@agent-native/core 0.15.12 → 0.16.0

package/dist/mcp-client/builtin-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-capabilities.d.ts","sourceRoot":"","sources":["../../src/mcp-client/builtin-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,MAAM,sBAAsB,GAC9B,yBAAyB,GACzB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,sBAAsB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,cAAc,CAAC,EAAE,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,wBAAwB,EAAE,oBAAoB,EAoC1D,CAAC;AAMF,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,MAAM,GACT,oBAAoB,GAAG,IAAI,CAE7B;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,GACT,EAAE,IAAI,sBAAsB,CAE9B;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,oBAAoB,EAChC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAET;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,SAAS,MAAM,EAAE,GACrB,sBAAsB,EAAE,CAkB1B;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,oBAAoB,GAC/B,oBAAoB,CAOtB"}

package/dist/mcp-client/builtin-capabilities.js

@@ -0,0 +1,75 @@
+export const BUILTIN_MCP_CAPABILITIES = [
+    {
+        id: "browser-chrome-devtools",
+        serverId: "chrome-devtools",
+        name: "Chrome DevTools",
+        description: "Attach to a live Chrome browser through Chrome DevTools MCP.",
+        command: "npx",
+        args: [
+            "-y",
+            "chrome-devtools-mcp@0.26.0",
+            "--autoConnect",
+            "--no-usage-statistics",
+        ],
+        exclusiveGroup: "browser",
+        notes: "Uses --autoConnect and requires Chrome 144+ with remote debugging enabled.",
+    },
+    {
+        id: "browser-playwright",
+        serverId: "playwright",
+        name: "Playwright Browser",
+        description: "Launch and control a Playwright-managed browser.",
+        command: "npx",
+        args: ["-y", "@playwright/mcp@0.0.75"],
+        exclusiveGroup: "browser",
+    },
+    {
+        id: "computer-use",
+        serverId: "computer-use",
+        name: "Computer Use",
+        description: "Control local macOS apps through the Computer Use MCP server.",
+        command: "npx",
+        args: ["-y", "computer-use-mcp@1.8.0"],
+        platforms: ["darwin"],
+    },
+];
+const CAPABILITY_BY_ID = new Map(BUILTIN_MCP_CAPABILITIES.map((capability) => [capability.id, capability]));
+export function getBuiltinMcpCapability(id) {
+    return CAPABILITY_BY_ID.get(id) ?? null;
+}
+export function isBuiltinMcpCapabilityId(id) {
+    return CAPABILITY_BY_ID.has(id);
+}
+export function isBuiltinMcpCapabilityAvailable(capability, platform = process.platform) {
+    return !capability.platforms || capability.platforms.includes(platform);
+}
+export function normalizeBuiltinMcpCapabilityIds(ids) {
+    const enabled = [];
+    for (const rawId of ids) {
+        const capability = getBuiltinMcpCapability(rawId);
+        if (!capability)
+            continue;
+        if (capability.exclusiveGroup) {
+            for (let i = enabled.length - 1; i >= 0; i--) {
+                const existing = getBuiltinMcpCapability(enabled[i]);
+                if (existing?.exclusiveGroup === capability.exclusiveGroup) {
+                    enabled.splice(i, 1);
+                }
+            }
+        }
+        else if (enabled.includes(capability.id)) {
+            continue;
+        }
+        enabled.push(capability.id);
+    }
+    return enabled;
+}
+export function toBuiltinMcpServerConfig(capability) {
+    return {
+        type: "stdio",
+        command: capability.command,
+        args: capability.args,
+        description: capability.description,
+    };
+}
+//# sourceMappingURL=builtin-capabilities.js.map

package/dist/mcp-client/builtin-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-capabilities.js","sourceRoot":"","sources":["../../src/mcp-client/builtin-capabilities.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC9D;QACE,EAAE,EAAE,yBAAyB;QAC7B,QAAQ,EAAE,iBAAiB;QAC3B,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,KAAK;QACd,IAAI,EAAE;YACJ,IAAI;YACJ,4BAA4B;YAC5B,eAAe;YACf,uBAAuB;SACxB;QACD,cAAc,EAAE,SAAS;QACzB,KAAK,EACH,4EAA4E;KAC/E;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,wBAAwB,CAAC;QACtC,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,cAAc;QACxB,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,+DAA+D;QACjE,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,wBAAwB,CAAC;QACtC,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;CACF,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,wBAAwB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAC1E,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACrC,EAAU;IAEV,OAAO,gBAAgB,CAAC,GAAG,CAAC,EAA4B,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAU;IAEV,OAAO,gBAAgB,CAAC,GAAG,CAAC,EAA4B,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,UAAgC,EAChC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,GAAsB;IAEtB,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,IAAI,QAAQ,EAAE,cAAc,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;oBAC3D,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW,EAAE,UAAU,CAAC,WAAW;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { McpStdioServerConfig } from \"./config.js\";\n\nexport type BuiltinMcpCapabilityId =\n  | \"browser-chrome-devtools\"\n  | \"browser-playwright\"\n  | \"computer-use\";\n\nexport interface BuiltinMcpCapability {\n  id: BuiltinMcpCapabilityId;\n  serverId: string;\n  name: string;\n  description: string;\n  command: string;\n  args: string[];\n  exclusiveGroup?: \"browser\";\n  platforms?: NodeJS.Platform[];\n  notes?: string;\n}\n\nexport const BUILTIN_MCP_CAPABILITIES: BuiltinMcpCapability[] = [\n  {\n    id: \"browser-chrome-devtools\",\n    serverId: \"chrome-devtools\",\n    name: \"Chrome DevTools\",\n    description: \"Attach to a live Chrome browser through Chrome DevTools MCP.\",\n    command: \"npx\",\n    args: [\n      \"-y\",\n      \"chrome-devtools-mcp@0.26.0\",\n      \"--autoConnect\",\n      \"--no-usage-statistics\",\n    ],\n    exclusiveGroup: \"browser\",\n    notes:\n      \"Uses --autoConnect and requires Chrome 144+ with remote debugging enabled.\",\n  },\n  {\n    id: \"browser-playwright\",\n    serverId: \"playwright\",\n    name: \"Playwright Browser\",\n    description: \"Launch and control a Playwright-managed browser.\",\n    command: \"npx\",\n    args: [\"-y\", \"@playwright/mcp@0.0.75\"],\n    exclusiveGroup: \"browser\",\n  },\n  {\n    id: \"computer-use\",\n    serverId: \"computer-use\",\n    name: \"Computer Use\",\n    description:\n      \"Control local macOS apps through the Computer Use MCP server.\",\n    command: \"npx\",\n    args: [\"-y\", \"computer-use-mcp@1.8.0\"],\n    platforms: [\"darwin\"],\n  },\n];\n\nconst CAPABILITY_BY_ID = new Map(\n  BUILTIN_MCP_CAPABILITIES.map((capability) => [capability.id, capability]),\n);\n\nexport function getBuiltinMcpCapability(\n  id: string,\n): BuiltinMcpCapability | null {\n  return CAPABILITY_BY_ID.get(id as BuiltinMcpCapabilityId) ?? null;\n}\n\nexport function isBuiltinMcpCapabilityId(\n  id: string,\n): id is BuiltinMcpCapabilityId {\n  return CAPABILITY_BY_ID.has(id as BuiltinMcpCapabilityId);\n}\n\nexport function isBuiltinMcpCapabilityAvailable(\n  capability: BuiltinMcpCapability,\n  platform: NodeJS.Platform = process.platform,\n): boolean {\n  return !capability.platforms || capability.platforms.includes(platform);\n}\n\nexport function normalizeBuiltinMcpCapabilityIds(\n  ids: readonly string[],\n): BuiltinMcpCapabilityId[] {\n  const enabled: BuiltinMcpCapabilityId[] = [];\n  for (const rawId of ids) {\n    const capability = getBuiltinMcpCapability(rawId);\n    if (!capability) continue;\n    if (capability.exclusiveGroup) {\n      for (let i = enabled.length - 1; i >= 0; i--) {\n        const existing = getBuiltinMcpCapability(enabled[i]);\n        if (existing?.exclusiveGroup === capability.exclusiveGroup) {\n          enabled.splice(i, 1);\n        }\n      }\n    } else if (enabled.includes(capability.id)) {\n      continue;\n    }\n    enabled.push(capability.id);\n  }\n  return enabled;\n}\n\nexport function toBuiltinMcpServerConfig(\n  capability: BuiltinMcpCapability,\n): McpStdioServerConfig {\n  return {\n    type: \"stdio\",\n    command: capability.command,\n    args: capability.args,\n    description: capability.description,\n  };\n}\n"]}

package/dist/mcp-client/builtin-store.d.ts

@@ -0,0 +1,10 @@
+import { type BuiltinMcpCapabilityId } from "./builtin-capabilities.js";
+import type { RemoteMcpScope } from "./remote-store.js";
+export interface StoredBuiltinMcpCapabilities {
+    enabledIds: BuiltinMcpCapabilityId[];
+}
+export declare function builtinMcpCapabilitiesSettingsKey(): string;
+export declare function listEnabledBuiltinMcpCapabilities(scope: RemoteMcpScope, scopeId: string): Promise<BuiltinMcpCapabilityId[]>;
+export declare function setEnabledBuiltinMcpCapabilities(scope: RemoteMcpScope, scopeId: string, ids: readonly string[]): Promise<BuiltinMcpCapabilityId[]>;
+export declare function setBuiltinMcpCapabilityEnabled(scope: RemoteMcpScope, scopeId: string, id: string, enabled: boolean): Promise<BuiltinMcpCapabilityId[] | null>;
+//# sourceMappingURL=builtin-store.d.ts.map

package/dist/mcp-client/builtin-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-store.d.ts","sourceRoot":"","sources":["../../src/mcp-client/builtin-store.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC;AAkCD,wBAAgB,iCAAiC,IAAI,MAAM,CAE1D;AAED,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAInC;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,SAAS,MAAM,EAAE,GACrB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAInC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,CAS1C"}

package/dist/mcp-client/builtin-store.js

@@ -0,0 +1,55 @@
+import { getUserSetting, putUserSetting, deleteUserSetting, } from "../settings/user-settings.js";
+import { getOrgSetting, putOrgSetting, deleteOrgSetting, } from "../settings/org-settings.js";
+import { getBuiltinMcpCapability, normalizeBuiltinMcpCapabilityIds, } from "./builtin-capabilities.js";
+const SETTINGS_KEY = "mcp-builtin-capabilities";
+async function readSetting(scope, scopeId) {
+    return scope === "user"
+        ? getUserSetting(scopeId, SETTINGS_KEY)
+        : getOrgSetting(scopeId, SETTINGS_KEY);
+}
+async function writeSetting(scope, scopeId, enabledIds) {
+    if (enabledIds.length === 0) {
+        if (scope === "user") {
+            await deleteUserSetting(scopeId, SETTINGS_KEY);
+        }
+        else {
+            await deleteOrgSetting(scopeId, SETTINGS_KEY);
+        }
+        return;
+    }
+    const value = {
+        enabledIds,
+    };
+    if (scope === "user") {
+        await putUserSetting(scopeId, SETTINGS_KEY, value);
+    }
+    else {
+        await putOrgSetting(scopeId, SETTINGS_KEY, value);
+    }
+}
+export function builtinMcpCapabilitiesSettingsKey() {
+    return SETTINGS_KEY;
+}
+export async function listEnabledBuiltinMcpCapabilities(scope, scopeId) {
+    const raw = await readSetting(scope, scopeId);
+    if (!raw || !Array.isArray(raw.enabledIds))
+        return [];
+    return normalizeBuiltinMcpCapabilityIds(raw.enabledIds.map(String));
+}
+export async function setEnabledBuiltinMcpCapabilities(scope, scopeId, ids) {
+    const enabledIds = normalizeBuiltinMcpCapabilityIds(ids);
+    await writeSetting(scope, scopeId, enabledIds);
+    return enabledIds;
+}
+export async function setBuiltinMcpCapabilityEnabled(scope, scopeId, id, enabled) {
+    const capability = getBuiltinMcpCapability(id);
+    if (!capability)
+        return null;
+    const existing = await listEnabledBuiltinMcpCapabilities(scope, scopeId);
+    const next = enabled
+        ? normalizeBuiltinMcpCapabilityIds([...existing, capability.id])
+        : existing.filter((existingId) => existingId !== capability.id);
+    await writeSetting(scope, scopeId, next);
+    return next;
+}
+//# sourceMappingURL=builtin-store.js.map

package/dist/mcp-client/builtin-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-store.js","sourceRoot":"","sources":["../../src/mcp-client/builtin-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,gCAAgC,GAEjC,MAAM,2BAA2B,CAAC;AAGnC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAMhD,KAAK,UAAU,WAAW,CACxB,KAAqB,EACrB,OAAe;IAEf,OAAO,KAAK,KAAK,MAAM;QACrB,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC;QACvC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAqB,EACrB,OAAe,EACf,UAAoC;IAEpC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAA2D;QACpE,UAAU;KACX,CAAC;IACF,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IACtD,OAAO,gCAAgC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqB,EACrB,OAAe,EACf,GAAsB;IAEtB,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAqB,EACrB,OAAe,EACf,EAAU,EACV,OAAgB;IAEhB,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,gCAAgC,CAAC,CAAC,GAAG,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import {\n  getUserSetting,\n  putUserSetting,\n  deleteUserSetting,\n} from \"../settings/user-settings.js\";\nimport {\n  getOrgSetting,\n  putOrgSetting,\n  deleteOrgSetting,\n} from \"../settings/org-settings.js\";\nimport {\n  getBuiltinMcpCapability,\n  normalizeBuiltinMcpCapabilityIds,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\nimport type { RemoteMcpScope } from \"./remote-store.js\";\n\nconst SETTINGS_KEY = \"mcp-builtin-capabilities\";\n\nexport interface StoredBuiltinMcpCapabilities {\n  enabledIds: BuiltinMcpCapabilityId[];\n}\n\nasync function readSetting(\n  scope: RemoteMcpScope,\n  scopeId: string,\n): Promise<Record<string, unknown> | null> {\n  return scope === \"user\"\n    ? getUserSetting(scopeId, SETTINGS_KEY)\n    : getOrgSetting(scopeId, SETTINGS_KEY);\n}\n\nasync function writeSetting(\n  scope: RemoteMcpScope,\n  scopeId: string,\n  enabledIds: BuiltinMcpCapabilityId[],\n): Promise<void> {\n  if (enabledIds.length === 0) {\n    if (scope === \"user\") {\n      await deleteUserSetting(scopeId, SETTINGS_KEY);\n    } else {\n      await deleteOrgSetting(scopeId, SETTINGS_KEY);\n    }\n    return;\n  }\n  const value: StoredBuiltinMcpCapabilities & Record<string, unknown> = {\n    enabledIds,\n  };\n  if (scope === \"user\") {\n    await putUserSetting(scopeId, SETTINGS_KEY, value);\n  } else {\n    await putOrgSetting(scopeId, SETTINGS_KEY, value);\n  }\n}\n\nexport function builtinMcpCapabilitiesSettingsKey(): string {\n  return SETTINGS_KEY;\n}\n\nexport async function listEnabledBuiltinMcpCapabilities(\n  scope: RemoteMcpScope,\n  scopeId: string,\n): Promise<BuiltinMcpCapabilityId[]> {\n  const raw = await readSetting(scope, scopeId);\n  if (!raw || !Array.isArray(raw.enabledIds)) return [];\n  return normalizeBuiltinMcpCapabilityIds(raw.enabledIds.map(String));\n}\n\nexport async function setEnabledBuiltinMcpCapabilities(\n  scope: RemoteMcpScope,\n  scopeId: string,\n  ids: readonly string[],\n): Promise<BuiltinMcpCapabilityId[]> {\n  const enabledIds = normalizeBuiltinMcpCapabilityIds(ids);\n  await writeSetting(scope, scopeId, enabledIds);\n  return enabledIds;\n}\n\nexport async function setBuiltinMcpCapabilityEnabled(\n  scope: RemoteMcpScope,\n  scopeId: string,\n  id: string,\n  enabled: boolean,\n): Promise<BuiltinMcpCapabilityId[] | null> {\n  const capability = getBuiltinMcpCapability(id);\n  if (!capability) return null;\n  const existing = await listEnabledBuiltinMcpCapabilities(scope, scopeId);\n  const next = enabled\n    ? normalizeBuiltinMcpCapabilityIds([...existing, capability.id])\n    : existing.filter((existingId) => existingId !== capability.id);\n  await writeSetting(scope, scopeId, next);\n  return next;\n}\n"]}

package/dist/mcp-client/index.d.ts

@@ -7,7 +7,9 @@
 export { loadMcpConfig, autoDetectMcpConfig, type McpConfig, type McpServerConfig, } from "./config.js";
 export { McpClientManager, parseMcpToolName, MCP_TOOL_PREFIX, type McpTool, type McpClientManagerOptions, } from "./manager.js";
 export { listRemoteServers, addRemoteServer, removeRemoteServer, validateRemoteUrl, normalizeServerName, mergedConfigKey, parseMergedKey, hashEmail, toHttpServerConfig, toHttpServerConfigAsync, materializeHeaders, type RemoteMcpScope, type StoredRemoteMcpServer, } from "./remote-store.js";
-export { mountMcpServersRoutes, buildMergedConfig } from "./routes.js";
+export { BUILTIN_MCP_CAPABILITIES, getBuiltinMcpCapability, isBuiltinMcpCapabilityAvailable, normalizeBuiltinMcpCapabilityIds, toBuiltinMcpServerConfig, type BuiltinMcpCapability, type BuiltinMcpCapabilityId, } from "./builtin-capabilities.js";
+export { builtinMcpCapabilitiesSettingsKey, listEnabledBuiltinMcpCapabilities, setEnabledBuiltinMcpCapabilities, setBuiltinMcpCapabilityEnabled, type StoredBuiltinMcpCapabilities, } from "./builtin-store.js";
+export { mountMcpServersRoutes, buildMergedConfig, builtinMergedConfigKey, type ClientBuiltinCapability, } from "./routes.js";
 export { mountMcpHubRoutes, listHubServers, getHubStatus, isHubServeEnabled, isHubConsumeEnabled, type HubServerRecord, type HubServersResponse, } from "./hub-routes.js";
 export { fetchHubServers } from "./hub-client.js";
 export { isMcpToolAllowedForRequest } from "./visibility.js";

package/dist/mcp-client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp-client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,KAAK,OAAO,EACZ,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAG7D;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAW,MAAM,cAAc,CAAC;AAE9D,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,gBAAgB,GACxB,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAM7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAClC,IAAI,CAaN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp-client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,KAAK,OAAO,EACZ,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,gCAAgC,EAChC,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAG7D;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAW,MAAM,cAAc,CAAC;AAE9D,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,gBAAgB,GACxB,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAM7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAClC,IAAI,CAaN"}

package/dist/mcp-client/index.js

@@ -7,7 +7,9 @@
 export { loadMcpConfig, autoDetectMcpConfig, } from "./config.js";
 export { McpClientManager, parseMcpToolName, MCP_TOOL_PREFIX, } from "./manager.js";
 export { listRemoteServers, addRemoteServer, removeRemoteServer, validateRemoteUrl, normalizeServerName, mergedConfigKey, parseMergedKey, hashEmail, toHttpServerConfig, toHttpServerConfigAsync, materializeHeaders, } from "./remote-store.js";
-export { mountMcpServersRoutes, buildMergedConfig } from "./routes.js";
+export { BUILTIN_MCP_CAPABILITIES, getBuiltinMcpCapability, isBuiltinMcpCapabilityAvailable, normalizeBuiltinMcpCapabilityIds, toBuiltinMcpServerConfig, } from "./builtin-capabilities.js";
+export { builtinMcpCapabilitiesSettingsKey, listEnabledBuiltinMcpCapabilities, setEnabledBuiltinMcpCapabilities, setBuiltinMcpCapabilityEnabled, } from "./builtin-store.js";
+export { mountMcpServersRoutes, buildMergedConfig, builtinMergedConfigKey, } from "./routes.js";
 export { mountMcpHubRoutes, listHubServers, getHubStatus, isHubServeEnabled, isHubConsumeEnabled, } from "./hub-routes.js";
 export { fetchHubServers } from "./hub-client.js";
 export { isMcpToolAllowedForRequest } from "./visibility.js";

package/dist/mcp-client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp-client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAU7D,MAAM,UAAU,uBAAuB,CACrC,OAAyB;IAEzB,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyB,EACzB,MAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAyB,EACzB,IAAa;IAEb,OAAO;QACL,IAAI,EAAE;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,WAAkB;SACpC;QACD,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,KAAK,EAAE,IAA4B,EAAE,EAAE;YAC1C,oEAAoE;YACpE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,mBAAmB,IAAI,CAAC,IAAI,iDAAiD,CAAC;YACvF,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvD,yFAAyF;gBACzF,sEAAsE;gBACtE,IACE,MAAM;oBACN,OAAO,MAAM,KAAK,QAAQ;oBAC1B,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC,EACtC,CAAC;oBACD,MAAM,KAAK,GAAI,MAAc,CAAC,OAAqC,CAAC;oBACpE,MAAM,IAAI,GAAG,KAAK;yBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBACT,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;4BAClD,OAAO,CAAC,CAAC,IAAI,CAAC;wBAChB,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;4BACrB,OAAO,WAAW,CAAC,EAAE,QAAQ,IAAI,SAAS,GAAG,CAAC;wBAChD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC3B,CAAC,CAAC;yBACD,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,IAAK,MAAc,CAAC,OAAO;wBAAE,OAAO,UAAU,IAAI,EAAE,CAAC;oBACrD,OAAO,IAAI,IAAI,aAAa,CAAC;gBAC/B,CAAC;gBACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,0BAA0B,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YACvE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * MCP client module — symmetric counterpart to `@agent-native/core/mcp`\n * (the MCP server). Connects to local MCP servers configured in\n * `mcp.config.json` or the `MCP_SERVERS` env var and exposes their tools\n * to the agent-chat tool-use loop.\n */\n\nexport {\n  loadMcpConfig,\n  autoDetectMcpConfig,\n  type McpConfig,\n  type McpServerConfig,\n} from \"./config.js\";\n\nexport {\n  McpClientManager,\n  parseMcpToolName,\n  MCP_TOOL_PREFIX,\n  type McpTool,\n  type McpClientManagerOptions,\n} from \"./manager.js\";\n\nexport {\n  listRemoteServers,\n  addRemoteServer,\n  removeRemoteServer,\n  validateRemoteUrl,\n  normalizeServerName,\n  mergedConfigKey,\n  parseMergedKey,\n  hashEmail,\n  toHttpServerConfig,\n  toHttpServerConfigAsync,\n  materializeHeaders,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\n\nexport { mountMcpServersRoutes, buildMergedConfig } from \"./routes.js\";\n\nexport {\n  mountMcpHubRoutes,\n  listHubServers,\n  getHubStatus,\n  isHubServeEnabled,\n  isHubConsumeEnabled,\n  type HubServerRecord,\n  type HubServersResponse,\n} from \"./hub-routes.js\";\n\nexport { fetchHubServers } from \"./hub-client.js\";\n\nexport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\n\n/**\n * Convert MCP tools into `ActionEntry` values suitable for registration in\n * the agent's action registry. Each tool is marked `http: false` so it's\n * never auto-mounted as an HTTP endpoint — MCP tools are agent-only.\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { McpClientManager, McpTool } from \"./manager.js\";\n\nexport function mcpToolsToActionEntries(\n  manager: McpClientManager,\n): Record<string, ActionEntry> {\n  const entries: Record<string, ActionEntry> = {};\n  for (const tool of manager.getTools()) {\n    entries[tool.name] = mcpToolToActionEntry(manager, tool);\n  }\n  return entries;\n}\n\n/**\n * Mutate a target action dict in place so it matches the current MCP tool set:\n * - adds new `mcp__*` keys that aren't in target,\n * - removes `mcp__*` keys that no longer exist in the manager,\n * - leaves non-MCP keys untouched.\n *\n * Used by the agent-chat plugin to keep its `prodActions` / `devActions`\n * registries in sync after `McpClientManager.reconfigure()` runs.\n */\nexport function syncMcpActionEntries(\n  manager: McpClientManager,\n  target: Record<string, ActionEntry>,\n): void {\n  const current = new Set<string>();\n  for (const tool of manager.getTools()) {\n    current.add(tool.name);\n    if (!target[tool.name]) {\n      target[tool.name] = mcpToolToActionEntry(manager, tool);\n    }\n  }\n  for (const key of Object.keys(target)) {\n    if (key.startsWith(\"mcp__\") && !current.has(key)) {\n      delete target[key];\n    }\n  }\n}\n\nfunction mcpToolToActionEntry(\n  manager: McpClientManager,\n  tool: McpTool,\n): ActionEntry {\n  return {\n    tool: {\n      description: tool.description,\n      parameters: tool.inputSchema as any,\n    },\n    http: false,\n    run: async (args: Record<string, string>) => {\n      // Defense-in-depth: even if a cross-scope MCP tool somehow makes it\n      // into the LLM's visible tool list, reject invocation here so we never\n      // execute a user's credentials on behalf of another user.\n      if (!isMcpToolAllowedForRequest(tool.name)) {\n        return `Error: MCP tool ${tool.name} is not available in the current request scope.`;\n      }\n      try {\n        const result = await manager.callTool(tool.name, args);\n        // MCP tool results are typically `{ content: [{ type: \"text\", text: ... }], isError? }`.\n        // Flatten text content for the agent's string-based tool result slot.\n        if (\n          result &&\n          typeof result === \"object\" &&\n          Array.isArray((result as any).content)\n        ) {\n          const parts = (result as any).content as Array<Record<string, any>>;\n          const text = parts\n            .map((p) => {\n              if (p?.type === \"text\" && typeof p.text === \"string\")\n                return p.text;\n              if (p?.type === \"image\")\n                return `[image: ${p?.mimeType ?? \"unknown\"}]`;\n              return JSON.stringify(p);\n            })\n            .join(\"\\n\");\n          if ((result as any).isError) return `Error: ${text}`;\n          return text || \"(no output)\";\n        }\n        return typeof result === \"string\" ? result : JSON.stringify(result);\n      } catch (err: any) {\n        return `Error calling MCP tool ${tool.name}: ${err?.message ?? err}`;\n      }\n    },\n  };\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp-client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,GAEvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAU7D,MAAM,UAAU,uBAAuB,CACrC,OAAyB;IAEzB,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyB,EACzB,MAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAyB,EACzB,IAAa;IAEb,OAAO;QACL,IAAI,EAAE;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,WAAkB;SACpC;QACD,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,KAAK,EAAE,IAA4B,EAAE,EAAE;YAC1C,oEAAoE;YACpE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,mBAAmB,IAAI,CAAC,IAAI,iDAAiD,CAAC;YACvF,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvD,yFAAyF;gBACzF,sEAAsE;gBACtE,IACE,MAAM;oBACN,OAAO,MAAM,KAAK,QAAQ;oBAC1B,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC,EACtC,CAAC;oBACD,MAAM,KAAK,GAAI,MAAc,CAAC,OAAqC,CAAC;oBACpE,MAAM,IAAI,GAAG,KAAK;yBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBACT,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;4BAClD,OAAO,CAAC,CAAC,IAAI,CAAC;wBAChB,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;4BACrB,OAAO,WAAW,CAAC,EAAE,QAAQ,IAAI,SAAS,GAAG,CAAC;wBAChD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC3B,CAAC,CAAC;yBACD,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,IAAK,MAAc,CAAC,OAAO;wBAAE,OAAO,UAAU,IAAI,EAAE,CAAC;oBACrD,OAAO,IAAI,IAAI,aAAa,CAAC;gBAC/B,CAAC;gBACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,0BAA0B,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YACvE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * MCP client module — symmetric counterpart to `@agent-native/core/mcp`\n * (the MCP server). Connects to local MCP servers configured in\n * `mcp.config.json` or the `MCP_SERVERS` env var and exposes their tools\n * to the agent-chat tool-use loop.\n */\n\nexport {\n  loadMcpConfig,\n  autoDetectMcpConfig,\n  type McpConfig,\n  type McpServerConfig,\n} from \"./config.js\";\n\nexport {\n  McpClientManager,\n  parseMcpToolName,\n  MCP_TOOL_PREFIX,\n  type McpTool,\n  type McpClientManagerOptions,\n} from \"./manager.js\";\n\nexport {\n  listRemoteServers,\n  addRemoteServer,\n  removeRemoteServer,\n  validateRemoteUrl,\n  normalizeServerName,\n  mergedConfigKey,\n  parseMergedKey,\n  hashEmail,\n  toHttpServerConfig,\n  toHttpServerConfigAsync,\n  materializeHeaders,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\n\nexport {\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\n\nexport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  type StoredBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\n\nexport {\n  mountMcpServersRoutes,\n  buildMergedConfig,\n  builtinMergedConfigKey,\n  type ClientBuiltinCapability,\n} from \"./routes.js\";\n\nexport {\n  mountMcpHubRoutes,\n  listHubServers,\n  getHubStatus,\n  isHubServeEnabled,\n  isHubConsumeEnabled,\n  type HubServerRecord,\n  type HubServersResponse,\n} from \"./hub-routes.js\";\n\nexport { fetchHubServers } from \"./hub-client.js\";\n\nexport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\n\n/**\n * Convert MCP tools into `ActionEntry` values suitable for registration in\n * the agent's action registry. Each tool is marked `http: false` so it's\n * never auto-mounted as an HTTP endpoint — MCP tools are agent-only.\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { McpClientManager, McpTool } from \"./manager.js\";\n\nexport function mcpToolsToActionEntries(\n  manager: McpClientManager,\n): Record<string, ActionEntry> {\n  const entries: Record<string, ActionEntry> = {};\n  for (const tool of manager.getTools()) {\n    entries[tool.name] = mcpToolToActionEntry(manager, tool);\n  }\n  return entries;\n}\n\n/**\n * Mutate a target action dict in place so it matches the current MCP tool set:\n * - adds new `mcp__*` keys that aren't in target,\n * - removes `mcp__*` keys that no longer exist in the manager,\n * - leaves non-MCP keys untouched.\n *\n * Used by the agent-chat plugin to keep its `prodActions` / `devActions`\n * registries in sync after `McpClientManager.reconfigure()` runs.\n */\nexport function syncMcpActionEntries(\n  manager: McpClientManager,\n  target: Record<string, ActionEntry>,\n): void {\n  const current = new Set<string>();\n  for (const tool of manager.getTools()) {\n    current.add(tool.name);\n    if (!target[tool.name]) {\n      target[tool.name] = mcpToolToActionEntry(manager, tool);\n    }\n  }\n  for (const key of Object.keys(target)) {\n    if (key.startsWith(\"mcp__\") && !current.has(key)) {\n      delete target[key];\n    }\n  }\n}\n\nfunction mcpToolToActionEntry(\n  manager: McpClientManager,\n  tool: McpTool,\n): ActionEntry {\n  return {\n    tool: {\n      description: tool.description,\n      parameters: tool.inputSchema as any,\n    },\n    http: false,\n    run: async (args: Record<string, string>) => {\n      // Defense-in-depth: even if a cross-scope MCP tool somehow makes it\n      // into the LLM's visible tool list, reject invocation here so we never\n      // execute a user's credentials on behalf of another user.\n      if (!isMcpToolAllowedForRequest(tool.name)) {\n        return `Error: MCP tool ${tool.name} is not available in the current request scope.`;\n      }\n      try {\n        const result = await manager.callTool(tool.name, args);\n        // MCP tool results are typically `{ content: [{ type: \"text\", text: ... }], isError? }`.\n        // Flatten text content for the agent's string-based tool result slot.\n        if (\n          result &&\n          typeof result === \"object\" &&\n          Array.isArray((result as any).content)\n        ) {\n          const parts = (result as any).content as Array<Record<string, any>>;\n          const text = parts\n            .map((p) => {\n              if (p?.type === \"text\" && typeof p.text === \"string\")\n                return p.text;\n              if (p?.type === \"image\")\n                return `[image: ${p?.mimeType ?? \"unknown\"}]`;\n              return JSON.stringify(p);\n            })\n            .join(\"\\n\");\n          if ((result as any).isError) return `Error: ${text}`;\n          return text || \"(no output)\";\n        }\n        return typeof result === \"string\" ? result : JSON.stringify(result);\n      } catch (err: any) {\n        return `Error calling MCP tool ${tool.name}: ${err?.message ?? err}`;\n      }\n    },\n  };\n}\n"]}

package/dist/mcp-client/routes.d.ts

@@ -10,9 +10,12 @@
  *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)
  *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)
  *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting
+ *   GET    /_agent-native/mcp/builtin           list built-in capability toggles
+ *   POST   /_agent-native/mcp/builtin           update built-in capability toggles
  */
 import type { McpClientManager } from "./manager.js";
 import type { McpConfig } from "./config.js";
+import { type BuiltinMcpCapability, type BuiltinMcpCapabilityId } from "./builtin-capabilities.js";
 import { type RemoteMcpScope } from "./remote-store.js";
 export { formatMcpConnectError } from "./errors.js";
 export interface ClientServer {
@@ -29,6 +32,30 @@ export interface ClientServer {
     mergedId: string;
     status: ServerStatus;
 }
+export interface ClientBuiltinCapability {
+    id: BuiltinMcpCapabilityId;
+    serverId: string;
+    name: string;
+    description: string;
+    command: string;
+    args: string[];
+    exclusiveGroup?: string;
+    available: boolean;
+    unavailableReason?: string;
+    notes?: string;
+    enabled: {
+        user: boolean;
+        org: boolean;
+    };
+    mergedIds: {
+        user?: string;
+        org?: string;
+    };
+    status: {
+        user?: ServerStatus;
+        org?: ServerStatus;
+    };
+}
 type ServerStatus = {
     state: "connected";
     toolCount: number;
@@ -38,6 +65,7 @@ type ServerStatus = {
 } | {
     state: "unknown";
 };
+export declare function builtinMergedConfigKey(scope: RemoteMcpScope, capability: BuiltinMcpCapability, ownerId: string): string;
 /**
  * Build the merged MCP config the manager should run with: file/env config
  * plus **every** user-scope and org-scope remote server persisted in the

package/dist/mcp-client/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AAG9D,OAAO,EAOL,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA+BpD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,KAAK,YAAY,GACb;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAiBzB;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA+CnE;AAmCD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAoDN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AAG9D,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EAOL,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA+BpD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,sBAAsB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,YAAY,CAAC;QAAC,GAAG,CAAC,EAAE,YAAY,CAAA;KAAE,CAAC;CACrD;AAED,KAAK,YAAY,GACb;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AA6BzB,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA2EnE;AAmCD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAyEN"}

package/dist/mcp-client/routes.js

@@ -10,6 +10,8 @@
  *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)
  *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)
  *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting
+ *   GET    /_agent-native/mcp/builtin           list built-in capability toggles
+ *   POST   /_agent-native/mcp/builtin           update built-in capability toggles
  */
 import { defineEventHandler, getMethod, getQuery, setResponseHeader, setResponseStatus, } from "h3";
 import { getH3App } from "../server/framework-request-handler.js";
@@ -19,6 +21,8 @@ import { getSession } from "../server/auth.js";
 import { getAllSettings } from "../settings/store.js";
 import { loadMcpConfig, autoDetectMcpConfig } from "./config.js";
 import { formatMcpConnectError } from "./errors.js";
+import { BUILTIN_MCP_CAPABILITIES, getBuiltinMcpCapability, isBuiltinMcpCapabilityAvailable, normalizeBuiltinMcpCapabilityIds, toBuiltinMcpServerConfig, } from "./builtin-capabilities.js";
+import { builtinMcpCapabilitiesSettingsKey, listEnabledBuiltinMcpCapabilities, setBuiltinMcpCapabilityEnabled, setEnabledBuiltinMcpCapabilities, } from "./builtin-store.js";
 import { addRemoteServer, listRemoteServers, mergedConfigKey, removeRemoteServer, toHttpServerConfigAsync, validateRemoteUrl, } from "./remote-store.js";
 import { fetchHubServers } from "./hub-client.js";
 export { formatMcpConnectError } from "./errors.js";
@@ -58,6 +62,18 @@ function statusFor(manager, mergedId) {
     }
     return { state: "unknown" };
 }
+function pseudoStoredBuiltin(capability) {
+    return {
+        id: `builtin_${capability.id}`,
+        name: capability.serverId,
+        url: `builtin:${capability.id}`,
+        description: capability.description,
+        createdAt: 0,
+    };
+}
+export function builtinMergedConfigKey(scope, capability, ownerId) {
+    return mergedConfigKey(scope, pseudoStoredBuiltin(capability), ownerId);
+}
 /**
  * Build the merged MCP config the manager should run with: file/env config
  * plus **every** user-scope and org-scope remote server persisted in the
@@ -102,6 +118,34 @@ export async function buildMergedConfig() {
                 await toHttpServerConfigAsync(scope, ownerId, stored);
         }
     }
+    for (const [fullKey, value] of Object.entries(all)) {
+        const settingsKey = builtinMcpCapabilitiesSettingsKey();
+        const userMatch = new RegExp(`^u:([^:]+):${settingsKey}$`).exec(fullKey);
+        const orgMatch = new RegExp(`^o:([^:]+):${settingsKey}$`).exec(fullKey);
+        let scope = null;
+        let ownerId = null;
+        if (userMatch) {
+            scope = "user";
+            ownerId = userMatch[1];
+        }
+        else if (orgMatch) {
+            scope = "org";
+            ownerId = orgMatch[1];
+        }
+        if (!scope || !ownerId)
+            continue;
+        const enabledIds = normalizeBuiltinMcpCapabilityIds(Array.isArray(value.enabledIds)
+            ? value.enabledIds.map(String)
+            : []);
+        for (const id of enabledIds) {
+            const capability = getBuiltinMcpCapability(id);
+            if (!capability || !isBuiltinMcpCapabilityAvailable(capability)) {
+                continue;
+            }
+            servers[builtinMergedConfigKey(scope, capability, ownerId)] =
+                toBuiltinMcpServerConfig(capability);
+        }
+    }
     // Hub-consume: if this app is configured to consume from a remote hub
     // (AGENT_NATIVE_MCP_HUB_URL + AGENT_NATIVE_MCP_HUB_TOKEN), pull its
     // org-scope servers and merge. Hub entries use `hub_<orgId>_<name>` so
@@ -188,11 +232,156 @@ export function mountMcpServersRoutes(nitroApp, manager) {
             setResponseStatus(event, 404);
             return { error: "Not found" };
         }));
+        getH3App(nitroApp).use("/_agent-native/mcp/builtin", defineEventHandler(async (event) => {
+            const method = getMethod(event);
+            const pathname = (event.url?.pathname || "")
+                .replace(/^\/+/, "")
+                .replace(/\/+$/, "");
+            const parts = pathname ? pathname.split("/") : [];
+            setResponseHeader(event, "Content-Type", "application/json");
+            if (parts.length === 0) {
+                if (method === "GET")
+                    return handleBuiltinList(event, manager);
+                if (method === "POST")
+                    return handleBuiltinUpdate(event, manager);
+                setResponseStatus(event, 405);
+                return { error: "Method not allowed" };
+            }
+            setResponseStatus(event, 404);
+            return { error: "Not found" };
+        }));
     }
     catch (err) {
-        console.warn(`[mcp-client] Failed to mount /_agent-native/mcp/servers: ${err?.message ?? err}`);
+        console.warn(`[mcp-client] Failed to mount MCP routes: ${err?.message ?? err}`);
     }
 }
+async function handleBuiltinList(event, manager) {
+    const { email, orgId, role } = await resolveContextForRequest(event);
+    const userEnabled = email
+        ? await listEnabledBuiltinMcpCapabilities("user", email)
+        : [];
+    const orgEnabled = orgId
+        ? await listEnabledBuiltinMcpCapabilities("org", orgId)
+        : [];
+    return {
+        capabilities: BUILTIN_MCP_CAPABILITIES.map((capability) => {
+            const available = isBuiltinMcpCapabilityAvailable(capability);
+            const userMergedId = email
+                ? builtinMergedConfigKey("user", capability, email)
+                : undefined;
+            const orgMergedId = orgId
+                ? builtinMergedConfigKey("org", capability, orgId)
+                : undefined;
+            return {
+                id: capability.id,
+                serverId: capability.serverId,
+                name: capability.name,
+                description: capability.description,
+                command: capability.command,
+                args: capability.args,
+                exclusiveGroup: capability.exclusiveGroup,
+                available,
+                unavailableReason: available
+                    ? undefined
+                    : `Only available on ${capability.platforms?.join(", ")}`,
+                notes: capability.notes,
+                enabled: {
+                    user: userEnabled.includes(capability.id),
+                    org: orgEnabled.includes(capability.id),
+                },
+                mergedIds: {
+                    user: userMergedId,
+                    org: orgMergedId,
+                },
+                status: {
+                    user: userMergedId && userEnabled.includes(capability.id)
+                        ? statusFor(manager, userMergedId)
+                        : undefined,
+                    org: orgMergedId && orgEnabled.includes(capability.id)
+                        ? statusFor(manager, orgMergedId)
+                        : undefined,
+                },
+            };
+        }),
+        user: { enabledIds: userEnabled },
+        org: { enabledIds: orgEnabled, orgId, role },
+    };
+}
+async function handleBuiltinUpdate(event, manager) {
+    const body = (await readBody(event).catch(() => ({})));
+    const scope = body.scope === "org" ? "org" : body.scope === "user" ? "user" : null;
+    if (!scope) {
+        setResponseStatus(event, 400);
+        return { error: 'scope must be "user" or "org"' };
+    }
+    const { email, orgId, role } = await resolveContextForRequest(event);
+    let scopeId = null;
+    if (scope === "user") {
+        scopeId = email;
+    }
+    else {
+        if (!orgId) {
+            setResponseStatus(event, 400);
+            return {
+                error: "You must belong to an organization to change org-scope built-ins",
+            };
+        }
+        if (role !== "owner" && role !== "admin") {
+            setResponseStatus(event, 403);
+            return {
+                error: "Only owners and admins can change org-scope MCP built-ins",
+            };
+        }
+        scopeId = orgId;
+    }
+    if (!scopeId) {
+        setResponseStatus(event, 401);
+        return { error: "Authentication required" };
+    }
+    if (Array.isArray(body.enabledIds)) {
+        for (const rawId of body.enabledIds) {
+            const error = validateBuiltinCapabilityForEnable(String(rawId));
+            if (error) {
+                setResponseStatus(event, 400);
+                return { error };
+            }
+        }
+        await setEnabledBuiltinMcpCapabilities(scope, scopeId, body.enabledIds.map(String));
+    }
+    else if (typeof body.id === "string" && typeof body.enabled === "boolean") {
+        if (body.enabled) {
+            const error = validateBuiltinCapabilityForEnable(body.id);
+            if (error) {
+                setResponseStatus(event, 400);
+                return { error };
+            }
+        }
+        else if (!getBuiltinMcpCapability(body.id)) {
+            setResponseStatus(event, 400);
+            return { error: `Unknown built-in MCP capability "${body.id}"` };
+        }
+        const result = await setBuiltinMcpCapabilityEnabled(scope, scopeId, body.id, body.enabled);
+        if (!result) {
+            setResponseStatus(event, 400);
+            return { error: `Unknown built-in MCP capability "${body.id}"` };
+        }
+    }
+    else {
+        setResponseStatus(event, 400);
+        return { error: "Provide enabledIds or id + enabled" };
+    }
+    await reconfigureManager(manager);
+    return handleBuiltinList(event, manager);
+}
+function validateBuiltinCapabilityForEnable(id) {
+    const capability = getBuiltinMcpCapability(id);
+    if (!capability)
+        return `Unknown built-in MCP capability "${id}"`;
+    if (!isBuiltinMcpCapabilityAvailable(capability)) {
+        return `${capability.name} is only available on ${capability.platforms?.join(", ")}`;
+    }
+    return null;
+}
 async function handleList(event, manager) {
     const { email, orgId, role } = await resolveContextForRequest(event);
     const userServers = email ? await listRemoteServers("user", email) : [];
@@ -296,6 +485,11 @@ async function handleDelete(event, manager, id) {
     return { ok: true };
 }
 async function handleTestUrl(event) {
+    const { email, orgId } = await resolveContextForRequest(event);
+    if (!email && !orgId) {
+        setResponseStatus(event, 401);
+        return { error: "Authentication required" };
+    }
     const body = (await readBody(event).catch(() => ({})));
     const url = typeof body.url === "string" ? body.url : "";
     const check = validateRemoteUrl(url);