider_id: str):
+        mcp_tool = cls.get_mcp_provider_by_provider_id(provider_id, tenant_id)
+
+        db.session.delete(mcp_tool)
+        db.session.commit()
+
+    @classmethod
+    def update_mcp_provider(
+        cls,
+        tenant_id: str,
+        provider_id: str,
+        name: str,
+        server_url: str,
+        icon: str,
+        icon_type: str,
+        icon_background: str,
+        server_identifier: str,
+    ):
+        mcp_provider = cls.get_mcp_provider_by_provider_id(provider_id, tenant_id)
+        mcp_provider.updated_at = datetime.now()
+        mcp_provider.name = name
+        mcp_provider.icon = (
+            json.dumps({"content": icon, "background": icon_background}) if icon_type == "emoji" else icon
+        )
+        mcp_provider.server_identifier = server_identifier
+
+        if UNCHANGED_SERVER_URL_PLACEHOLDER not in server_url:
+            encrypted_server_url = encrypter.encrypt_token(tenant_id, server_url)
+            mcp_provider.server_url = encrypted_server_url
+            server_url_hash = hashlib.sha256(server_url.encode()).hexdigest()
+
+            if server_url_hash != mcp_provider.server_url_hash:
+                cls._re_connect_mcp_provider(mcp_provider, provider_id, tenant_id)
+                mcp_provider.server_url_hash = server_url_hash
+        try:
+            db.session.commit()
+        except IntegrityError as e:
+            db.session.rollback()
+            error_msg = str(e.orig)
+            if "unique_mcp_provider_name" in error_msg:
+                raise ValueError(f"MCP tool {name} already exists")
+            elif "unique_mcp_provider_server_url" in error_msg:
+                raise ValueError(f"MCP tool {server_url} already exists")
+            elif "unique_mcp_provider_server_identifier" in error_msg:
+                raise ValueError(f"MCP tool {server_identifier} already exists")
+            else:
+                raise
+
+    @classmethod
+    def update_mcp_provider_credentials(
+        cls, mcp_provider: MCPToolProvider, credentials: dict[str, Any], authed: bool = False
+    ):
+        provider_controller = MCPToolProviderController._from_db(mcp_provider)
+        tool_configuration = ProviderConfigEncrypter(
+            tenant_id=mcp_provider.tenant_id,
+            config=list(provider_controller.get_credentials_schema()),
+            provider_type=provider_controller.provider_type.value,
+            provider_identity=provider_controller.provider_id,
+        )
+        credentials = tool_configuration.encrypt(credentials)
+        mcp_provider.updated_at = datetime.now()
+        mcp_provider.encrypted_credentials = json.dumps({**mcp_provider.credentials, **credentials})
+        mcp_provider.authed = authed
+        if not authed:
+            mcp_provider.tools = "[]"
+        db.session.commit()
+
+    @classmethod
+    def _re_connect_mcp_provider(cls, mcp_provider: MCPToolProvider, provider_id: str, tenant_id: str):
+        """re-connect mcp provider"""
+        try:
+            with MCPClient(
+                mcp_provider.decrypted_server_url,
+                provider_id,
+                tenant_id,
+                authed=False,
+                for_list=True,
+            ) as mcp_client:
+                tools = mcp_client.list_tools()
+                mcp_provider.authed = True
+                mcp_provider.tools = json.dumps([tool.model_dump() for tool in tools])
+        except MCPAuthError:
+            mcp_provider.authed = False
+            mcp_provider.tools = "[]"
+        except MCPError as e:
+            raise ValueError(f"Failed to re-connect MCP server: {e}") from e
+        # reset credentials
+        mcp_provider.encrypted_credentials = "{}"

api/services/tools/tools_transform_service.py

@@ -1,11 +1,12 @@
 import json
 import logging
-from typing import Optional, Union, cast
+from typing import Any, Optional, Union, cast
 
 from yarl import URL
 
 from configs import dify_config
 from core.helper.provider_cache import ToolProviderCredentialsCache
+from core.mcp.types import Tool as MCPTool
 from core.tools.__base.tool import Tool
 from core.tools.__base.tool_runtime import ToolRuntime
 from core.tools.builtin_tool.provider import BuiltinToolProviderController
@@ -23,7 +24,7 @@ from core.tools.plugin_tool.provider import PluginToolProviderController
 from core.tools.utils.encryption import create_provider_encrypter, create_tool_provider_encrypter
 from core.tools.workflow_as_tool.provider import WorkflowToolProviderController
 from core.tools.workflow_as_tool.tool import WorkflowTool
-from models.tools import ApiToolProvider, BuiltinToolProvider, WorkflowToolProvider
+from models.tools import ApiToolProvider, BuiltinToolProvider, MCPToolProvider, WorkflowToolProvider
 
 logger = logging.getLogger(__name__)
 
@@ -54,7 +55,8 @@ class ToolTransformService:
                 return icon
             except Exception:
                 return {"background": "#252525", "content": "\ud83d\ude01"}
-
+        elif provider_type == ToolProviderType.MCP.value:
+            return icon
         return ""
 
     @staticmethod
@@ -75,10 +77,18 @@ class ToolTransformService:
                     provider.icon = ToolTransformService.get_plugin_icon_url(
                         tenant_id=tenant_id, filename=provider.icon
                     )
+                if isinstance(provider.icon_dark, str) and provider.icon_dark:
+                    provider.icon_dark = ToolTransformService.get_plugin_icon_url(
+                        tenant_id=tenant_id, filename=provider.icon_dark
+                    )
             else:
                 provider.icon = ToolTransformService.get_tool_provider_icon_url(
                     provider_type=provider.type.value, provider_name=provider.name, icon=provider.icon
                 )
+                if provider.icon_dark:
+                    provider.icon_dark = ToolTransformService.get_tool_provider_icon_url(
+                        provider_type=provider.type.value, provider_name=provider.name, icon=provider.icon_dark
+                    )
 
     @classmethod
     def builtin_provider_to_user_provider(
@@ -96,6 +106,7 @@ class ToolTransformService:
             name=provider_controller.entity.identity.name,
             description=provider_controller.entity.identity.description,
             icon=provider_controller.entity.identity.icon,
+            icon_dark=provider_controller.entity.identity.icon_dark,
             label=provider_controller.entity.identity.label,
             type=ToolProviderType.BUILT_IN,
             masked_credentials={},
@@ -163,11 +174,16 @@ class ToolTransformService:
         convert provider controller to user provider
         """
         # package tool provider controller
+        auth_type = ApiProviderAuthType.NONE
+        credentials_auth_type = db_provider.credentials.get("auth_type")
+        if credentials_auth_type in ("api_key_header", "api_key"):  # backward compatibility
+            auth_type = ApiProviderAuthType.API_KEY_HEADER
+        elif credentials_auth_type == "api_key_query":
+            auth_type = ApiProviderAuthType.API_KEY_QUERY
+
         controller = ApiToolProviderController.from_db(
             db_provider=db_provider,
-            auth_type=ApiProviderAuthType.API_KEY
-            if db_provider.credentials["auth_type"] == "api_key"
-            else ApiProviderAuthType.NONE,
+            auth_type=auth_type,
         )
 
         return controller
@@ -192,6 +208,7 @@ class ToolTransformService:
             name=provider_controller.entity.identity.name,
             description=provider_controller.entity.identity.description,
             icon=provider_controller.entity.identity.icon,
+            icon_dark=provider_controller.entity.identity.icon_dark,
             label=provider_controller.entity.identity.label,
             type=ToolProviderType.WORKFLOW,
             masked_credentials={},
@@ -202,6 +219,41 @@ class ToolTransformService:
             labels=labels or [],
         )
 
+    @staticmethod
+    def mcp_provider_to_user_provider(db_provider: MCPToolProvider, for_list: bool = False) -> ToolProviderApiEntity:
+        user = db_provider.load_user()
+        return ToolProviderApiEntity(
+            id=db_provider.server_identifier if not for_list else db_provider.id,
+            author=user.name if user else "Anonymous",
+            name=db_provider.name,
+            icon=db_provider.provider_icon,
+            type=ToolProviderType.MCP,
+            is_team_authorization=db_provider.authed,
+            server_url=db_provider.masked_server_url,
+            tools=ToolTransformService.mcp_tool_to_user_tool(
+                db_provider, [MCPTool(**tool) for tool in json.loads(db_provider.tools)]
+            ),
+            updated_at=int(db_provider.updated_at.timestamp()),
+            label=I18nObject(en_US=db_provider.name, zh_Hans=db_provider.name),
+            description=I18nObject(en_US="", zh_Hans=""),
+            server_identifier=db_provider.server_identifier,
+        )
+
+    @staticmethod
+    def mcp_tool_to_user_tool(mcp_provider: MCPToolProvider, tools: list[MCPTool]) -> list[ToolApiEntity]:
+        user = mcp_provider.load_user()
+        return [
+            ToolApiEntity(
+                author=user.name if user else "Anonymous",
+                name=tool.name,
+                label=I18nObject(en_US=tool.name, zh_Hans=tool.name),
+                description=I18nObject(en_US=tool.description, zh_Hans=tool.description),
+                parameters=ToolTransformService.convert_mcp_schema_to_parameter(tool.inputSchema),
+                labels=[],
+            )
+            for tool in tools
+        ]
+
     @classmethod
     def api_provider_to_user_provider(
         cls,
@@ -329,3 +381,53 @@ class ToolTransformService:
             is_default=provider.is_default,
             credentials=credentials,
         )
+
+    @staticmethod
+    def convert_mcp_schema_to_parameter(schema: dict) -> list["ToolParameter"]:
+        """
+        Convert MCP JSON schema to tool parameters
+
+        :param schema: JSON schema dictionary
+        :return: list of ToolParameter instances
+        """
+
+        def create_parameter(
+            name: str, description: str, param_type: str, required: bool, input_schema: dict | None = None
+        ) -> ToolParameter:
+            """Create a ToolParameter instance with given attributes"""
+            input_schema_dict: dict[str, Any] = {"input_schema": input_schema} if input_schema else {}
+            return ToolParameter(
+                name=name,
+                llm_description=description,
+                label=I18nObject(en_US=name),
+                form=ToolParameter.ToolParameterForm.LLM,
+                required=required,
+                type=ToolParameter.ToolParameterType(param_type),
+                human_description=I18nObject(en_US=description),
+                **input_schema_dict,
+            )
+
+        def process_properties(props: dict, required: list, prefix: str = "") -> list[ToolParameter]:
+            """Process properties recursively"""
+            TYPE_MAPPING = {"integer": "number", "float": "number"}
+            COMPLEX_TYPES = ["array", "object"]
+
+            parameters = []
+            for name, prop in props.items():
+                current_description = prop.get("description", "")
+                prop_type = prop.get("type", "string")
+
+                if isinstance(prop_type, list):
+                    prop_type = prop_type[0]
+                if prop_type in TYPE_MAPPING:
+                    prop_type = TYPE_MAPPING[prop_type]
+                input_schema = prop if prop_type in COMPLEX_TYPES else None
+                parameters.append(
+                    create_parameter(name, current_description, prop_type, name in required, input_schema)
+                )
+
+            return parameters
+
+        if schema.get("type") == "object" and "properties" in schema:
+            return process_properties(schema["properties"], schema.get("required", []))
+        return []