fix(server): scope Agent Builder model list to connected providers (#17725)

Co-authored-by: Mastra Code (anthropic/claude-opus-4-8) <noreply@mastra.ai>

Author: roaminro

.changeset/purple-adults-find.md

@@ -0,0 +1,5 @@
+---
+'@mastra/server': patch
+---
+
+Fixed the Agent Builder selecting models from providers with no API key configured. The builder available-models list now only includes providers whose API key is set, so an agent created in the Agent Builder can no longer be assigned a model that can never run.

packages/server/src/server/handlers/editor-builder.test.ts

@@ -1,6 +1,6 @@
 import type { IAgentBuilder } from '@mastra/core/agent-builder/ee';
 import type { IMastraEditor } from '@mastra/core/editor';
-import { describe, it, expect, vi } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
 import {
   GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE,
@@ -613,18 +613,47 @@ describe('GET /editor/builder/infrastructure route metadata', () => {
 describe('GET /editor/builder/models/available', () => {
   const runAvailable = (editor?: Partial<IMastraEditor>) =>
     GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE.handler({ mastra: createMockMastra(editor) } as any) as Promise<{
-      providers: Array<{ id: string; models: string[] }>;
+      providers: Array<{ id: string; models: string[]; connected: boolean }>;
     }>;
 
-  it('returns the full provider list when no editor / policy is configured', async () => {
+  const originalOpenAIKey = process.env.OPENAI_API_KEY;
+  const originalAnthropicKey = process.env.ANTHROPIC_API_KEY;
+
+  beforeEach(() => {
+    // The endpoint only surfaces providers with a configured API key, so make
+    // exactly one provider "connected" and ensure another is not.
+    process.env.OPENAI_API_KEY = 'test-key';
+    delete process.env.ANTHROPIC_API_KEY;
+  });
+
+  afterEach(() => {
+    if (originalOpenAIKey === undefined) delete process.env.OPENAI_API_KEY;
+    else process.env.OPENAI_API_KEY = originalOpenAIKey;
+    if (originalAnthropicKey === undefined) delete process.env.ANTHROPIC_API_KEY;
+    else process.env.ANTHROPIC_API_KEY = originalAnthropicKey;
+  });
+
+  it('returns only providers with a configured API key when no policy is configured', async () => {
     const { providers } = await runAvailable();
 
     expect(providers.length).toBeGreaterThan(0);
+    // Every returned provider is connected (has its API key configured).
+    expect(providers.every(p => p.connected)).toBe(true);
+
     const openai = providers.find(p => p.id === 'openai');
     expect(openai).toBeDefined();
     expect(openai!.models.length).toBeGreaterThan(0);
   });
 
+  it('omits providers whose API key is not configured', async () => {
+    const { providers } = await runAvailable();
+
+    // anthropic has no API key set in this test, so it must be filtered out
+    // even though it exists in the provider registry.
+    expect(providers.find(p => p.id === 'anthropic')).toBeUndefined();
+    expect(providers.find(p => p.id === 'openai')).toBeDefined();
+  });
+
   it('filters models down to the active policy allowlist (provider wildcard)', async () => {
     const builder: IAgentBuilder = {
       enabled: true,

packages/server/src/server/handlers/editor-builder.ts

@@ -179,14 +179,18 @@ export const GET_EDITOR_BUILDER_SETTINGS_ROUTE = createRoute({
 /**
  * GET /editor/builder/models/available
  *
- * Returns the configured AI providers/models filtered by the active builder
- * model policy. The server is the single authority for the allowlist: it
- * applies `isModelAllowed` here so the Studio model picker can render the
- * response verbatim without importing any EE matcher into the browser.
+ * Returns the configured AI providers/models the agent builder may use. The
+ * server is the single authority: it scopes the list to providers with a
+ * configured API key (`connected`) and applies the active builder model
+ * policy via `isModelAllowed`, so the Studio surfaces can render the response
+ * verbatim without importing any EE matcher into the browser.
  *
- * - Policy inactive (or no allowlist) ⇒ the full provider list is returned.
- * - Policy active with an allowlist ⇒ each provider's models are filtered,
- *   and providers left with no allowed models are omitted entirely.
+ * - Providers without a configured API key are always omitted — the builder
+ *   decides the agent's model from this list, so an unconnected provider would
+ *   produce an agent that can never run.
+ * - Policy inactive (or no allowlist) ⇒ all connected providers are returned.
+ * - Policy active with an allowlist ⇒ each connected provider's models are
+ *   filtered, and providers left with no allowed models are omitted entirely.
  */
 export const GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE = createRoute({
   method: 'GET',
@@ -200,10 +204,14 @@ export const GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE = createRoute({
   requiresPermission: 'stored-agents:read',
   handler: async ({ mastra }) => {
     try {
-      const providers = await buildProvidersList(mastra);
+      // Only surface providers whose API key is configured (`connected`). The
+      // agent builder decides the agent's model from this list, so including
+      // providers without a key lets it pick a model that can never run. We
+      // scope to connected providers so every choice is actually usable.
+      const providers = (await buildProvidersList(mastra)).filter(provider => provider.connected);
       const policy = await resolveBuilderModelPolicy(mastra.getEditor());
 
-      // Inactive policy (or no allowlist) ⇒ nothing to filter.
+      // Inactive policy (or no allowlist) ⇒ no allowlist filtering to apply.
       if (!policy.active || !policy.allowed || policy.allowed.length === 0) {
         return { providers };
       }