@agimon-ai/po-mcp 0.0.0-alpha.7 → 0.0.0-alpha.71

package/LICENSE

@@ -1,21 +1,149 @@
-MIT License
-
-Copyright (c) 2026 Vuong Ngo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             Agimon Pty Ltd
+Licensed Work:        Po, the software in the Po source repository and the
+                      packages released from it, in each version released by
+                      the Licensor.
+                      The Licensed Work is (c) 2026 Agimon Pty Ltd.
+                      Material identified as third-party in the "Third-party
+                      components" section at the end of this file or in a
+                      NOTICE file, and any package or directory whose own
+                      license file grants a different license, is not part of
+                      the Licensed Work and remains under its own license.
+Additional Use Grant: You may make production use of the Licensed Work if
+  your use is Eligible Use. "Eligible Use" is production use that falls
+  within at least one of the following:
+
+  (a) Personal Use. Use by an individual for their own personal purposes,
+      and not on behalf of, or for the benefit of, an employer, client, or
+      other Organization. Use by an individual in the course of employment
+      or engagement by an Organization is use by that Organization.
+
+  (b) Small Organization Use. Use by or on behalf of an Organization whose
+      Annual Revenue is less than USD 1,000,000.
+
+  (c) Non-profit, Education and Research Use. Use, regardless of Annual
+      Revenue, by (i) an Organization registered or recognized as a
+      non-profit or charitable organization under the laws of its
+      jurisdiction, for its non-profit purposes; (ii) an accredited school,
+      college, or university, for teaching, learning, or academic research;
+      or (iii) a publicly funded research institution, for its research.
+
+  (d) Service Provider Use. Use by a consultant, contractor, agency, or other
+      service provider, regardless of its own Annual Revenue, solely to
+      build, deploy, host, operate, or support the Licensed Work for a client
+      whose own use would be Eligible Use under (a), (b), or (c). A service
+      provider's use for its own purposes is Eligible Use only if the service
+      provider itself qualifies under (b) or (c).
+
+
+  Hosted services. Offering the Licensed Work to third parties as a hosted
+  or managed service whose primary value is the Licensed Work is Eligible
+  Use only if each such third party's own use would be Eligible Use.
+
+  Definitions. "Organization" means any company, partnership, sole
+  proprietorship, trust, association, government body, or other entity, and
+  includes an individual acting in a business or professional capacity.
+  "Affiliate" means any entity that directly or indirectly controls, is
+  controlled by, or is under common control with an Organization, where
+  "control" means ownership of more than 50% of the voting interests of an
+  entity or the power to direct its management and policies by contract or
+  otherwise. "Annual Revenue" means the total gross revenue of an
+  Organization and all of its Affiliates combined, from all sources and
+  whether or not related to the Licensed Work, for its most recently
+  completed fiscal year, or, if it has not completed a fiscal year, for the
+  twelve months before the use (or since its formation, if shorter),
+  converted into US dollars at the average exchange rate for that period.
+  Proceeds of equity or debt financing are not revenue.
+
+  Threshold. If an Organization stops qualifying under (b), its existing
+  production use remains Eligible Use for 90 days after it stops
+  qualifying, after which it must obtain a commercial license or stop
+  production use. Use that was Eligible Use when it occurred never requires
+  a commercial license after the fact.
+Change Date:          Four years from the date a version of the Licensed Work
+                      is first publicly released by the Licensor.
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed
+Work, please visit: https://agimon.ai/licensing
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -39,6 +39,18 @@ Repository `.mcp.json` entries describe direct MCP servers:
 }
 ```
 
+Your own servers live in `mcp.json` in your Po home (`~/.po/mcp.json`, or under `PO_HOME`), in the
+same shape. Po loads them into every repository's sessions, first, so a repository, plugin or
+domain entry with the same name wins.
+
+Add a server from the cockpit without editing either file: **Add server** on a repository's MCP
+servers page writes that repository's `.mcp.json`, and **Settings, MCP servers** writes your own
+config. Remote servers take a URL and optional headers. A local command also needs the trust
+confirmation, which the hub checks again. Adding never replaces an existing name or rewrites a
+file that is not valid JSON. Named header or environment values can be kept in the Po vault
+instead (`secretFields` on the add request): the vault is written first, the file gets
+`${vault:<server>-<field>}` in their place, and a failed file write removes the new secrets.
+Without a vault the request answers 503.
 Selected legacy plugins may also provide root `.mcp.json`. A schema-gated Agent Plugin v1 instead
 provides root `mcp.json`. Po validates its portable contract, supplies private persistent
 `PLUGIN_DATA`, and resolves plugin-relative stdio commands and working directories. It also
@@ -63,7 +75,7 @@ should load.
 
 Within Po, this package consumes the immutable `poMcpProjection` service published on the
 session Cordis root.
-Downstream clients run in-process through `@agimon-ai/mcp-proxy`; this adapter does not start its
+Downstream clients run in-process through `@agimon-ai/po-mcp-proxy`; this adapter does not start its
 Hono server.
 
 ## Direct tools and configured identity
@@ -81,12 +93,79 @@ original downstream tool name; tool prefixes are not parsed to route calls.
 Children borrow the parent runtime. Requested `mcp` or `mcp_use` groups expand into permitted
 direct tools; `mcpDirectTools` selectors (`*`, a configured server, or `server/tool`) narrow that
 set. Capability ceilings must explicitly allow MCP and still constrain the selected tools.
-Children cannot manage the parent's connections. Remote `mcp_use` remains a compatibility route,
-not the default native model declaration.
+The direct connection-management tool is main-agent-only. Borrowed trusted `exec` still uses
+parent-session bindings, including Help-only `mcpTest`. Remote `mcp_use` remains a compatibility
+route, not the default native model declaration.
 
-Full schemas cost context tokens. Select domains and child subsets rather than hiding tool
-availability or repeating catalogs in prompt prose. Codemode and tool search remain disabled;
-the Pi 1.0.0 source review did not measure savings or justify enabling them.
+Select domains and child subsets to control tool availability. Keep catalogs out of prompt prose.
+
+## Po MCP namespace
+
+Po's own `discover` and `exec` tools (`@agimon-ai/po-codemode`) enable the `mcp`
+namespace alongside namespaces such as `browser`. Pi's internal MCP codemode and tool
+search remain disabled. These are separate mechanisms, also distinct from code mode
+run by a remote MCP client. While code mode is bound, the main agent's direct tool
+declarations for these servers are withdrawn, since the namespace reaches every one and
+their schemas would only cost context; they show as inactive in Context. A tool that carries
+an MCP App keeps its direct tool for the inline UI. Without code mode every direct tool stays,
+and the `mcp_use` compatibility route remains. Native child sessions still receive the
+direct tools they are granted. The namespace does not change MCP access grants.
+
+The always-active `codemode-how-to-mcp` skill teaches agents this flow and, when loaded, lists the session's servers and tool names.
+
+Start with `discover({ namespace: 'mcp' })` to inspect the permitted catalog and typed
+signatures. If the declaration output exceeds 24,000 characters, narrow discovery
+with `discover({ query: 'github/search_issues' })` before calling a tool. Use only
+names and argument schemas returned by discovery, never guessed names.
+
+Inside `exec`, call a typed wrapper such as `await mcp.github.search_issues(args)`,
+where `args` matches the discovered input schema. Names are exact configured server
+and original tool names, not normalized direct-tool prefixes. Use bracket access
+for names that need it, for example `await mcp['work-github']['search-issues'](args)`.
+The generic route is `await mcp.call(server, tool, args)`, using the exact discovered
+server and tool names. Both routes use the same permitted session connections and
+admission checks as direct calls.
+
+Results expose `text`, `images`, `structuredContent`, and `blocks`. Inspect the text
+or structured content in the script; use `image(result)` to emit its images from
+`exec`. Upstream `isError` results reject with the upstream text rather than
+returning a successful result.
+
+Outbound file parameters still require consent. Time waiting for that consent counts
+against the `exec` timeout: 30 seconds by default, with `timeoutMs` up to 120 seconds.
+After a runtime swap, an old run cannot access the replacement runtime. Discover again
+and retry in a new `exec`, not in the old run.
+
+MCP Apps stay on direct tools so their inline UI and interaction lifecycle remain
+available. Use a direct call when an App is needed, not the namespace route.
+
+## Session-only URL test servers
+
+In Help mode, ask permission, then discover `mcpTest` and add a URL server:
+
+```ts
+await mcpTest.add({ name: 'test', url: 'https://example.com/mcp', type: 'http' });
+```
+
+HTTP and SSE servers accept optional headers and OAuth client settings. Sign-in links appear
+in the existing MCP panel. Add waits for completion and respects cancellation. With no code
+mode, the main-agent-only `mcp_test_server` tool supports `add`, `remove` and `list` instead.
+These management surfaces disappear when Help turns off, but connected test servers remain.
+`mcpTest.remove(name)` disconnects and forgets one while Help is on.
+
+Test server configuration, headers and credentials stay in memory, including across MCP
+reloads. They are not written to config, the Po vault, credential files or the shared tool cache,
+and a new session does not inherit them. They cannot replace configured names or override
+`--no-mcp`. Stdio and `/mcp add` are deliberately unsupported.
+
+Memory-only storage does not redact tool arguments or conversation history. Never paste
+literal secrets into management calls. Use `${ENV_VAR}` references from the session's
+admitted environment for sensitive headers or OAuth client settings.
+
+Configured-server credentials live in the Po vault (`po/vault`, namespace `mcp.oauth`). Without a
+vault they stay in memory and the session shows a diagnostic. Near-expiry tokens refresh before
+requests, with no idle timer. The vault's lease coordinates refresh across processes, so a
+rotating refresh token is spent once; memory stores synchronize only within their process.
 
 ## Inline Apps (development)
 
@@ -106,17 +185,17 @@ Reopening a widget reads its retained result and state, never reruns the origina
 built on the ChatGPT SDK work too. Only ChatGPT widgets receive `toolOutput` globals updates
 after their own `callTool`. Each App root gets a `light`/`dark` class, `data-theme` and
 `color-scheme` (an App's own class or `data-theme` is kept), and theme changes sync live.
-A tool result that rendered an App stays behind the card toggle unless the call failed.
+An MCP tool card starts collapsed; an App stays visible. Expanding the card shows the call's input, then its result.
 
 The ChatGPT adapter implements tool input/output and private metadata globals, globals
 updates, `callTool`, `setWidgetState`, `sendFollowUpMessage`, inline display mode, height,
 close, and confirmed external links. File libraries, checkout, accounts, modal/fullscreen
 modes, stable custom origins, sampling, and automatic model-context updates are unsupported.
 
-The runtime pins published `@agimon-ai/mcp-proxy@0.32.12` for Apps capability
-negotiation, private result capture before output guarding, and upstream request
-cancellation. Model-facing output remains guarded; retained App results are bounded
-separately. No local proxy dependency or spill-file reads are used.
+The runtime uses workspace-owned `@agimon-ai/po-mcp-proxy` from
+`packages/utils/po-mcp-proxy` for Apps capability negotiation, private result capture
+before output guarding, and upstream request cancellation. Model-facing output remains
+guarded; retained App results are bounded separately. No spill-file reads are used.
 
 Run from the repository root:
 
@@ -157,10 +236,26 @@ catalog and authorization APIs remain separate from this live-session view.
 Allowed stdio entries execute their configured commands with the Pi process environment and
 operating system privileges. Review configuration as executable code.
 
-OAuth credentials use the operating system keyring when available. The private-file fallback is
-stored under `~/.mcp-proxy/oauth` with owner-only permissions. Credentials remain machine-wide and
-keyed by server name, while their upstream URL binding prevents blind replay to another endpoint.
-Treat both the configuration and credential store as sensitive.
+OAuth credentials are encrypted entries in the Po vault. Each is keyed by scope and server name:
+`user` for your own `mcp.json`, `repository:<digest>` for a repository (keyed by its git common
+directory, so worktrees share it and separate clones do not), and the plugin's source id for a
+plugin. One server name at three levels therefore has three credentials. The upstream URL binding
+still prevents blind replay to another endpoint. Credentials saved earlier in the OS keyring or
+under `~/.mcp-proxy/oauth` are not read or migrated: authorize once more. Treat both the
+configuration and the vault as sensitive.
+
+`${vault:NAME}` references (`NAME` is 1 to 64 of `A-Z a-z 0-9 . _ -`) work in header values, env
+values and `bearerToken`. They are resolved when Po connects, on a copy of the configuration, so
+config files, the definitions cache and config hashes only ever hold the reference. A reference
+in `url`, `command`, `args` or `cwd` fails the connection. Secrets live in vault namespace
+`mcp.secret` under the same scopes as OAuth credentials, so a repository server never reads a
+user-scope secret. Each secret is bound to where it goes: a URL origin (https, or plain http only
+to this machine, with redirects refused), or a command plus its exact arguments. A changed origin,
+command or argument list reads as missing. A missing secret shows as "needs secret NAME" in the
+session MCP panel, which stores it through the session's owner-only `POST /secrets` route and
+reconnects the server. Compatibility frontends that read the same config files directly get the
+reference left unresolved. Literal values keep working. Any in-process plugin can read every
+vault namespace.
 
 The default OAuth callback is `http://127.0.0.1:19876/callback`. Authorization therefore requires the
 browser and Po runtime to share that loopback network namespace. A remote browser cannot complete
@@ -189,7 +284,7 @@ Maintained by [Agimon](https://agimon.ai/about).
 
 ## License
 
-MIT
+Business Source License 1.1: free for personal use, organisations under USD 1M revenue, non-profits and education. See [LICENSE](LICENSE) and https://agimon.ai/licensing.
 
 Named routed `src/extensions/` entries declare host contributions and delegate to services. MCP session state and connection behavior live in named service folders, and `src/exports/` exposes reusable public APIs.
 

package/dist/apiContracts.cjs

@@ -74,6 +74,51 @@ const McpSessionToolSchema = typebox.Type.Object({
 	inputSchema: typebox.Type.Record(S, typebox.Type.Unknown()),
 	tokens: N
 });
+const StringPairs = typebox.Type.Record(S, S);
+const McpServerEntrySchema = typebox.Type.Union([typebox.Type.Object({
+	type: typebox.Type.Literal("http"),
+	url: typebox.Type.String({ maxLength: 2048 }),
+	headers: O(StringPairs)
+}), typebox.Type.Object({
+	command: typebox.Type.String({
+		minLength: 1,
+		maxLength: 1024
+	}),
+	args: typebox.Type.Array(S),
+	env: O(StringPairs)
+})]);
+const McpAddServerSchema = typebox.Type.Object({
+	scope: literals(["repository", "global"]),
+	repositoryId: O(RepositoryId),
+	name: typebox.Type.String({ pattern: "^[A-Za-z0-9_-]{1,64}$" }),
+	entry: McpServerEntrySchema,
+	trusted: O(B),
+	secretFields: O(typebox.Type.Array(typebox.Type.String({
+		minLength: 1,
+		maxLength: 128
+	}), { maxItems: 64 }))
+});
+const SecretName = typebox.Type.String({ pattern: "^[A-Za-z0-9._-]{1,64}$" });
+const McpSupplySecretSchema = typebox.Type.Object({
+	server: typebox.Type.String({
+		minLength: 1,
+		maxLength: 160
+	}),
+	name: SecretName,
+	value: typebox.Type.String({
+		minLength: 1,
+		maxLength: 4096
+	})
+});
+const McpSupplySecretResultSchema = typebox.Type.Object({
+	server: S,
+	name: SecretName
+});
+const McpGlobalServersSchema = typebox.Type.Object({ servers: typebox.Type.Array(typebox.Type.Object({
+	name: S,
+	kind: literals(["remote", "local"]),
+	target: S
+})) });
 const SessionToolQuery = [{
 	name: "server",
 	in: "query",
@@ -95,76 +140,122 @@ const apiContracts = (0, _agimon_ai_po_core_apiContracts.defineApiContract)({
 	version: 1,
 	sockets: [],
 	dynamic: [],
-	http: [{
-		id: "mcp.session.tool",
-		scope: "session",
-		basePath: "mcp-session",
-		path: "/tool",
-		method: "GET",
-		authentication: "owner",
-		description: "Read one tool the session reaches through mcp_use: its description, schema, and token cost.",
-		parameters: SessionToolQuery,
-		responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpSessionToolSchema)
-	}, ...["global", "workspace"].flatMap((scope) => [
+	http: [
 		{
-			id: "mcp.catalog",
-			scope,
-			basePath: "mcp",
-			path: "/repository",
+			id: "mcp.session.tool",
+			scope: "session",
+			basePath: "mcp-session",
+			path: "/tool",
 			method: "GET",
 			authentication: "owner",
-			description: "Read the synced MCP repository catalog.",
-			parameters: RepositoryQuery,
-			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpCatalogSchema)
+			description: "Read one tool the session reaches through mcp_use: its description, schema, and token cost.",
+			parameters: SessionToolQuery,
+			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpSessionToolSchema)
 		},
 		{
-			id: "mcp.discover",
-			scope,
-			basePath: "mcp",
-			path: "/repository/discover",
+			id: "mcp.session.secret",
+			scope: "session",
+			basePath: "mcp-session",
+			path: "/secrets",
 			method: "POST",
 			authentication: "owner",
-			description: "Discover repository MCP servers.",
+			description: "Store a ${vault:NAME} secret this session reported missing, then reconnect its server.",
 			body: {
 				required: true,
 				contentType: "application/json",
-				schema: typebox.Type.Object({ repositoryId: RepositoryId })
+				schema: McpSupplySecretSchema
 			},
-			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpCatalogSchema)
+			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpSupplySecretResultSchema)
 		},
-		{
-			id: "mcp.authorize",
-			scope,
-			basePath: "mcp",
-			path: "/repository/authorize",
-			method: "POST",
-			authentication: "owner",
-			description: "Start MCP authorization.",
-			body: {
-				required: true,
-				contentType: "application/json",
-				schema: typebox.Type.Object({
-					repositoryId: RepositoryId,
-					serverName: typebox.Type.String({
-						minLength: 1,
-						maxLength: 160
+		...["global", "workspace"].flatMap((scope) => [
+			{
+				id: "mcp.catalog",
+				scope,
+				basePath: "mcp",
+				path: "/repository",
+				method: "GET",
+				authentication: "owner",
+				description: "Read the synced MCP repository catalog.",
+				parameters: RepositoryQuery,
+				responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpCatalogSchema)
+			},
+			{
+				id: "mcp.discover",
+				scope,
+				basePath: "mcp",
+				path: "/repository/discover",
+				method: "POST",
+				authentication: "owner",
+				description: "Discover repository MCP servers.",
+				body: {
+					required: true,
+					contentType: "application/json",
+					schema: typebox.Type.Object({ repositoryId: RepositoryId })
+				},
+				responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpCatalogSchema)
+			},
+			{
+				id: "mcp.authorize",
+				scope,
+				basePath: "mcp",
+				path: "/repository/authorize",
+				method: "POST",
+				authentication: "owner",
+				description: "Start MCP authorization.",
+				body: {
+					required: true,
+					contentType: "application/json",
+					schema: typebox.Type.Object({
+						repositoryId: RepositoryId,
+						serverName: typebox.Type.String({
+							minLength: 1,
+							maxLength: 160
+						})
 					})
-				})
+				},
+				responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpAuthorizationSchema, 202)
 			},
-			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpAuthorizationSchema, 202)
-		},
-		...["GET", "DELETE"].map((method) => ({
-			id: `mcp.authorization.${method}`,
-			scope,
-			basePath: "mcp",
-			path: "/repository/authorize/{flowId}",
-			method,
-			authentication: "owner",
-			description: method === "GET" ? "Read an authorization flow." : "Cancel an authorization flow.",
-			parameters: RepositoryQuery,
-			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpAuthorizationSchema)
-		}))
-	])]
+			{
+				id: "mcp.server.add",
+				scope,
+				basePath: "mcp",
+				path: "/servers",
+				method: "POST",
+				authentication: "owner",
+				description: "Add one MCP server to the repository's .mcp.json or the person's own config.",
+				body: {
+					required: true,
+					contentType: "application/json",
+					schema: McpAddServerSchema
+				},
+				responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(typebox.Type.Object({
+					scope: literals(["repository", "global"]),
+					name: S
+				}), 201)
+			},
+			{
+				id: "mcp.servers.global",
+				scope,
+				basePath: "mcp",
+				path: "/servers/global",
+				method: "GET",
+				authentication: "owner",
+				description: "List the servers in the person's own MCP config, without headers or environment.",
+				responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpGlobalServersSchema)
+			},
+			...["GET", "DELETE"].map((method) => ({
+				id: `mcp.authorization.${method}`,
+				scope,
+				basePath: "mcp",
+				path: "/repository/authorize/{flowId}",
+				method,
+				authentication: "owner",
+				description: method === "GET" ? "Read an authorization flow." : "Cancel an authorization flow.",
+				parameters: RepositoryQuery,
+				responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(McpAuthorizationSchema)
+			}))
+		])
+	]
 });
 //#endregion
 //#region src/schemas/mcpApps.ts