fix(mcp): authenticate lazily instead of polling idle accounts

[tpetr]

Linear, Slack, and Notion MCP adapters currently retrieve Coder credentials at startup, every 30 seconds while idle, and in a redundant preflight before upstream requests. Coder can validate tokens against the provider, making these idle checks a source of unnecessary API traffic.

Authenticate on demand when the client lists or calls tools. Remove the startup probe, idle timer, and redundant preflight; retain fresh credential acquisition on every upstream HTTP request, with no credential cache. Unlinked or rejected credentials still hide tools and return linking guidance on the next request.

Account linking no longer triggers proactive discovery while idle. Clients that cached an empty tool list need to refresh tools or reconnect after linking; the module READMEs document this tradeoff. Deploy the updated modules and restart MCP processes to replace already-running polling adapters.

Validation:

• All 55 adapter/installer tests passed with mocked providers, including idle-time checks, exact credential-acquisition counts, and stale-tool calls after unlinking.
• terraform fmt -check and all 18 mocked Terraform tests passed across the three modules.
• No live provider tools were called or account data changed. This change removes a known traffic source; it does not establish the cause of the observed Linear quota exhaustion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T21:18:32.900902Z	255f42d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.