@agentvault/agentvault 0.17.3 → 0.17.5

package/dist/openclaw-entry.js

@@ -14,6 +14,178 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/http-handlers.ts
+var http_handlers_exports = {};
+__export(http_handlers_exports, {
+  handleActionRequest: () => handleActionRequest,
+  handleDecisionRequest: () => handleDecisionRequest,
+  handleMcpConfigRequest: () => handleMcpConfigRequest,
+  handleSendRequest: () => handleSendRequest,
+  handleStatusRequest: () => handleStatusRequest,
+  handleTargetsRequest: () => handleTargetsRequest
+});
+async function handleSendRequest(parsed, channel) {
+  const text = parsed.text;
+  if (!text || typeof text !== "string") {
+    return { status: 400, body: { ok: false, error: "Missing 'text' field" } };
+  }
+  try {
+    let target;
+    let a2aTarget = parsed.hub_address ?? parsed.a2a_address ?? parsed.a2aAddress;
+    if (!a2aTarget && parsed.channel_id && typeof parsed.channel_id === "string") {
+      const hubAddr = channel.resolveA2AChannelHub(parsed.channel_id);
+      if (hubAddr) a2aTarget = hubAddr;
+    }
+    if (a2aTarget && typeof a2aTarget === "string") {
+      target = { kind: "a2a", hubAddress: a2aTarget };
+    } else if (typeof parsed.room_id === "string") {
+      target = { kind: "room", roomId: parsed.room_id };
+    } else if (parsed.target === "context") {
+      target = { kind: "context" };
+    } else if (parsed.file_path && typeof parsed.file_path === "string") {
+      const receipt2 = await channel.deliver(
+        { kind: "owner" },
+        { type: "attachment", text, filePath: parsed.file_path },
+        { topicId: parsed.topicId }
+      );
+      return {
+        status: receipt2.ok ? 200 : 500,
+        body: {
+          ok: receipt2.ok,
+          destination: receipt2.destination,
+          ...receipt2.error ? { error: receipt2.error } : {}
+        }
+      };
+    } else {
+      target = { kind: "owner" };
+    }
+    const receipt = await channel.deliver(
+      target,
+      { type: "text", text },
+      {
+        topicId: parsed.topicId,
+        priority: parsed.priority,
+        metadata: {
+          ...parsed.metadata,
+          ...parsed.message_type ? { message_type: parsed.message_type } : {}
+        }
+      }
+    );
+    return {
+      status: receipt.ok ? 200 : 500,
+      body: {
+        ok: receipt.ok,
+        destination: receipt.destination,
+        ...receipt.error ? { error: receipt.error } : {}
+      }
+    };
+  } catch (err) {
+    return { status: 500, body: { ok: false, error: String(err) } };
+  }
+}
+async function handleActionRequest(parsed, channel) {
+  if (!parsed.action || typeof parsed.action !== "string") {
+    return { status: 400, body: { ok: false, error: "Missing 'action' field" } };
+  }
+  try {
+    const confirmation = {
+      action: parsed.action,
+      status: parsed.status ?? "completed",
+      decisionId: parsed.decision_id,
+      detail: parsed.detail,
+      estimated_cost: parsed.estimated_cost
+    };
+    const target = parsed.room_id && typeof parsed.room_id === "string" ? { kind: "room", roomId: parsed.room_id } : { kind: "owner" };
+    const receipt = await channel.deliver(
+      target,
+      { type: "action_confirmation", confirmation }
+    );
+    return {
+      status: receipt.ok ? 200 : 500,
+      body: {
+        ok: receipt.ok,
+        destination: receipt.destination,
+        ...receipt.error ? { error: receipt.error } : {}
+      }
+    };
+  } catch (err) {
+    return { status: 500, body: { ok: false, error: String(err) } };
+  }
+}
+async function handleDecisionRequest(parsed, channel) {
+  const title = parsed.title;
+  if (!title || typeof title !== "string") {
+    return { status: 400, body: { ok: false, error: "Missing 'title' field" } };
+  }
+  const options = parsed.options;
+  if (!Array.isArray(options) || options.length < 2) {
+    return { status: 400, body: { ok: false, error: "'options' must be an array with at least 2 items" } };
+  }
+  for (const opt of options) {
+    if (!opt || typeof opt !== "object" || !opt.option_id || !opt.label) {
+      return { status: 400, body: { ok: false, error: "Each option must have 'option_id' and 'label'" } };
+    }
+  }
+  try {
+    const decision_id = await channel.sendDecisionRequest({
+      title,
+      description: parsed.description,
+      options,
+      context_refs: parsed.context_refs,
+      deadline: parsed.deadline,
+      auto_action: parsed.auto_action
+    });
+    return { status: 200, body: { ok: true, decision_id } };
+  } catch (err) {
+    return { status: 500, body: { ok: false, error: String(err) } };
+  }
+}
+function handleStatusRequest(channel) {
+  return {
+    status: 200,
+    body: {
+      ok: true,
+      state: channel.state,
+      deviceId: channel.deviceId ?? void 0,
+      sessions: channel.sessionCount
+    }
+  };
+}
+function handleTargetsRequest(channel) {
+  return {
+    status: 200,
+    body: {
+      ok: true,
+      targets: channel.listTargets(),
+      context: channel.lastInboundRoomId ? { kind: "room", roomId: channel.lastInboundRoomId } : { kind: "owner" }
+    }
+  };
+}
+function handleMcpConfigRequest(agentName, port, mcpSkillCount) {
+  return {
+    status: 200,
+    body: {
+      mcpServers: {
+        [`agentvault-${agentName}`]: {
+          url: `http://127.0.0.1:${port}/mcp`
+        }
+      },
+      _meta: {
+        agent: agentName,
+        skills_count: mcpSkillCount,
+        transport: "streamable-http",
+        auth: "none (localhost)",
+        instructions: "Add the mcpServers block to your MCP configuration file (e.g., .mcp.json or mcp_config.json)"
+      }
+    }
+  };
+}
+var init_http_handlers = __esm({
+  "src/http-handlers.ts"() {
+    "use strict";
+  }
+});
+
 // src/openclaw-compat.ts
 var openclaw_compat_exports = {};
 __export(openclaw_compat_exports, {
@@ -90,8 +262,385 @@ var init_openclaw_compat = __esm({
   }
 });
 
+// src/mcp-server.ts
+var mcp_server_exports = {};
+__export(mcp_server_exports, {
+  AgentVaultMcpServer: () => AgentVaultMcpServer
+});
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+var AgentVaultMcpServer;
+var init_mcp_server = __esm({
+  "src/mcp-server.ts"() {
+    "use strict";
+    AgentVaultMcpServer = class {
+      server;
+      skills = /* @__PURE__ */ new Map();
+      opts;
+      initialized = false;
+      constructor(opts) {
+        this.opts = opts;
+        this.server = new McpServer({
+          name: `agentvault-${opts.agentName}`,
+          version: "1.0.0"
+        });
+      }
+      /* ---- Skill registration ------------------------------------------------ */
+      /**
+       * Register a skill that will be exposed as an MCP tool.
+       * Must be called *before* `initialize()`.
+       */
+      registerSkill(skill) {
+        this.skills.set(skill.name, skill);
+      }
+      /**
+       * Register all skills as MCP tools / resources / prompts.
+       * Called lazily on first request if not called explicitly.
+       */
+      initialize() {
+        if (this.initialized) return;
+        for (const [name, skill] of this.skills) {
+          this.registerToolForSkill(name, skill);
+        }
+        this.server.resource(
+          "skills-registry",
+          "skills://registry",
+          { description: "List of all registered agent skills", mimeType: "application/json" },
+          async () => {
+            const registry = Array.from(this.skills.values()).map((s) => ({
+              name: s.name,
+              version: s.version,
+              description: s.description,
+              tags: s.tags,
+              sla: s.slaDefinition,
+              hasSchema: !!s.inputSchema,
+              hasInstructions: !!s.instructions,
+              certificationTier: s.certificationTier,
+              modelRouting: s.modelRouting,
+              allowedModels: s.allowedModels,
+              hasToolPolicy: !!(s.toolsAllowed || s.toolsDenied),
+              hasOutputSchema: !!s.outputSchema,
+              requiredPolicies: s.requiredPolicies
+            }));
+            return {
+              contents: [{
+                uri: "skills://registry",
+                mimeType: "application/json",
+                text: JSON.stringify(registry, null, 2)
+              }]
+            };
+          }
+        );
+        for (const [name, skill] of this.skills) {
+          if (skill.instructions) {
+            this.server.prompt(
+              name,
+              skill.description ?? `Instructions for ${name}`,
+              () => ({
+                messages: [{
+                  role: "user",
+                  content: { type: "text", text: skill.instructions }
+                }]
+              })
+            );
+          }
+        }
+        this.initialized = true;
+      }
+      /* ---- HTTP request handler ---------------------------------------------- */
+      /**
+       * Handle an incoming HTTP request to the /mcp endpoint.
+       *
+       * Supports the Streamable HTTP transport protocol:
+       * - POST for JSON-RPC messages
+       * - GET  for SSE notification stream
+       * - DELETE for session close
+       *
+       * Each request gets a fresh stateless transport; after the response is
+       * flushed the transport + underlying protocol connection are torn down
+       * so the single McpServer instance is ready for the next caller.
+       *
+       * Local requests from 127.0.0.1/::1 bypass SPT validation (owner access).
+       */
+      async handleRequest(req, res) {
+        if (!this.initialized) {
+          this.initialize();
+        }
+        const remote = req.socket?.remoteAddress;
+        const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+        if (!isLocal) {
+          const authHeader = req.headers.authorization;
+          if (!authHeader?.startsWith("Bearer ")) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Missing or invalid Authorization header" }));
+            return;
+          }
+          const token = authHeader.slice(7);
+          const valid = await this.validateSpt(token);
+          if (!valid) {
+            res.writeHead(403, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Invalid or expired SPT token" }));
+            return;
+          }
+        }
+        const transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: void 0
+          // stateless
+        });
+        await this.server.connect(transport);
+        try {
+          await transport.handleRequest(req, res);
+        } finally {
+          await transport.close();
+        }
+      }
+      /* ---- Private helpers --------------------------------------------------- */
+      /**
+       * Register a single skill as an MCP tool.
+       *
+       * The MCP SDK's `tool()` overloads that accept a schema expect Zod types.
+       * Since our skill definitions use raw JSON Schema we register without
+       * schema validation (name + description + handler) and let the handler
+       * receive the raw args object.
+       */
+      registerToolForSkill(name, skill) {
+        const description = skill.description ?? `AgentVault skill: ${name}`;
+        this.server.tool(
+          name,
+          description,
+          async (args) => {
+            if (!this.opts.onInvoke) {
+              return {
+                content: [{ type: "text", text: `Skill "${name}" invoked but no handler registered` }]
+              };
+            }
+            try {
+              const result = await this.opts.onInvoke(name, args);
+              const text = typeof result === "string" ? result : JSON.stringify(result, null, 2);
+              return {
+                content: [{ type: "text", text }]
+              };
+            } catch (err) {
+              const message = err instanceof Error ? err.message : String(err);
+              return {
+                content: [{ type: "text", text: `Error invoking skill "${name}": ${message}` }],
+                isError: true
+              };
+            }
+          }
+        );
+      }
+      /**
+       * Validate a Service Provider Token against the AgentVault backend.
+       */
+      async validateSpt(token) {
+        try {
+          const url = `${this.opts.apiUrl}/api/v1/capabilities/introspect`;
+          const headers = {
+            "Content-Type": "application/json"
+          };
+          if (this.opts.apiKey) {
+            headers["Authorization"] = `Bearer ${this.opts.apiKey}`;
+          }
+          const resp = await fetch(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ token })
+          });
+          if (!resp.ok) return false;
+          const data = await resp.json();
+          return data.active === true;
+        } catch {
+          return false;
+        }
+      }
+      /* ---- Accessors --------------------------------------------------------- */
+      get skillCount() {
+        return this.skills.size;
+      }
+      get isInitialized() {
+        return this.initialized;
+      }
+    };
+  }
+});
+
+// src/skill-manifest.ts
+var skill_manifest_exports = {};
+__export(skill_manifest_exports, {
+  loadSkillsFromApi: () => loadSkillsFromApi,
+  loadSkillsFromDirectory: () => loadSkillsFromDirectory,
+  mergeSkills: () => mergeSkills,
+  parseSkillMd: () => parseSkillMd
+});
+import { readFileSync, existsSync, readdirSync } from "node:fs";
+import { resolve, join } from "node:path";
+function parseSkillMd(content) {
+  const lines = content.split("\n");
+  if (lines[0]?.trim() !== "---") return null;
+  let endIdx = -1;
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i]?.trim() === "---") {
+      endIdx = i;
+      break;
+    }
+  }
+  if (endIdx === -1) return null;
+  const frontmatterLines = lines.slice(1, endIdx);
+  const frontmatter = parseSimpleYaml(frontmatterLines.join("\n"));
+  if (!frontmatter.name) return null;
+  const instructionLines = lines.slice(endIdx + 1);
+  const instructions = instructionLines.join("\n").trim();
+  const skill = {
+    name: frontmatter.name,
+    version: frontmatter.version,
+    description: frontmatter.description,
+    tags: frontmatter.tags,
+    inputSchema: frontmatter.schema,
+    slaDefinition: frontmatter.sla,
+    instructions: instructions || void 0
+  };
+  if (frontmatter.agentVault) {
+    const av = frontmatter.agentVault;
+    if (av.certification) skill.certificationTier = av.certification;
+    if (av.runtime?.capabilities) skill.toolsAllowed = av.runtime.capabilities;
+    if (av.runtime?.forbidden) skill.toolsDenied = av.runtime.forbidden;
+    if (av.runtime?.output_schema) skill.outputSchema = av.runtime.output_schema;
+    if (av.model?.routing) skill.modelRouting = av.model.routing;
+    if (av.model?.allowed) skill.allowedModels = av.model.allowed;
+    if (av.model?.default) skill.defaultModel = av.model.default;
+    if (av.integrity) skill.integrity = av.integrity;
+    if (av.requiredPolicies) skill.requiredPolicies = av.requiredPolicies;
+  }
+  return skill;
+}
+function parseSimpleYaml(yaml) {
+  const result = {};
+  const lines = yaml.split("\n");
+  const stack = [];
+  let currentObj = result;
+  function parseValue(raw) {
+    const value = raw.replace(/^["']|["']$/g, "");
+    const num = Number(value);
+    if (!isNaN(num) && value !== "") return num;
+    if (value === "true") return true;
+    if (value === "false") return false;
+    return value;
+  }
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    while (stack.length > 0 && indent <= stack[stack.length - 1].indent) {
+      const popped = stack.pop();
+      currentObj = stack.length > 0 ? stack[stack.length - 1].obj : result;
+      currentObj[popped.key] = popped.obj;
+    }
+    const inlineArrayMatch = trimmed.match(/^(\w[\w_-]*)\s*:\s*\[(.+)\]$/);
+    if (inlineArrayMatch) {
+      const key = inlineArrayMatch[1];
+      const values = inlineArrayMatch[2].split(",").map((v) => v.trim().replace(/^["']|["']$/g, ""));
+      if (stack.length > 0) {
+        stack[stack.length - 1].obj[key] = values;
+      } else {
+        currentObj[key] = values;
+      }
+      continue;
+    }
+    const kvMatch = trimmed.match(/^(\w[\w_-]*)\s*:\s*(.+)$/);
+    if (kvMatch) {
+      const key = kvMatch[1];
+      const val = parseValue(kvMatch[2]);
+      if (stack.length > 0) {
+        stack[stack.length - 1].obj[key] = val;
+      } else {
+        currentObj[key] = val;
+      }
+      continue;
+    }
+    const nestedMatch = trimmed.match(/^(\w[\w_-]*)\s*:$/);
+    if (nestedMatch) {
+      const key = nestedMatch[1];
+      const newObj = {};
+      stack.push({ key, obj: newObj, indent });
+      continue;
+    }
+  }
+  while (stack.length > 0) {
+    const popped = stack.pop();
+    const parent = stack.length > 0 ? stack[stack.length - 1].obj : result;
+    parent[popped.key] = popped.obj;
+  }
+  return result;
+}
+function loadSkillsFromDirectory(dir) {
+  const skills = [];
+  const absDir = resolve(dir);
+  if (!existsSync(absDir)) return skills;
+  const rootSkill = join(absDir, "SKILL.md");
+  if (existsSync(rootSkill)) {
+    const content = readFileSync(rootSkill, "utf-8");
+    const skill = parseSkillMd(content);
+    if (skill) skills.push(skill);
+  }
+  try {
+    const entries = readdirSync(absDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        const subSkill = join(absDir, entry.name, "SKILL.md");
+        if (existsSync(subSkill)) {
+          const content = readFileSync(subSkill, "utf-8");
+          const skill = parseSkillMd(content);
+          if (skill) skills.push(skill);
+        }
+      }
+    }
+  } catch {
+  }
+  return skills;
+}
+async function loadSkillsFromApi(apiUrl, apiKey, hubId) {
+  try {
+    const res = await fetch(`${apiUrl}/api/v1/hub/identities/${hubId}/skills`, {
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.map((cap) => ({
+      name: cap.capability_name,
+      version: cap.capability_version,
+      description: cap.description,
+      inputSchema: cap.schema_definition,
+      slaDefinition: cap.sla_definition,
+      tags: cap.tags,
+      instructions: cap.instructions
+    }));
+  } catch {
+    return [];
+  }
+}
+function mergeSkills(local, remote) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const skill of remote) {
+    byName.set(skill.name, skill);
+  }
+  for (const skill of local) {
+    byName.set(skill.name, skill);
+  }
+  const source = local.length > 0 && remote.length > 0 ? "merged" : local.length > 0 ? "local" : "remote";
+  return {
+    skills: Array.from(byName.values()),
+    source
+  };
+}
+var init_skill_manifest = __esm({
+  "src/skill-manifest.ts"() {
+    "use strict";
+  }
+});
+
 // src/openclaw-entry.ts
-import { resolve } from "node:path";
+import { resolve as pathResolve } from "node:path";
 import { randomBytes } from "node:crypto";
 
 // src/account-config.ts
@@ -289,146 +838,8 @@ function runWithTraceContext(ctx, fn) {
   return traceStore.run(ctx, fn);
 }
 
-// src/http-handlers.ts
-async function handleSendRequest(parsed, channel) {
-  const text = parsed.text;
-  if (!text || typeof text !== "string") {
-    return { status: 400, body: { ok: false, error: "Missing 'text' field" } };
-  }
-  try {
-    let target;
-    let a2aTarget = parsed.hub_address ?? parsed.a2a_address ?? parsed.a2aAddress;
-    if (!a2aTarget && parsed.channel_id && typeof parsed.channel_id === "string") {
-      const hubAddr = channel.resolveA2AChannelHub(parsed.channel_id);
-      if (hubAddr) a2aTarget = hubAddr;
-    }
-    if (a2aTarget && typeof a2aTarget === "string") {
-      target = { kind: "a2a", hubAddress: a2aTarget };
-    } else if (typeof parsed.room_id === "string") {
-      target = { kind: "room", roomId: parsed.room_id };
-    } else if (parsed.target === "context") {
-      target = { kind: "context" };
-    } else if (parsed.file_path && typeof parsed.file_path === "string") {
-      const receipt2 = await channel.deliver(
-        { kind: "owner" },
-        { type: "attachment", text, filePath: parsed.file_path },
-        { topicId: parsed.topicId }
-      );
-      return {
-        status: receipt2.ok ? 200 : 500,
-        body: {
-          ok: receipt2.ok,
-          destination: receipt2.destination,
-          ...receipt2.error ? { error: receipt2.error } : {}
-        }
-      };
-    } else {
-      target = { kind: "owner" };
-    }
-    const receipt = await channel.deliver(
-      target,
-      { type: "text", text },
-      {
-        topicId: parsed.topicId,
-        priority: parsed.priority,
-        metadata: {
-          ...parsed.metadata,
-          ...parsed.message_type ? { message_type: parsed.message_type } : {}
-        }
-      }
-    );
-    return {
-      status: receipt.ok ? 200 : 500,
-      body: {
-        ok: receipt.ok,
-        destination: receipt.destination,
-        ...receipt.error ? { error: receipt.error } : {}
-      }
-    };
-  } catch (err) {
-    return { status: 500, body: { ok: false, error: String(err) } };
-  }
-}
-async function handleActionRequest(parsed, channel) {
-  if (!parsed.action || typeof parsed.action !== "string") {
-    return { status: 400, body: { ok: false, error: "Missing 'action' field" } };
-  }
-  try {
-    const confirmation = {
-      action: parsed.action,
-      status: parsed.status ?? "completed",
-      decisionId: parsed.decision_id,
-      detail: parsed.detail,
-      estimated_cost: parsed.estimated_cost
-    };
-    const target = parsed.room_id && typeof parsed.room_id === "string" ? { kind: "room", roomId: parsed.room_id } : { kind: "owner" };
-    const receipt = await channel.deliver(
-      target,
-      { type: "action_confirmation", confirmation }
-    );
-    return {
-      status: receipt.ok ? 200 : 500,
-      body: {
-        ok: receipt.ok,
-        destination: receipt.destination,
-        ...receipt.error ? { error: receipt.error } : {}
-      }
-    };
-  } catch (err) {
-    return { status: 500, body: { ok: false, error: String(err) } };
-  }
-}
-async function handleDecisionRequest(parsed, channel) {
-  const title = parsed.title;
-  if (!title || typeof title !== "string") {
-    return { status: 400, body: { ok: false, error: "Missing 'title' field" } };
-  }
-  const options = parsed.options;
-  if (!Array.isArray(options) || options.length < 2) {
-    return { status: 400, body: { ok: false, error: "'options' must be an array with at least 2 items" } };
-  }
-  for (const opt of options) {
-    if (!opt || typeof opt !== "object" || !opt.option_id || !opt.label) {
-      return { status: 400, body: { ok: false, error: "Each option must have 'option_id' and 'label'" } };
-    }
-  }
-  try {
-    const decision_id = await channel.sendDecisionRequest({
-      title,
-      description: parsed.description,
-      options,
-      context_refs: parsed.context_refs,
-      deadline: parsed.deadline,
-      auto_action: parsed.auto_action
-    });
-    return { status: 200, body: { ok: true, decision_id } };
-  } catch (err) {
-    return { status: 500, body: { ok: false, error: String(err) } };
-  }
-}
-function handleStatusRequest(channel) {
-  return {
-    status: 200,
-    body: {
-      ok: true,
-      state: channel.state,
-      deviceId: channel.deviceId ?? void 0,
-      sessions: channel.sessionCount
-    }
-  };
-}
-function handleTargetsRequest(channel) {
-  return {
-    status: 200,
-    body: {
-      ok: true,
-      targets: channel.listTargets(),
-      context: channel.lastInboundRoomId ? { kind: "room", roomId: channel.lastInboundRoomId } : { kind: "owner" }
-    }
-  };
-}
-
 // src/openclaw-entry.ts
+init_http_handlers();
 init_openclaw_compat();
 
 // src/types.ts
@@ -1104,7 +1515,7 @@ var agentVaultPlugin = {
           "AgentVault channel not configured. Run: npx @agentvault/agentvault setup --token=av_tok_...\nThen restart OpenClaw."
         );
       }
-      const dataDir = resolve(account.dataDir.replace(/^~/, __require("node:os").homedir()));
+      const dataDir = pathResolve(account.dataDir.replace(/^~/, __require("node:os").homedir()));
       _log?.(`[AgentVault] starting (dataDir=${dataDir})`);
       await new Promise((resolve2, reject) => {
         let channel;
@@ -1114,7 +1525,7 @@ var agentVaultPlugin = {
           resolve2();
         };
         abortSignal?.addEventListener("abort", () => void onAbort());
-        import("./index.js").then(({ SecureChannel }) => {
+        import("./index.js").then(async ({ SecureChannel }) => {
           channel = new SecureChannel({
             inviteToken: "",
             dataDir,
@@ -1193,6 +1604,38 @@ var agentVaultPlugin = {
           channel.on("error", (err) => {
             _log?.(`[AgentVault] channel error (non-fatal): ${String(err)}`);
           });
+          try {
+            const { AgentVaultMcpServer: AgentVaultMcpServer2 } = await Promise.resolve().then(() => (init_mcp_server(), mcp_server_exports));
+            const { loadSkillsFromDirectory: loadSkillsFromDirectory2 } = await Promise.resolve().then(() => (init_skill_manifest(), skill_manifest_exports));
+            const mcpServer = new AgentVaultMcpServer2({
+              agentName: account.agentName ?? "agent",
+              apiUrl: account.apiUrl ?? "https://api.agentvault.chat",
+              onInvoke: async (skillName, args) => {
+                const text = JSON.stringify({ skill: skillName, args });
+                const receipt = await channel.deliver(
+                  { kind: "owner" },
+                  { type: "text", text },
+                  { metadata: { message_type: "skill_invocation", skill_name: skillName } }
+                );
+                return { invoked: true, skill: skillName, delivered: receipt.ok };
+              }
+            });
+            const workspaceDir = dataDir;
+            const skills = loadSkillsFromDirectory2(workspaceDir);
+            for (const skill of skills) {
+              mcpServer.registerSkill(skill);
+            }
+            const skillsSubDir = pathResolve(dataDir, "skills");
+            const subDirSkills = loadSkillsFromDirectory2(skillsSubDir);
+            for (const skill of subDirSkills) {
+              mcpServer.registerSkill(skill);
+            }
+            mcpServer.initialize();
+            channel.setMcpServer(mcpServer);
+            _log?.(`[AgentVault] MCP server activated with ${mcpServer.skillCount} skill(s)`);
+          } catch (err) {
+            _log?.(`[AgentVault] MCP server activation failed (non-fatal): ${String(err)}`);
+          }
           const httpPort = account.httpPort ?? 18790;
           channel.on("ready", () => {
             channel.startHttpServer(httpPort);
@@ -1399,6 +1842,19 @@ var openclaw_entry_default = {
             return { status: result.status, body: result.body };
           }
         });
+        api.registerHttpRoute({
+          path: "/agentvault/mcp-config",
+          method: "GET",
+          handler: async () => {
+            const ch = _channels.values().next().value;
+            if (!ch) return { status: 503, body: { ok: false, error: "Channel not started" } };
+            const { handleMcpConfigRequest: handleMcpConfigRequest2 } = await Promise.resolve().then(() => (init_http_handlers(), http_handlers_exports));
+            const agentName = ch.config?.agentName ?? "agent";
+            const mcpSkillCount = ch.mcpServer?.skillCount ?? 0;
+            const result = handleMcpConfigRequest2(agentName, 18790, mcpSkillCount);
+            return { status: result.status, body: result.body };
+          }
+        });
         isUsingManagedRoutes = true;
       } catch {
       }