@executor-js/plugin-mcp 1.4.32 → 1.5.0

package/dist/sdk/plugin.d.ts

@@ -1,286 +1,151 @@
 import { Effect, Layer, Schema } from "effect";
 import type { HttpClient } from "effect/unstable/http";
-import { type StorageFailure } from "@executor-js/sdk/core";
-import { OAuth2SourceConfig } from "@executor-js/sdk/http-source";
-import { type McpBindingStore, type McpStoredSource } from "./binding-store";
+import { IntegrationAlreadyExistsError, type AuthMethodDescriptor, type Integration, type IntegrationConfig, type IntegrationRecord, type StorageFailure } from "@executor-js/sdk";
 import { McpConnectionError, McpToolDiscoveryError } from "./errors";
 import { type McpShapeProbeResult } from "./probe-shape";
-import { type McpConfiguredValueInput as McpConfiguredValueInputType } from "./types";
-import { type ConfigFileSink } from "@executor-js/config";
-/**
- * Executor scope id that owns a newly-added MCP source row. Must be one
- * of the executor's configured scopes. Admins adding a shared server at
- * org scope pin here; per-user stdio sources can pin at the inner
- * scope.
- */
-type McpSourceScopeField = {
-    readonly scope: string;
-};
-export interface McpRemoteSourceConfig extends McpSourceScopeField {
-    readonly transport: "remote";
-    readonly name: string;
-    readonly endpoint: string;
-    readonly remoteTransport?: "streamable-http" | "sse" | "auto";
-    readonly queryParams?: Record<string, McpConfiguredValueInputType>;
-    readonly headers?: Record<string, McpConfiguredValueInputType>;
-    readonly namespace?: string;
-    readonly oauth2?: OAuth2SourceConfig;
-    readonly credentials?: McpInitialCredentialsInput;
-}
-export interface McpStdioSourceConfig extends McpSourceScopeField {
-    readonly transport: "stdio";
-    readonly name: string;
-    readonly command: string;
-    readonly args?: string[];
-    readonly env?: Record<string, string>;
-    readonly cwd?: string;
-    readonly namespace?: string;
-}
-export type McpSourceConfig = McpRemoteSourceConfig | McpStdioSourceConfig;
-export interface McpProbeResult {
-    readonly connected: boolean;
-    readonly requiresOAuth: boolean;
-    readonly supportsDynamicRegistration: boolean;
-    readonly name: string;
-    readonly namespace: string;
-    readonly toolCount: number | null;
-    readonly serverName: string | null;
-}
-declare const McpConfigureSourceInputSchema: Schema.Struct<{
-    readonly name: Schema.optional<Schema.String>;
-    readonly endpoint: Schema.optional<Schema.String>;
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"text">;
-        readonly text: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"secret">;
-        readonly secretId: Schema.String;
-        readonly secretScope: Schema.optional<Schema.String>;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"connection">;
-        readonly connectionId: Schema.String;
-    }>]>>>;
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"text">;
-        readonly text: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"secret">;
-        readonly secretId: Schema.String;
-        readonly secretScope: Schema.optional<Schema.String>;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"connection">;
-        readonly connectionId: Schema.String;
-    }>]>>>;
+import { type McpIntegrationConfig as McpIntegrationConfigType } from "./types";
+declare const McpRemoteServerInputSchema: Schema.Struct<{
+    readonly transport: Schema.optional<Schema.Literal<"remote">>;
+    readonly name: Schema.String;
+    readonly endpoint: Schema.String;
+    readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly slug: Schema.optional<Schema.String>;
+    /** How a connection's value is applied to requests. Defaults to none. */
     readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"none">;
     }>, Schema.Struct<{
-        readonly oauth2: Schema.optional<Schema.Struct<{
-            readonly clientId: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
-                readonly kind: Schema.Literal<"text">;
-                readonly text: Schema.String;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"secret">;
-                readonly secretId: Schema.String;
-                readonly secretScope: Schema.optional<Schema.String>;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"connection">;
-                readonly connectionId: Schema.String;
-            }>]>>;
-            readonly clientSecret: Schema.optional<Schema.NullOr<Schema.Union<readonly [Schema.String, Schema.Struct<{
-                readonly kind: Schema.Literal<"text">;
-                readonly text: Schema.String;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"secret">;
-                readonly secretId: Schema.String;
-                readonly secretScope: Schema.optional<Schema.String>;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"connection">;
-                readonly connectionId: Schema.String;
-            }>]>>>;
-            readonly connection: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
-                readonly kind: Schema.Literal<"text">;
-                readonly text: Schema.String;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"secret">;
-                readonly secretId: Schema.String;
-                readonly secretScope: Schema.optional<Schema.String>;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"connection">;
-                readonly connectionId: Schema.String;
-            }>]>>;
-        }>>;
-    }>]>>;
-    readonly scope: Schema.String;
-}>;
-export type McpConfigureSourceInput = typeof McpConfigureSourceInputSchema.Type;
-declare const McpInitialCredentialsInputSchema: Schema.Struct<{
-    readonly scope: Schema.String;
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"text">;
-        readonly text: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"secret">;
-        readonly secretId: Schema.String;
-        readonly secretScope: Schema.optional<Schema.String>;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"connection">;
-        readonly connectionId: Schema.String;
-    }>]>>>;
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"text">;
-        readonly text: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"secret">;
-        readonly secretId: Schema.String;
-        readonly secretScope: Schema.optional<Schema.String>;
+        readonly kind: Schema.Literal<"header">;
+        readonly headerName: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
     }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"connection">;
-        readonly connectionId: Schema.String;
-    }>]>>>;
+        readonly kind: Schema.Literal<"oauth2">;
+    }>]>>;
+}>;
+declare const McpStdioServerInputSchema: Schema.Struct<{
+    readonly transport: Schema.Literal<"stdio">;
+    readonly name: Schema.String;
+    readonly command: Schema.String;
+    readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cwd: Schema.optional<Schema.String>;
+    readonly slug: Schema.optional<Schema.String>;
+}>;
+declare const McpAddServerInputSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly transport: Schema.optional<Schema.Literal<"remote">>;
+    readonly name: Schema.String;
+    readonly endpoint: Schema.String;
+    readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly slug: Schema.optional<Schema.String>;
+    /** How a connection's value is applied to requests. Defaults to none. */
     readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"none">;
     }>, Schema.Struct<{
-        readonly oauth2: Schema.optional<Schema.Struct<{
-            readonly clientId: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
-                readonly kind: Schema.Literal<"text">;
-                readonly text: Schema.String;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"secret">;
-                readonly secretId: Schema.String;
-                readonly secretScope: Schema.optional<Schema.String>;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"connection">;
-                readonly connectionId: Schema.String;
-            }>]>>;
-            readonly clientSecret: Schema.optional<Schema.NullOr<Schema.Union<readonly [Schema.String, Schema.Struct<{
-                readonly kind: Schema.Literal<"text">;
-                readonly text: Schema.String;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"secret">;
-                readonly secretId: Schema.String;
-                readonly secretScope: Schema.optional<Schema.String>;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"connection">;
-                readonly connectionId: Schema.String;
-            }>]>>>;
-            readonly connection: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
-                readonly kind: Schema.Literal<"text">;
-                readonly text: Schema.String;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"secret">;
-                readonly secretId: Schema.String;
-                readonly secretScope: Schema.optional<Schema.String>;
-                readonly prefix: Schema.optional<Schema.String>;
-            }>, Schema.Struct<{
-                readonly kind: Schema.Literal<"connection">;
-                readonly connectionId: Schema.String;
-            }>]>>;
-        }>>;
+        readonly kind: Schema.Literal<"header">;
+        readonly headerName: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth2">;
     }>]>>;
-}>;
-type McpInitialCredentialsInput = typeof McpInitialCredentialsInputSchema.Type;
+}>, Schema.Struct<{
+    readonly transport: Schema.Literal<"stdio">;
+    readonly name: Schema.String;
+    readonly command: Schema.String;
+    readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cwd: Schema.optional<Schema.String>;
+    readonly slug: Schema.optional<Schema.String>;
+}>]>;
 declare const McpProbeEndpointInputSchema: Schema.Struct<{
     readonly endpoint: Schema.String;
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly secretId: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly secretId: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+}>;
+declare const McpProbeEndpointOutputSchema: Schema.Struct<{
+    readonly connected: Schema.Boolean;
+    readonly requiresAuthentication: Schema.Boolean;
+    readonly requiresOAuth: Schema.Boolean;
+    readonly supportsDynamicRegistration: Schema.Boolean;
+    readonly name: Schema.String;
+    readonly slug: Schema.String;
+    readonly toolCount: Schema.NullOr<Schema.Number>;
+    readonly serverName: Schema.NullOr<Schema.String>;
 }>;
+export type McpRemoteServerInput = typeof McpRemoteServerInputSchema.Type;
+export type McpStdioServerInput = typeof McpStdioServerInputSchema.Type;
+export type McpServerInput = typeof McpAddServerInputSchema.Type;
+export type McpProbeResult = typeof McpProbeEndpointOutputSchema.Type;
 export type McpProbeEndpointInput = typeof McpProbeEndpointInputSchema.Type;
 /** Translate a non-MCP probe outcome into a message a user can act on.
- *  The technical `reason` (`401 without Bearer WWW-Authenticate — not an
- *  MCP auth challenge`, etc.) stays in telemetry via the probe span; the
- *  user gets a sentence pointing at their next step. Exported for tests. */
+ *  Exported for tests. */
 export declare const userFacingProbeMessage: (shape: Extract<McpShapeProbeResult, {
     kind: "not-mcp";
 } | {
     kind: "unreachable";
 }>) => string;
+export declare const describeMcpAuthMethods: (record: IntegrationRecord) => readonly AuthMethodDescriptor[];
+export declare const describeMcpIntegrationDisplay: (record: IntegrationRecord) => {
+    readonly url?: string;
+};
 export interface McpPluginOptions {
     /**
-     * Allow configuring stdio-transport MCP sources. Off by default.
+     * Allow configuring stdio-transport MCP servers. Off by default.
      *
-     * Stdio sources spawn a local subprocess that inherits the parent
+     * Stdio servers spawn a local subprocess that inherits the parent
      * `process.env`. Only enable for trusted single-user contexts.
      */
     readonly dangerouslyAllowStdioMCP?: boolean;
     readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
-    /** If provided, source add/remove is mirrored to executor.jsonc
-     *  (best-effort — file errors are logged, not raised). */
-    readonly configFile?: ConfigFileSink;
 }
-export declare const mcpPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"mcp", {
+export declare const mcpPlugin: import("@executor-js/sdk").ConfiguredPlugin<"mcp", {
     probeEndpoint: (input: string | McpProbeEndpointInput) => Effect.Effect<{
         connected: true;
+        requiresAuthentication: false;
         requiresOAuth: false;
         supportsDynamicRegistration: false;
         name: string;
-        namespace: string;
+        slug: string;
         toolCount: number;
         serverName: string | null;
     } | {
         connected: false;
+        requiresAuthentication: true;
         requiresOAuth: true;
         supportsDynamicRegistration: boolean;
         name: string;
-        namespace: string;
+        slug: string;
         toolCount: null;
         serverName: null;
-    }, StorageFailure | McpConnectionError, never>;
-    addSource: (config: McpSourceConfig) => Effect.Effect<{
-        toolCount: number;
-        namespace: string;
-    }, StorageFailure | McpConnectionError | McpToolDiscoveryError, never>;
-    removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
-    refreshSource: (namespace: string, scope: string) => Effect.Effect<{
-        toolCount: number;
-    }, StorageFailure | McpConnectionError | McpToolDiscoveryError, never>;
-    getSource: (namespace: string, scope: string) => Effect.Effect<McpStoredSource | null, StorageFailure, never>;
-}, McpBindingStore, McpPluginOptions, {}, undefined, Layer.Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
-/**
- * Errors any MCP extension method may surface. The first four are
- * plugin-domain tagged errors that flow directly to clients (4xx, each
- * carrying its own `HttpApiSchema` status). `StorageFailure` covers
- * raw backend failures (`StorageError`) plus `UniqueViolationError`;
- * the HTTP edge (`@executor-js/api`'s `withCapture`) translates
- * `StorageError` to the opaque `InternalError({ traceId })` at Layer
- * composition. `UniqueViolationError` passes through — plugins can
- * `Effect.catchTag` it if they want a friendlier user-facing error.
- */
+    } | {
+        connected: false;
+        requiresAuthentication: true;
+        requiresOAuth: false;
+        supportsDynamicRegistration: false;
+        name: string;
+        slug: string;
+        toolCount: null;
+        serverName: null;
+    }, McpConnectionError, never>;
+    addServer: (input: McpServerInput) => Effect.Effect<{
+        slug: string;
+    }, StorageFailure | IntegrationAlreadyExistsError, never>;
+    removeServer: (slug: string) => Effect.Effect<void, StorageFailure, never>;
+    getServer: (slug: string) => Effect.Effect<IntegrationRecord | null, StorageFailure, never>;
+    configureServer: (slug: string, config: McpIntegrationConfigType) => Effect.Effect<void, StorageFailure, never>;
+}, {}, McpPluginOptions, undefined, Layer.Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
 export type McpExtensionFailure = McpConnectionError | McpToolDiscoveryError | StorageFailure;
 export interface McpPluginExtension {
     readonly probeEndpoint: (input: string | McpProbeEndpointInput) => Effect.Effect<McpProbeResult, McpExtensionFailure>;
-    readonly addSource: (config: McpSourceConfig) => Effect.Effect<{
-        readonly toolCount: number;
-        readonly namespace: string;
-    }, McpExtensionFailure>;
-    readonly removeSource: (namespace: string, scope: string) => Effect.Effect<void, McpExtensionFailure>;
-    readonly refreshSource: (namespace: string, scope: string) => Effect.Effect<{
-        readonly toolCount: number;
-    }, McpExtensionFailure>;
-    readonly getSource: (namespace: string, scope: string) => Effect.Effect<McpStoredSource | null, McpExtensionFailure>;
+    readonly addServer: (input: McpServerInput) => Effect.Effect<{
+        readonly slug: string;
+    }, McpExtensionFailure | IntegrationAlreadyExistsError>;
+    readonly removeServer: (slug: string) => Effect.Effect<void, McpExtensionFailure>;
+    readonly getServer: (slug: string) => Effect.Effect<(Integration & {
+        readonly config: IntegrationConfig;
+    }) | null, McpExtensionFailure>;
+    readonly configureServer: (slug: string, config: McpIntegrationConfigType) => Effect.Effect<void, McpExtensionFailure>;
 }
 export {};

package/dist/sdk/types.d.ts

@@ -1,140 +1,42 @@
 import { Schema } from "effect";
-import { SecretBackedMap, SecretBackedValue } from "@executor-js/sdk/shared";
-export { SecretBackedMap, SecretBackedValue };
 export declare const McpRemoteTransport: Schema.Literals<readonly ["streamable-http", "sse", "auto"]>;
 export type McpRemoteTransport = typeof McpRemoteTransport.Type;
 /** All transport types (used in the connector layer) */
 export declare const McpTransport: Schema.Literals<readonly ["streamable-http", "sse", "stdio", "auto"]>;
 export type McpTransport = typeof McpTransport.Type;
-export declare const ConfiguredMcpCredentialValue: Schema.Union<readonly [Schema.String, Schema.Struct<{
-    readonly kind: Schema.Literal<"binding">;
-    readonly slot: Schema.String;
-    readonly prefix: Schema.optional<Schema.String>;
-}>]>;
-export type ConfiguredMcpCredentialValue = typeof ConfiguredMcpCredentialValue.Type;
-export declare const McpConfiguredValueInput: Schema.Union<readonly [Schema.String, Schema.Struct<{
-    readonly kind: Schema.Literal<"secret">;
-    readonly prefix: Schema.optional<Schema.String>;
-}>]>;
-export type McpConfiguredValueInput = typeof McpConfiguredValueInput.Type;
-export declare const McpCredentialInput: Schema.Union<readonly [Schema.String, Schema.Struct<{
-    readonly kind: Schema.Literal<"text">;
-    readonly text: Schema.String;
-    readonly prefix: Schema.optional<Schema.String>;
-}>, Schema.Struct<{
-    readonly kind: Schema.Literal<"secret">;
-    readonly secretId: Schema.String;
-    readonly secretScope: Schema.optional<Schema.String>;
-    readonly prefix: Schema.optional<Schema.String>;
-}>, Schema.Struct<{
-    readonly kind: Schema.Literal<"connection">;
-    readonly connectionId: Schema.String;
-}>]>;
-export type McpCredentialInput = typeof McpCredentialInput.Type;
-export declare const mcpHeaderSlot: (name: string) => string;
-export declare const mcpQueryParamSlot: (name: string) => string;
-export declare const MCP_HEADER_AUTH_SLOT = "auth:header";
-export declare const MCP_OAUTH_CONNECTION_SLOT = "auth:oauth2:connection";
-export declare const MCP_OAUTH_CLIENT_ID_SLOT = "auth:oauth2:client-id";
-export declare const MCP_OAUTH_CLIENT_SECRET_SLOT = "auth:oauth2:client-secret";
-/** JSON object loosely typed — used for opaque OAuth state we just round-trip. */
-declare const JsonObject: Schema.$Record<Schema.String, Schema.Unknown>;
-export { JsonObject as McpJsonObject };
-export declare const McpConnectionAuth: Schema.Union<readonly [Schema.Struct<{
+export declare const McpAuthTemplate: Schema.Union<readonly [Schema.Struct<{
     readonly kind: Schema.Literal<"none">;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"header">;
     readonly headerName: Schema.String;
-    readonly secretSlot: Schema.String;
     readonly prefix: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"oauth2">;
-    readonly connectionSlot: Schema.String;
-    readonly clientIdSlot: Schema.optional<Schema.String>;
-    readonly clientSecretSlot: Schema.optional<Schema.String>;
 }>]>;
-export type McpConnectionAuth = typeof McpConnectionAuth.Type;
-export declare const McpConnectionAuthInput: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"none">;
-}>, Schema.Struct<{
-    readonly oauth2: Schema.optional<Schema.Struct<{
-        readonly clientId: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
-            readonly kind: Schema.Literal<"text">;
-            readonly text: Schema.String;
-            readonly prefix: Schema.optional<Schema.String>;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"secret">;
-            readonly secretId: Schema.String;
-            readonly secretScope: Schema.optional<Schema.String>;
-            readonly prefix: Schema.optional<Schema.String>;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"connection">;
-            readonly connectionId: Schema.String;
-        }>]>>;
-        readonly clientSecret: Schema.optional<Schema.NullOr<Schema.Union<readonly [Schema.String, Schema.Struct<{
-            readonly kind: Schema.Literal<"text">;
-            readonly text: Schema.String;
-            readonly prefix: Schema.optional<Schema.String>;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"secret">;
-            readonly secretId: Schema.String;
-            readonly secretScope: Schema.optional<Schema.String>;
-            readonly prefix: Schema.optional<Schema.String>;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"connection">;
-            readonly connectionId: Schema.String;
-        }>]>>>;
-        readonly connection: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
-            readonly kind: Schema.Literal<"text">;
-            readonly text: Schema.String;
-            readonly prefix: Schema.optional<Schema.String>;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"secret">;
-            readonly secretId: Schema.String;
-            readonly secretScope: Schema.optional<Schema.String>;
-            readonly prefix: Schema.optional<Schema.String>;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"connection">;
-            readonly connectionId: Schema.String;
-        }>]>>;
-    }>>;
-}>]>;
-export type McpConnectionAuthInput = typeof McpConnectionAuthInput.Type;
-export declare const McpRemoteSourceData: Schema.Struct<{
+export type McpAuthTemplate = typeof McpAuthTemplate.Type;
+export declare const McpRemoteIntegrationConfig: Schema.Struct<{
     readonly transport: Schema.Literal<"remote">;
     /** The MCP server endpoint URL */
     readonly endpoint: Schema.String;
-    /** Transport preference for this remote source */
+    /** Transport preference for this remote server */
     readonly remoteTransport: Schema.withConstructorDefault<Schema.optionalKey<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>>;
-    /** Extra query params appended to the endpoint URL */
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
-    /** Extra headers sent on every request */
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
-    /** Auth configuration */
+    /** Static query params appended to the endpoint URL (non-credential) */
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    /** Static headers sent on every request (non-credential) */
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    /** Auth template — how the connection's value is rendered onto requests */
     readonly auth: Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"none">;
     }>, Schema.Struct<{
         readonly kind: Schema.Literal<"header">;
         readonly headerName: Schema.String;
-        readonly secretSlot: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
     }>, Schema.Struct<{
         readonly kind: Schema.Literal<"oauth2">;
-        readonly connectionSlot: Schema.String;
-        readonly clientIdSlot: Schema.optional<Schema.String>;
-        readonly clientSecretSlot: Schema.optional<Schema.String>;
     }>]>;
 }>;
-export type McpRemoteSourceData = typeof McpRemoteSourceData.Type;
-export declare const McpStdioSourceData: Schema.Struct<{
+export type McpRemoteIntegrationConfig = typeof McpRemoteIntegrationConfig.Type;
+export declare const McpStdioIntegrationConfig: Schema.Struct<{
     readonly transport: Schema.Literal<"stdio">;
     /** The command to run */
     readonly command: Schema.String;
@@ -145,38 +47,26 @@ export declare const McpStdioSourceData: Schema.Struct<{
     /** Working directory */
     readonly cwd: Schema.optional<Schema.String>;
 }>;
-export type McpStdioSourceData = typeof McpStdioSourceData.Type;
-export declare const McpStoredSourceData: Schema.Union<readonly [Schema.Struct<{
+export type McpStdioIntegrationConfig = typeof McpStdioIntegrationConfig.Type;
+export declare const McpIntegrationConfig: Schema.Union<readonly [Schema.Struct<{
     readonly transport: Schema.Literal<"remote">;
     /** The MCP server endpoint URL */
     readonly endpoint: Schema.String;
-    /** Transport preference for this remote source */
+    /** Transport preference for this remote server */
     readonly remoteTransport: Schema.withConstructorDefault<Schema.optionalKey<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>>;
-    /** Extra query params appended to the endpoint URL */
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
-    /** Extra headers sent on every request */
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
-    /** Auth configuration */
+    /** Static query params appended to the endpoint URL (non-credential) */
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    /** Static headers sent on every request (non-credential) */
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    /** Auth template — how the connection's value is rendered onto requests */
     readonly auth: Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"none">;
     }>, Schema.Struct<{
         readonly kind: Schema.Literal<"header">;
         readonly headerName: Schema.String;
-        readonly secretSlot: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
     }>, Schema.Struct<{
         readonly kind: Schema.Literal<"oauth2">;
-        readonly connectionSlot: Schema.String;
-        readonly clientIdSlot: Schema.optional<Schema.String>;
-        readonly clientSecretSlot: Schema.optional<Schema.String>;
     }>]>;
 }>, Schema.Struct<{
     readonly transport: Schema.Literal<"stdio">;
@@ -189,7 +79,10 @@ export declare const McpStoredSourceData: Schema.Union<readonly [Schema.Struct<{
     /** Working directory */
     readonly cwd: Schema.optional<Schema.String>;
 }>]>;
-export type McpStoredSourceData = typeof McpStoredSourceData.Type;
+export type McpIntegrationConfig = typeof McpIntegrationConfig.Type;
+/** Parse an opaque integration `config` blob into a typed MCP config, or null
+ *  if it isn't this plugin's shape. */
+export declare const parseMcpIntegrationConfig: (config: unknown) => McpIntegrationConfig | null;
 export declare const McpToolAnnotations: Schema.Struct<{
     readonly title: Schema.optional<Schema.String>;
     readonly readOnlyHint: Schema.optional<Schema.Boolean>;
@@ -199,7 +92,9 @@ export declare const McpToolAnnotations: Schema.Struct<{
 }>;
 export type McpToolAnnotations = typeof McpToolAnnotations.Type;
 export declare const McpToolBinding: Schema.Struct<{
+    /** Sanitized, address-safe tool name (the `<tool>` address segment). */
     readonly toolId: Schema.String;
+    /** The real MCP tool name as advertised by the server. */
     readonly toolName: Schema.String;
     readonly description: Schema.NullOr<Schema.String>;
     readonly inputSchema: Schema.optional<Schema.Unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-mcp",
-  "version": "1.4.32",
+  "version": "1.5.0",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/mcp",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -54,10 +54,9 @@
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@effect/platform-node": "4.0.0-beta.59",
-    "@executor-js/config": "1.4.32",
-    "@executor-js/sdk": "1.4.32",
+    "@executor-js/config": "1.5.0",
+    "@executor-js/sdk": "1.5.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "effect": "4.0.0-beta.59",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -66,6 +65,7 @@
     "@types/node": "^24.3.1",
     "@types/react": "^19.1.0",
     "bun-types": "^1.2.22",
+    "effect": "4.0.0-beta.59",
     "react": "^19.1.0",
     "tsup": "^8.5.0",
     "vitest": "^4.1.5"
@@ -73,6 +73,7 @@
   "peerDependencies": {
     "@effect/atom-react": "4.0.0-beta.59",
     "@tanstack/react-router": "^1.168.10",
+    "effect": "4.0.0-beta.59",
     "react": "^19.1.0"
   },
   "peerDependenciesMeta": {