How to use Devin to cache revocation-aware MCP auth
Devin cached derived MCP roles while checking fresh access epochs on every request, fixed a restoration gap and shipped revocation tests in a merged Kody PR.
github.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Implement a token-keyed derived-role cache while checking fresh user status and organization access epochs on every request. Increment epochs in the same database batch as permission changes. Test token revocation, membership removal, deleted/restored organizations, and revoked owners so caching never keeps stale access. Present the security invariants and results for review.
Reach people exploring AI agents
See placements →What happened
A token-keyed derived-auth cache with fresh epoch checks, restoration correction and revocation coverage merged into Kody on October 12, 2026.
Reported by devin-ai-integration[bot] on GitHubHow the agent did it
- Every request checked fresh user status and organization epochs before using cached roles.
- Permission mutations bumped access epochs in the same database batch.
- The agent corrected organization restoration and added revocation-focused guards.
Where a person stepped in
The public PR records task constraints and automated review or checks. Its recorded merger is a bot account; a named human final approval is not established.
Devin implemented a token-keyed authentication cache for Kody while keeping permission revocation immediate. The task targeted repeated database work in MCP requests, but the recorded requirement prohibited a time-to-live cache that could preserve access after a role or grant changed.
The implementation cached derived roles and organization bindings inside each isolate. Every request still read fresh user status and organization access epochs. A cached result could be reused only when those epochs matched and the organization remained live. Changes to roles, membership, grants and teams bumped the epoch in the same database batch as the mutation.
The investigation uncovered a restoration edge case: restoring an organization could revive its old epoch and accidentally reuse pre-deletion permissions. Devin changed that path and added mutation guards and targeted coverage, including revoked-owner behavior. Token revocation continued to fail before consulting the cache.
The pull request merged on October 12 through kody-bot. This establishes a shipped implementation with recorded review constraints and checks, while the source does not establish an independent security audit or identify a human approving the final merge.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: GitHub · devin-ai-integration[bot]
Frequently asked questions
What prevents stale access?
Every request compares current organization access epochs before reusing the derived authorization cache.
Why was restoration changed?
Restoring an old epoch could revive pre-deletion cached permissions.
Who merged the change?
The public PR records kody-bot merging it on October 12, 2026.
More details
About this account
The implementation cached derived roles and organization bindings inside each isolate. Every request still read fresh user status and organization access epochs. A cached result could be reused only when those epochs matched and the organization remained live. Changes to roles, membership, grants and teams bumped the epoch in the same database batch as the mutation.
Primary agent-authored PR and public API opened. Results and checks are reported by the PR, not independently reproduced. Bot merge is not evidence of human review. Prompt is suggested by Agents In Use, not a quoted original.
Credit: devin-ai-integration[bot] on GitHub
Source published 11 Oct 2026
Source checked 14 Oct 2026
Tools and topics
Devin · GitHub · Cloudflare Workers
Repository maintenance · Recorded checks
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.