@executor-js/plugin-mcp 1.4.32 → 1.5.0

package/dist/chunk-2TXHTMKM.js

@@ -0,0 +1,1298 @@
+import {
+  mcpPresets
+} from "./chunk-TW44CBXJ.js";
+import {
+  McpAuthTemplate,
+  McpConnectionError,
+  McpInvocationError,
+  McpRemoteTransport,
+  McpToolAnnotations,
+  McpToolDiscoveryError,
+  parseMcpIntegrationConfig
+} from "./chunk-6OEQZ72N.js";
+
+// src/sdk/manifest.ts
+import { Option, Schema } from "effect";
+var ListedTool = Schema.Struct({
+  name: Schema.String,
+  description: Schema.optional(Schema.NullOr(Schema.String)),
+  inputSchema: Schema.optional(Schema.Unknown),
+  parameters: Schema.optional(Schema.Unknown),
+  outputSchema: Schema.optional(Schema.Unknown),
+  annotations: Schema.optional(McpToolAnnotations)
+});
+var ListToolsResult = Schema.Struct({
+  tools: Schema.Array(ListedTool)
+});
+var ServerInfo = Schema.Struct({
+  name: Schema.optional(Schema.String),
+  version: Schema.optional(Schema.String)
+});
+var decodeListToolsResult = Schema.decodeUnknownOption(ListToolsResult);
+var decodeServerInfo = Schema.decodeUnknownOption(ServerInfo);
+var isListToolsResult = (value) => Option.isSome(decodeListToolsResult(value));
+var sanitize = (value) => {
+  const s = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return s || "tool";
+};
+var uniqueId = (value, seen) => {
+  const base = sanitize(value);
+  const n = (seen.get(base) ?? 0) + 1;
+  seen.set(base, n);
+  return n === 1 ? base : `${base}_${n}`;
+};
+var joinToolPath = (namespace, toolId) => namespace?.trim() ? `${namespace}.${toolId}` : toolId;
+var extractManifestFromListToolsResult = (listToolsResult, metadata) => {
+  const seen = /* @__PURE__ */ new Map();
+  const listed = decodeListToolsResult(listToolsResult).pipe(
+    Option.map((result) => result.tools),
+    Option.getOrElse(() => [])
+  );
+  const server = decodeServerInfo(metadata?.serverInfo).pipe(
+    Option.map(
+      (info) => ({
+        name: info.name ?? null,
+        version: info.version ?? null
+      })
+    ),
+    Option.getOrNull
+  );
+  const tools = listed.flatMap((tool2) => {
+    const toolName = tool2.name.trim();
+    if (!toolName) return [];
+    return [
+      {
+        toolId: uniqueId(toolName, seen),
+        toolName,
+        description: tool2.description ?? null,
+        inputSchema: tool2.inputSchema ?? tool2.parameters,
+        outputSchema: tool2.outputSchema,
+        annotations: tool2.annotations
+      }
+    ];
+  });
+  return { server, tools };
+};
+var slugify = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+var hostnameOf = (url) => {
+  if (!URL.canParse(url)) return null;
+  return new URL(url).hostname;
+};
+var basenameOf = (path) => path.trim().split(/[\\/]/).pop() ?? path.trim();
+var deriveMcpNamespace = (input) => {
+  if (input.name?.trim()) return slugify(input.name) || "mcp";
+  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;
+  if (fromEndpoint) return slugify(fromEndpoint) || "mcp";
+  if (input.command?.trim()) return slugify(basenameOf(input.command)) || "mcp";
+  return "mcp";
+};
+
+// src/sdk/plugin.ts
+import { Effect as Effect5, Match, Option as Option4, Result, Schema as Schema4 } from "effect";
+import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
+import * as z from "zod/v4";
+import {
+  authToolFailure,
+  definePlugin,
+  IntegrationAlreadyExistsError,
+  IntegrationSlug,
+  tool,
+  ToolResult,
+  ToolName
+} from "@executor-js/sdk";
+
+// src/sdk/connection.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
+import { Effect } from "effect";
+var buildEndpointUrl = (endpoint, queryParams) => {
+  const url = new URL(endpoint);
+  for (const [key, value] of Object.entries(queryParams)) {
+    url.searchParams.set(key, value);
+  }
+  return url;
+};
+var createClient = () => new Client(
+  { name: "executor-mcp", version: "0.1.0" },
+  {
+    capabilities: { elicitation: { form: {}, url: {} } },
+    jsonSchemaValidator: new CfWorkerJsonSchemaValidator()
+  }
+);
+var connectionFromClient = (client) => ({
+  client,
+  close: () => client.close()
+});
+var connectClient = (input) => Effect.gen(function* () {
+  const client = createClient();
+  const transportInstance = input.createTransport();
+  yield* Effect.tryPromise({
+    try: () => client.connect(transportInstance),
+    catch: () => new McpConnectionError({
+      transport: input.transport,
+      message: `Failed connecting via ${input.transport}`
+    })
+  }).pipe(
+    Effect.withSpan("plugin.mcp.connection.handshake", {
+      attributes: { "plugin.mcp.transport": input.transport }
+    })
+  );
+  return connectionFromClient(client);
+});
+var createMcpConnector = (input) => {
+  if (input.transport === "stdio") {
+    const command = input.command.trim();
+    if (!command) {
+      return Effect.fail(
+        new McpConnectionError({
+          transport: "stdio",
+          message: "MCP stdio transport requires a command"
+        })
+      );
+    }
+    return Effect.gen(function* () {
+      const { createStdioTransport } = yield* Effect.tryPromise({
+        try: () => import("./stdio-connector-AA5S6UUJ.js"),
+        catch: () => new McpConnectionError({
+          transport: "stdio",
+          message: "Failed to load stdio transport module"
+        })
+      });
+      return yield* connectClient({
+        transport: "stdio",
+        createTransport: () => createStdioTransport({
+          command,
+          args: input.args,
+          env: input.env,
+          cwd: input.cwd?.trim().length ? input.cwd.trim() : void 0
+        })
+      });
+    });
+  }
+  const headers = input.headers ?? {};
+  const remoteTransport = input.remoteTransport ?? "auto";
+  const requestInit = Object.keys(headers).length > 0 ? { headers } : void 0;
+  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});
+  const connectStreamableHttp = connectClient({
+    transport: "streamable-http",
+    createTransport: () => new StreamableHTTPClientTransport(endpoint, {
+      requestInit,
+      authProvider: input.authProvider
+    })
+  });
+  const connectSse = connectClient({
+    transport: "sse",
+    createTransport: () => new SSEClientTransport(endpoint, {
+      requestInit,
+      authProvider: input.authProvider
+    })
+  });
+  if (remoteTransport === "streamable-http") return connectStreamableHttp;
+  if (remoteTransport === "sse") return connectSse;
+  return connectStreamableHttp.pipe(Effect.catch(() => connectSse));
+};
+
+// src/sdk/discover.ts
+import { Effect as Effect2 } from "effect";
+var discoverTools = (connector) => Effect2.gen(function* () {
+  const connection = yield* connector.pipe(
+    Effect2.mapError(
+      ({ message }) => new McpToolDiscoveryError({
+        stage: "connect",
+        message: `Failed connecting to MCP server: ${message}`
+      })
+    )
+  );
+  const listResult = yield* Effect2.tryPromise({
+    try: () => connection.client.listTools(),
+    catch: () => new McpToolDiscoveryError({
+      stage: "list_tools",
+      message: "Failed listing MCP tools"
+    })
+  });
+  if (!isListToolsResult(listResult)) {
+    yield* closeConnection(connection);
+    return yield* new McpToolDiscoveryError({
+      stage: "list_tools",
+      message: "MCP listTools response did not match the expected schema"
+    });
+  }
+  const manifest = extractManifestFromListToolsResult(listResult, {
+    serverInfo: connection.client.getServerVersion?.()
+  });
+  yield* closeConnection(connection);
+  return manifest;
+});
+var closeConnection = (connection) => Effect2.ignore(
+  Effect2.tryPromise({
+    try: () => connection.close(),
+    catch: () => new McpToolDiscoveryError({
+      stage: "list_tools",
+      message: "Failed closing MCP connection"
+    })
+  })
+);
+
+// src/sdk/invoke.ts
+import { Cause, Effect as Effect3, Exit, Option as Option2, Predicate, Schema as Schema2 } from "effect";
+import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import {
+  ElicitationId,
+  FormElicitation,
+  UrlElicitation
+} from "@executor-js/sdk";
+var ArgsRecord = Schema2.Record(Schema2.String, Schema2.Unknown);
+var decodeArgsRecord = Schema2.decodeUnknownOption(ArgsRecord);
+var argsRecord = (value) => Option2.getOrElse(decodeArgsRecord(value), () => ({}));
+var McpElicitParams = Schema2.Union([
+  Schema2.Struct({
+    mode: Schema2.Literal("url"),
+    message: Schema2.String,
+    url: Schema2.String,
+    elicitationId: Schema2.optional(Schema2.String),
+    id: Schema2.optional(Schema2.String)
+  }),
+  Schema2.Struct({
+    mode: Schema2.optional(Schema2.Literal("form")),
+    message: Schema2.String,
+    requestedSchema: Schema2.Record(Schema2.String, Schema2.Unknown)
+  })
+]);
+var decodeElicitParams = Schema2.decodeUnknownSync(McpElicitParams);
+var toElicitationRequest = (params) => params.mode === "url" ? UrlElicitation.make({
+  message: params.message,
+  url: params.url,
+  elicitationId: ElicitationId.make(params.elicitationId ?? params.id ?? "")
+}) : FormElicitation.make({
+  message: params.message,
+  requestedSchema: params.requestedSchema
+});
+var installElicitationHandler = (client, elicit) => {
+  client.setRequestHandler(ElicitRequestSchema, async (request) => {
+    const params = decodeElicitParams(request.params);
+    const req = toElicitationRequest(params);
+    const exit = await Effect3.runPromiseExit(elicit(req));
+    if (Exit.isSuccess(exit)) {
+      const response = exit.value;
+      return {
+        action: response.action,
+        ...response.action === "accept" && response.content ? { content: response.content } : {}
+      };
+    }
+    const failure = exit.cause.reasons.find(Cause.isFailReason);
+    if (failure) {
+      const err = failure.error;
+      if (Predicate.isTagged(err, "ElicitationDeclinedError")) {
+        const action = Predicate.hasProperty(err, "action") && err.action === "cancel" ? "cancel" : "decline";
+        return { action };
+      }
+    }
+    throw Cause.squash(exit.cause);
+  });
+};
+var useConnection = (connection, toolName, args, elicit) => Effect3.gen(function* () {
+  installElicitationHandler(connection.client, elicit);
+  return yield* Effect3.tryPromise({
+    try: () => connection.client.callTool({ name: toolName, arguments: args }),
+    catch: () => new McpInvocationError({
+      toolName,
+      message: `MCP tool call failed for ${toolName}`
+    })
+  }).pipe(
+    Effect3.withSpan("plugin.mcp.client.call_tool", {
+      attributes: { "mcp.tool.name": toolName }
+    })
+  );
+});
+var invokeMcpTool = (input) => Effect3.gen(function* () {
+  const args = argsRecord(input.args);
+  const connection = yield* Effect3.acquireRelease(
+    input.connector.pipe(
+      Effect3.withSpan("plugin.mcp.connection.acquire", {
+        attributes: { "plugin.mcp.transport": input.transport }
+      })
+    ),
+    (conn) => Effect3.ignore(
+      Effect3.tryPromise({
+        try: () => conn.close(),
+        catch: () => new McpConnectionError({
+          transport: input.transport,
+          message: "Failed to close MCP connection"
+        })
+      })
+    )
+  );
+  return yield* useConnection(connection, input.toolName, args, input.elicit);
+}).pipe(
+  Effect3.scoped,
+  Effect3.withSpan("plugin.mcp.invoke", {
+    attributes: {
+      "mcp.tool.name": input.toolName,
+      "plugin.mcp.tool_id": input.toolId,
+      "plugin.mcp.transport": input.transport
+    }
+  })
+);
+
+// src/sdk/probe-shape.ts
+import { Data, Duration, Effect as Effect4, Option as Option3, Schema as Schema3 } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
+var INITIALIZE_BODY = JSON.stringify({
+  jsonrpc: "2.0",
+  id: 1,
+  method: "initialize",
+  params: {
+    protocolVersion: "2025-06-18",
+    capabilities: {},
+    clientInfo: { name: "executor-probe", version: "0" }
+  }
+});
+var readHeader = (headers, name) => {
+  const direct = headers[name];
+  if (direct !== void 0) return direct;
+  const lower = name.toLowerCase();
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === lower) return v;
+  }
+  return null;
+};
+var ProbeTransportError = class extends Data.TaggedError("ProbeTransportError") {
+};
+var decodeJsonString = Schema3.decodeUnknownOption(Schema3.fromJsonString(Schema3.Unknown));
+var asObject = (body) => {
+  if (!body) return null;
+  const parsed = decodeJsonString(body);
+  if (Option3.isNone(parsed)) return null;
+  const value = parsed.value;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value;
+};
+var isJsonRpcEnvelope = (body) => {
+  const obj = asObject(body);
+  if (!obj) return false;
+  if (obj.jsonrpc !== "2.0") return false;
+  return "result" in obj || "error" in obj || "method" in obj;
+};
+var isOAuthErrorBody = (body) => {
+  const obj = asObject(body);
+  if (!obj) return false;
+  if (Array.isArray(obj.errors)) return false;
+  return typeof obj.error === "string";
+};
+var ProtectedResourceMetadata = Schema3.Struct({
+  resource: Schema3.String,
+  authorization_servers: Schema3.Array(Schema3.String)
+});
+var decodeProtectedResourceMetadata = Schema3.decodeUnknownOption(
+  Schema3.fromJsonString(ProtectedResourceMetadata)
+);
+var protectedResourceMetadataUrl = (endpoint) => {
+  const path = endpoint.pathname === "/" ? "" : endpoint.pathname;
+  return `${endpoint.origin}/.well-known/oauth-protected-resource${path}`;
+};
+var resourceMatchesEndpoint = (resource, endpoint) => {
+  if (!URL.canParse(resource)) return false;
+  const parsed = new URL(resource);
+  if (parsed.origin !== endpoint.origin) return false;
+  const resourcePath = parsed.pathname.replace(/\/+$/, "");
+  const endpointPath = endpoint.pathname.replace(/\/+$/, "");
+  return endpointPath === resourcePath || endpointPath.startsWith(`${resourcePath}/`);
+};
+var probeProtectedResourceMetadata = (client, endpoint, timeoutMs) => Effect4.gen(function* () {
+  const response = yield* client.execute(
+    HttpClientRequest.get(protectedResourceMetadataUrl(endpoint)).pipe(
+      HttpClientRequest.setHeader("accept", "application/json")
+    )
+  ).pipe(Effect4.timeout(Duration.millis(timeoutMs)));
+  if (response.status < 200 || response.status >= 300) return false;
+  const body = yield* response.text.pipe(
+    Effect4.timeout(Duration.millis(timeoutMs)),
+    Effect4.catch(() => Effect4.succeed(""))
+  );
+  const metadata = decodeProtectedResourceMetadata(body);
+  if (Option3.isNone(metadata)) return false;
+  if (metadata.value.authorization_servers.length === 0) return false;
+  return resourceMatchesEndpoint(metadata.value.resource, endpoint);
+}).pipe(Effect4.catch(() => Effect4.succeed(false)));
+var ErrorMessageShape = Schema3.Struct({ message: Schema3.String });
+var decodeErrorMessageShape = Schema3.decodeUnknownOption(ErrorMessageShape);
+var reasonFromBoundaryCause = (cause) => {
+  const messageShape = decodeErrorMessageShape(cause);
+  if (Option3.isSome(messageShape)) return messageShape.value.message;
+  if (typeof cause === "string") return cause;
+  if (typeof cause === "number" || typeof cause === "boolean" || typeof cause === "bigint") {
+    return `${cause}`;
+  }
+  if (typeof cause === "symbol") return cause.description ?? "symbol";
+  if (cause === null) return "null";
+  if (typeof cause === "undefined") return "undefined";
+  return "fetch failed";
+};
+var probeMcpEndpointShape = (endpoint, options = {}) => Effect4.gen(function* () {
+  const timeoutMs = options.timeoutMs ?? 8e3;
+  const outcome = yield* Effect4.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const readBody = (response) => response.text.pipe(
+      Effect4.timeout(Duration.millis(timeoutMs)),
+      Effect4.catch(() => Effect4.succeed(""))
+    );
+    const classify = (response, method) => Effect4.gen(function* () {
+      const contentType = readHeader(response.headers, "content-type") ?? "";
+      const isSse = /^\s*text\/event-stream\b/i.test(contentType);
+      if (response.status === 401) {
+        const wwwAuth = readHeader(response.headers, "www-authenticate");
+        if (!wwwAuth || !/^\s*bearer\b/i.test(wwwAuth)) {
+          if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {
+            return { kind: "mcp", requiresAuth: true };
+          }
+          return {
+            kind: "not-mcp",
+            category: "auth-required",
+            reason: "401 without Bearer WWW-Authenticate \u2014 not an MCP auth challenge"
+          };
+        }
+        if (/(?:^|[\s,])resource_metadata\s*=/i.test(wwwAuth)) {
+          return { kind: "mcp", requiresAuth: true };
+        }
+        if (/(?:^|[\s,])error\s*=/i.test(wwwAuth)) {
+          return { kind: "mcp", requiresAuth: true };
+        }
+        if (isSse) return { kind: "mcp", requiresAuth: true };
+        const body = yield* readBody(response);
+        if (!isJsonRpcEnvelope(body) && !isOAuthErrorBody(body)) {
+          if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {
+            return { kind: "mcp", requiresAuth: true };
+          }
+          return {
+            kind: "not-mcp",
+            category: "auth-required",
+            reason: "401 + Bearer without resource_metadata, JSON-RPC body, or OAuth error body"
+          };
+        }
+        return { kind: "mcp", requiresAuth: true };
+      }
+      if (response.status >= 200 && response.status < 300) {
+        if (method === "GET") {
+          if (!isSse) {
+            return {
+              kind: "not-mcp",
+              category: "wrong-shape",
+              reason: "GET response is not an SSE stream"
+            };
+          }
+          return { kind: "mcp", requiresAuth: false };
+        }
+        if (isSse) return { kind: "mcp", requiresAuth: false };
+        const body = yield* readBody(response);
+        if (!isJsonRpcEnvelope(body)) {
+          return {
+            kind: "not-mcp",
+            category: "wrong-shape",
+            reason: "2xx POST body is not a JSON-RPC envelope"
+          };
+        }
+        return { kind: "mcp", requiresAuth: false };
+      }
+      return null;
+    });
+    const url = new URL(endpoint);
+    for (const [key, value] of Object.entries(options.queryParams ?? {})) {
+      url.searchParams.set(key, value);
+    }
+    let postRequest = HttpClientRequest.post(url.toString()).pipe(
+      HttpClientRequest.setHeader("content-type", "application/json"),
+      HttpClientRequest.setHeader("accept", "application/json, text/event-stream"),
+      HttpClientRequest.bodyText(INITIALIZE_BODY, "application/json")
+    );
+    for (const [name, value] of Object.entries(options.headers ?? {})) {
+      postRequest = HttpClientRequest.setHeader(postRequest, name, value);
+    }
+    const postResponse = yield* client.execute(postRequest).pipe(Effect4.timeout(Duration.millis(timeoutMs)));
+    const postResult = yield* classify(postResponse, "POST");
+    if (postResult) return postResult;
+    if ([404, 405, 406, 415].includes(postResponse.status)) {
+      let getRequest = HttpClientRequest.get(url.toString()).pipe(
+        HttpClientRequest.setHeader("accept", "text/event-stream")
+      );
+      for (const [name, value] of Object.entries(options.headers ?? {})) {
+        getRequest = HttpClientRequest.setHeader(getRequest, name, value);
+      }
+      const getResponse = yield* client.execute(getRequest).pipe(Effect4.timeout(Duration.millis(timeoutMs)));
+      const getResult = yield* classify(getResponse, "GET");
+      if (getResult) return getResult;
+    }
+    return {
+      kind: "not-mcp",
+      category: "wrong-shape",
+      reason: `unexpected status ${postResponse.status} for initialize`
+    };
+  }).pipe(
+    Effect4.provide(options.httpClientLayer ?? FetchHttpClient.layer),
+    Effect4.mapError(
+      (cause) => new ProbeTransportError({
+        reason: reasonFromBoundaryCause(cause),
+        cause
+      })
+    ),
+    Effect4.catch(
+      (cause) => Effect4.succeed({
+        kind: "unreachable",
+        reason: cause.reason
+      })
+    )
+  );
+  return outcome;
+}).pipe(Effect4.withSpan("mcp.plugin.probe_shape"));
+
+// src/sdk/plugin.ts
+var MCP_PLUGIN_ID = "mcp";
+var legacyOAuthClientSlugCandidate = (value) => {
+  const slug = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug.length > 0 ? slug : null;
+};
+var legacyOAuthClientSlugCandidates = (slug, integration) => {
+  const candidates = /* @__PURE__ */ new Set();
+  const fromSlug = legacyOAuthClientSlugCandidate(slug);
+  if (fromSlug) candidates.add(fromSlug);
+  const fromDescription = integration == null ? null : legacyOAuthClientSlugCandidate(integration.description);
+  if (fromDescription) candidates.add(fromDescription);
+  return candidates;
+};
+var oauthClientKey = (owner, slug) => `${owner}:${String(slug)}`;
+var legacyMcpClientMatches = (client, candidates, config) => {
+  if (!candidates.has(String(client.slug))) return false;
+  if (!config || config.transport !== "remote" || config.auth.kind !== "oauth2") return false;
+  return client.grant === "authorization_code" && (client.resource ?? null) === config.endpoint;
+};
+var McpStampSchema = Schema4.Struct({
+  toolName: Schema4.String,
+  upstream: Schema4.optional(
+    Schema4.Struct({
+      title: Schema4.optional(Schema4.String),
+      readOnlyHint: Schema4.optional(Schema4.Boolean),
+      destructiveHint: Schema4.optional(Schema4.Boolean),
+      idempotentHint: Schema4.optional(Schema4.Boolean),
+      openWorldHint: Schema4.optional(Schema4.Boolean)
+    })
+  )
+});
+var AnnotationsWithStamp = Schema4.Struct({ mcp: McpStampSchema });
+var decodeStamp = Schema4.decodeUnknownOption(AnnotationsWithStamp);
+var readStamp = (annotations) => Option4.match(decodeStamp(annotations), {
+  onNone: () => null,
+  onSome: (decoded) => decoded.mcp
+});
+var McpRemoteServerInputSchema = Schema4.Struct({
+  transport: Schema4.optional(Schema4.Literal("remote")),
+  name: Schema4.String,
+  endpoint: Schema4.String,
+  remoteTransport: Schema4.optional(McpRemoteTransport),
+  headers: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String)),
+  queryParams: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String)),
+  slug: Schema4.optional(Schema4.String),
+  /** How a connection's value is applied to requests. Defaults to none. */
+  auth: Schema4.optional(McpAuthTemplate)
+});
+var McpStdioServerInputSchema = Schema4.Struct({
+  transport: Schema4.Literal("stdio"),
+  name: Schema4.String,
+  command: Schema4.String,
+  args: Schema4.optional(Schema4.Array(Schema4.String)),
+  env: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String)),
+  cwd: Schema4.optional(Schema4.String),
+  slug: Schema4.optional(Schema4.String)
+});
+var McpAddServerInputSchema = Schema4.Union([
+  McpRemoteServerInputSchema,
+  McpStdioServerInputSchema
+]);
+var McpAddServerOutputSchema = Schema4.Struct({
+  slug: Schema4.String
+});
+var McpProbeEndpointInputSchema = Schema4.Struct({
+  endpoint: Schema4.String,
+  headers: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String)),
+  queryParams: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String))
+});
+var McpProbeEndpointOutputSchema = Schema4.Struct({
+  connected: Schema4.Boolean,
+  requiresAuthentication: Schema4.Boolean,
+  requiresOAuth: Schema4.Boolean,
+  supportsDynamicRegistration: Schema4.Boolean,
+  name: Schema4.String,
+  slug: Schema4.String,
+  toolCount: Schema4.NullOr(Schema4.Number),
+  serverName: Schema4.NullOr(Schema4.String)
+});
+var McpGetServerInputSchema = Schema4.Struct({
+  slug: Schema4.String
+});
+var McpGetServerOutputSchema = Schema4.Struct({
+  integration: Schema4.NullOr(Schema4.Unknown)
+});
+var schemaToStaticToolSchema = (schema) => Schema4.toStandardSchemaV1(Schema4.toStandardJSONSchemaV1(schema));
+var McpAddServerInputStandardSchema = schemaToStaticToolSchema(McpAddServerInputSchema);
+var McpAddServerOutputStandardSchema = schemaToStaticToolSchema(McpAddServerOutputSchema);
+var McpProbeEndpointInputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointInputSchema);
+var McpProbeEndpointOutputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointOutputSchema);
+var McpGetServerInputStandardSchema = schemaToStaticToolSchema(McpGetServerInputSchema);
+var McpGetServerOutputStandardSchema = schemaToStaticToolSchema(McpGetServerOutputSchema);
+var mcpToolFailure = (code, message, details) => ToolResult.fail({
+  code,
+  message,
+  ...details === void 0 ? {} : { details }
+});
+var slugFrom = (slug) => IntegrationSlug.make(slug);
+var normalizeSlug = (input) => input.slug ?? deriveMcpNamespace({
+  name: input.name,
+  endpoint: input.transport === "stdio" ? void 0 : input.endpoint,
+  command: input.transport === "stdio" ? input.command : void 0
+});
+var toIntegrationConfig = (input) => {
+  if (input.transport === "stdio") {
+    return {
+      transport: "stdio",
+      command: input.command,
+      args: input.args ? [...input.args] : void 0,
+      env: input.env,
+      cwd: input.cwd
+    };
+  }
+  return {
+    transport: "remote",
+    endpoint: input.endpoint,
+    remoteTransport: input.remoteTransport ?? "auto",
+    queryParams: input.queryParams,
+    headers: input.headers,
+    auth: input.auth ?? { kind: "none" }
+  };
+};
+var McpCallToolResultJsonSchema = z.toJSONSchema(CallToolResultSchema);
+var mcpCallToolResultOutputSchema = (structuredContentSchema) => {
+  const defaultStructuredContentSchema = McpCallToolResultJsonSchema.properties?.structuredContent ?? {};
+  return {
+    ...McpCallToolResultJsonSchema,
+    properties: {
+      ...McpCallToolResultJsonSchema.properties,
+      structuredContent: structuredContentSchema === void 0 ? defaultStructuredContentSchema : structuredContentSchema,
+      isError: { const: false }
+    },
+    required: structuredContentSchema === void 0 ? ["content"] : ["content", "structuredContent"]
+  };
+};
+var toToolDef = (entry) => {
+  const destructive = entry.annotations?.destructiveHint === true;
+  const stamp = {
+    toolName: entry.toolName,
+    ...entry.annotations ? { upstream: entry.annotations } : {}
+  };
+  const annotations = {
+    requiresApproval: destructive,
+    ...destructive ? { approvalDescription: entry.annotations?.title ?? entry.toolName } : {},
+    mcp: stamp
+  };
+  return {
+    name: ToolName.make(entry.toolId),
+    description: entry.description ?? `MCP tool: ${entry.toolName}`,
+    inputSchema: entry.inputSchema,
+    outputSchema: mcpCallToolResultOutputSchema(entry.outputSchema),
+    annotations
+  };
+};
+var McpTextContent = Schema4.Struct({ type: Schema4.Literal("text"), text: Schema4.String });
+var McpToolCallEnvelope = Schema4.Struct({
+  isError: Schema4.optional(Schema4.Boolean),
+  content: Schema4.optional(Schema4.Array(Schema4.Unknown))
+});
+var decodeMcpTextContent = Schema4.decodeUnknownOption(McpTextContent);
+var decodeMcpToolCallEnvelope = Schema4.decodeUnknownOption(McpToolCallEnvelope);
+var extractMcpErrorMessage = (content) => {
+  if (Array.isArray(content)) {
+    for (const item of content) {
+      const decoded = Option4.getOrUndefined(decodeMcpTextContent(item));
+      if (decoded !== void 0 && decoded.text.length > 0) return decoded.text;
+    }
+  }
+  return "MCP tool returned an error";
+};
+var urlMatchesToken = (url, token) => {
+  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, "i");
+  return re.test(url.hostname) || re.test(url.pathname);
+};
+var userFacingProbeMessage = (shape) => {
+  if (shape.kind === "unreachable") {
+    return "Couldn't reach this URL. Check the address, your network, and that the server is running.";
+  }
+  return Match.value(shape.category).pipe(
+    Match.when(
+      "auth-required",
+      () => "This server requires authentication. Add credentials (Authorization header, query parameter, or API key) below and retry."
+    ),
+    Match.when(
+      "wrong-shape",
+      () => "This URL doesn't appear to host an MCP server. Double-check the address, including the path."
+    ),
+    Match.exhaustive
+  );
+};
+var makeOAuthProvider = (accessToken) => ({
+  get redirectUrl() {
+    return "http://localhost/oauth/callback";
+  },
+  get clientMetadata() {
+    return {
+      redirect_uris: ["http://localhost/oauth/callback"],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      client_name: "Executor"
+    };
+  },
+  clientInformation: () => void 0,
+  saveClientInformation: () => void 0,
+  tokens: () => ({ access_token: accessToken, token_type: "Bearer" }),
+  saveTokens: () => void 0,
+  redirectToAuthorization: async () => {
+    throw new Error("MCP OAuth re-authorization required");
+  },
+  saveCodeVerifier: () => void 0,
+  codeVerifier: () => {
+    throw new Error("No active PKCE verifier");
+  },
+  saveDiscoveryState: () => void 0,
+  discoveryState: () => void 0
+});
+var buildConnectorInput = (config, value, allowStdio) => {
+  if (config.transport === "stdio") {
+    if (!allowStdio) {
+      return Effect5.fail(
+        new McpConnectionError({
+          transport: "stdio",
+          message: "MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() \u2014 only safe for trusted local contexts."
+        })
+      );
+    }
+    return Effect5.succeed({
+      transport: "stdio",
+      command: config.command,
+      args: config.args,
+      env: config.env,
+      cwd: config.cwd
+    });
+  }
+  const headers = { ...config.headers ?? {} };
+  let authProvider;
+  const auth = config.auth;
+  if (auth.kind === "header" && value !== null) {
+    headers[auth.headerName] = auth.prefix ? `${auth.prefix}${value}` : value;
+  } else if (auth.kind === "oauth2" && value !== null) {
+    authProvider = makeOAuthProvider(value);
+  }
+  return Effect5.succeed({
+    transport: "remote",
+    endpoint: config.endpoint,
+    remoteTransport: config.remoteTransport ?? "auto",
+    queryParams: config.queryParams && Object.keys(config.queryParams).length > 0 ? config.queryParams : void 0,
+    headers: Object.keys(headers).length > 0 ? headers : void 0,
+    authProvider
+  });
+};
+var describeMcpAuthMethods = (record) => {
+  const config = parseMcpIntegrationConfig(record.config);
+  if (!config || config.transport === "stdio") return [];
+  const auth = config.auth;
+  if (auth.kind === "none") {
+    return [
+      {
+        id: "none",
+        label: "No authentication",
+        kind: "none",
+        template: "none"
+      }
+    ];
+  }
+  if (auth.kind === "header") {
+    return [
+      {
+        id: "header",
+        label: "API key (header)",
+        kind: "apikey",
+        template: "header",
+        placements: [{ carrier: "header", name: auth.headerName, prefix: auth.prefix ?? "" }]
+      }
+    ];
+  }
+  if (auth.kind === "oauth2") {
+    return [
+      {
+        id: "oauth2",
+        label: "OAuth",
+        kind: "oauth",
+        template: "oauth2",
+        oauth: { discoveryUrl: config.endpoint, supportsDynamicRegistration: true }
+      }
+    ];
+  }
+  return [];
+};
+var describeMcpIntegrationDisplay = (record) => {
+  const config = parseMcpIntegrationConfig(record.config);
+  if (!config || config.transport === "stdio") return {};
+  return { url: config.endpoint };
+};
+var mcpPlugin = definePlugin((options) => {
+  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;
+  const presetEntries = (allowStdio ? mcpPresets : mcpPresets.filter((preset) => !("transport" in preset && preset.transport === "stdio"))).map((preset) => ({
+    id: preset.id,
+    name: preset.name,
+    summary: preset.summary,
+    ..."url" in preset && preset.url ? { url: preset.url } : {},
+    ..."endpoint" in preset && preset.endpoint ? { endpoint: preset.endpoint } : {},
+    ...preset.icon ? { icon: preset.icon } : {},
+    ...preset.featured ? { featured: preset.featured } : {},
+    transport: "transport" in preset && preset.transport === "stdio" ? "stdio" : "remote",
+    ..."command" in preset ? { command: preset.command } : {},
+    ..."args" in preset && preset.args ? { args: [...preset.args] } : {},
+    ..."env" in preset && preset.env ? { env: preset.env } : {}
+  }));
+  return {
+    id: MCP_PLUGIN_ID,
+    packageName: "@executor-js/plugin-mcp",
+    integrationPresets: presetEntries,
+    // Surfaced to the client bundle via the Vite plugin. The MCP `./client`
+    // factory reads `allowStdio` and gates the stdio tab + presets.
+    clientConfig: { allowStdio },
+    storage: () => ({}),
+    extension: (ctx) => {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
+      const probeEndpoint = (input) => Effect5.gen(function* () {
+        const endpoint = typeof input === "string" ? input : input.endpoint;
+        const trimmed = endpoint.trim();
+        if (!trimmed) {
+          return yield* new McpConnectionError({
+            transport: "remote",
+            message: "Endpoint URL is required"
+          });
+        }
+        const name = yield* Effect5.try({
+          try: () => new URL(trimmed).hostname,
+          catch: () => "mcp"
+        }).pipe(Effect5.orElseSucceed(() => "mcp"));
+        const slug = deriveMcpNamespace({ endpoint: trimmed });
+        const probeHeaders = typeof input === "string" ? void 0 : input.headers;
+        const probeQueryParams = typeof input === "string" ? void 0 : input.queryParams;
+        const connector = createMcpConnector({
+          transport: "remote",
+          endpoint: trimmed,
+          headers: probeHeaders,
+          queryParams: probeQueryParams
+        });
+        const result = yield* discoverTools(connector).pipe(
+          Effect5.map((m) => ({ ok: true, manifest: m })),
+          Effect5.catch(() => Effect5.succeed({ ok: false, manifest: null })),
+          Effect5.withSpan("mcp.plugin.discover_tools")
+        );
+        if (result.ok && result.manifest) {
+          return {
+            connected: true,
+            requiresAuthentication: false,
+            requiresOAuth: false,
+            supportsDynamicRegistration: false,
+            name: result.manifest.server?.name ?? name,
+            slug,
+            toolCount: result.manifest.tools.length,
+            serverName: result.manifest.server?.name ?? null
+          };
+        }
+        const shape = yield* probeMcpEndpointShape(trimmed, {
+          httpClientLayer,
+          headers: probeHeaders,
+          queryParams: probeQueryParams
+        });
+        if (shape.kind !== "mcp") {
+          return yield* new McpConnectionError({
+            transport: "remote",
+            message: userFacingProbeMessage(shape)
+          });
+        }
+        const probeResult = yield* ctx.oauth.probe({ url: trimmed }).pipe(
+          Effect5.map((oauth) => ({ ok: true, oauth })),
+          Effect5.catch(() => Effect5.succeed({ ok: false, oauth: null })),
+          Effect5.withSpan("mcp.plugin.probe_oauth")
+        );
+        if (probeResult.ok) {
+          return {
+            connected: false,
+            requiresAuthentication: true,
+            requiresOAuth: true,
+            supportsDynamicRegistration: probeResult.oauth.registrationEndpoint != null,
+            name,
+            slug,
+            toolCount: null,
+            serverName: null
+          };
+        }
+        if (shape.requiresAuth) {
+          return {
+            connected: false,
+            requiresAuthentication: true,
+            requiresOAuth: false,
+            supportsDynamicRegistration: false,
+            name,
+            slug,
+            toolCount: null,
+            serverName: null
+          };
+        }
+        return yield* new McpConnectionError({
+          transport: "remote",
+          message: "This endpoint looks like MCP, but Executor couldn't discover tools from it. Check the URL and try again."
+        });
+      }).pipe(
+        Effect5.withSpan("mcp.plugin.probe_endpoint", {
+          attributes: { "mcp.endpoint": typeof input === "string" ? input : input.endpoint }
+        })
+      );
+      const addServer = (input) => Effect5.gen(function* () {
+        const slug = normalizeSlug(input);
+        const config = toIntegrationConfig(input);
+        const existing = yield* ctx.core.integrations.get(slugFrom(slug));
+        if (existing) {
+          return yield* new IntegrationAlreadyExistsError({ slug: slugFrom(slug) });
+        }
+        yield* ctx.core.integrations.register({
+          slug: slugFrom(slug),
+          description: input.name,
+          config,
+          canRemove: true,
+          canRefresh: true
+        }).pipe(
+          Effect5.withSpan("mcp.plugin.register_integration", {
+            attributes: { "mcp.integration.slug": slug }
+          })
+        );
+        return { slug };
+      }).pipe(
+        Effect5.withSpan("mcp.plugin.add_server", {
+          attributes: {
+            "mcp.server.transport": input.transport ?? "remote",
+            "mcp.server.name": input.name
+          }
+        })
+      );
+      const removeServer = (slug) => Effect5.gen(function* () {
+        const integration = slugFrom(slug);
+        const record = yield* ctx.core.integrations.get(integration);
+        const config = record ? parseMcpIntegrationConfig(record.config) : null;
+        const legacyCandidates = legacyOAuthClientSlugCandidates(slug, record);
+        const connections = yield* ctx.connections.list({ integration });
+        const allConnections = yield* ctx.connections.list();
+        const oauthClientSummaries = yield* ctx.oauth.listClients();
+        const usedElsewhere = new Set(
+          allConnections.filter((connection) => String(connection.integration) !== String(integration)).flatMap(
+            (connection) => connection.oauthClient == null ? [] : [
+              oauthClientKey(
+                connection.oauthClientOwner ?? connection.owner,
+                connection.oauthClient
+              )
+            ]
+          )
+        );
+        const oauthClientsByKey = new Map(
+          oauthClientSummaries.map((client) => [
+            oauthClientKey(client.owner, client.slug),
+            client
+          ])
+        );
+        const clientsToRemove = /* @__PURE__ */ new Map();
+        for (const connection of connections) {
+          if (connection.oauthClient == null) continue;
+          const owner = connection.oauthClientOwner ?? connection.owner;
+          const key = oauthClientKey(owner, connection.oauthClient);
+          const client = oauthClientsByKey.get(key);
+          if (client?.origin.kind !== "dynamic_client_registration") continue;
+          clientsToRemove.set(key, {
+            owner,
+            slug: connection.oauthClient
+          });
+        }
+        for (const client of oauthClientSummaries) {
+          const key = oauthClientKey(client.owner, client.slug);
+          if (usedElsewhere.has(key)) continue;
+          if (client.origin.kind === "dynamic_client_registration" && (client.origin.integration == null || String(client.origin.integration) === slug)) {
+            clientsToRemove.set(key, { owner: client.owner, slug: client.slug });
+            continue;
+          }
+          if (legacyMcpClientMatches(client, legacyCandidates, config)) {
+            clientsToRemove.set(key, { owner: client.owner, slug: client.slug });
+          }
+        }
+        yield* ctx.core.integrations.remove(integration).pipe(Effect5.catchTag("IntegrationRemovalNotAllowedError", () => Effect5.void));
+        yield* Effect5.forEach(
+          clientsToRemove.values(),
+          (client) => ctx.oauth.removeClient(client.owner, client.slug),
+          { discard: true }
+        );
+      }).pipe(
+        Effect5.withSpan("mcp.plugin.remove_server", {
+          attributes: { "mcp.integration.slug": slug }
+        })
+      );
+      const getServer = (slug) => ctx.core.integrations.get(slugFrom(slug)).pipe(
+        Effect5.withSpan("mcp.plugin.get_server", {
+          attributes: { "mcp.integration.slug": slug }
+        })
+      );
+      const configureServer = (slug, config) => ctx.core.integrations.update(slugFrom(slug), { config }).pipe(
+        Effect5.withSpan("mcp.plugin.configure_server", {
+          attributes: { "mcp.integration.slug": slug }
+        })
+      );
+      return {
+        probeEndpoint,
+        addServer,
+        removeServer,
+        getServer,
+        configureServer
+      };
+    },
+    // -----------------------------------------------------------------------
+    // Per-connection tool production. Dial the server using the connection's
+    // resolved value (rendered through the integration's auth template) and
+    // list its tools. The real MCP tool name + upstream annotations are
+    // stamped into each ToolDef's annotations so invokeTool can recover them.
+    // Discovery failures (auth not ready, server down) yield an empty tool set
+    // rather than failing — the connection still lands and can be refreshed.
+    // -----------------------------------------------------------------------
+    resolveTools: ({ config, connection, getValue }) => Effect5.gen(function* () {
+      const parsed = parseMcpIntegrationConfig(config);
+      if (!parsed) return { tools: [] };
+      const value = yield* getValue().pipe(Effect5.orElseSucceed(() => null));
+      const built = yield* buildConnectorInput(parsed, value, allowStdio).pipe(
+        Effect5.map((ci) => createMcpConnector(ci)),
+        Effect5.result
+      );
+      const manifest = Result.isSuccess(built) ? yield* discoverTools(built.success).pipe(
+        Effect5.map((m) => ({ ok: true, manifest: m })),
+        Effect5.catch(() => Effect5.succeed({ ok: false, manifest: null })),
+        Effect5.withSpan("mcp.plugin.discover_tools", {
+          attributes: { "mcp.connection.name": String(connection.name) }
+        })
+      ) : { ok: false, manifest: null };
+      const entries = manifest.ok && manifest.manifest ? manifest.manifest.tools : [];
+      return { tools: entries.map(toToolDef) };
+    }).pipe(
+      Effect5.withSpan("mcp.plugin.resolve_tools", {
+        attributes: { "mcp.connection.name": String(connection.name) }
+      })
+    ),
+    invokeTool: ({ toolRow, credential, args, elicit }) => Effect5.gen(function* () {
+      const parsed = parseMcpIntegrationConfig(credential.config);
+      if (!parsed) {
+        return yield* new McpConnectionError({
+          transport: "auto",
+          message: `MCP integration "${toolRow.integration}" has no usable config`
+        });
+      }
+      const stamp = readStamp(toolRow.annotations);
+      if (!stamp) {
+        return yield* new McpToolDiscoveryError({
+          stage: "list_tools",
+          message: `Tool "${toolRow.name}" is missing its MCP binding \u2014 refresh the connection`
+        });
+      }
+      const transport = parsed.transport === "stdio" ? "stdio" : parsed.remoteTransport ?? "auto";
+      const connector = yield* buildConnectorInput(
+        parsed,
+        credential.value,
+        allowStdio
+      ).pipe(Effect5.map((ci) => createMcpConnector(ci)));
+      const raw = yield* invokeMcpTool({
+        toolId: String(toolRow.name),
+        toolName: stamp.toolName,
+        args,
+        transport,
+        connector,
+        elicit
+      });
+      const envelope = Option4.getOrUndefined(decodeMcpToolCallEnvelope(raw));
+      if (envelope?.isError === true) {
+        return ToolResult.fail({
+          code: "mcp_tool_error",
+          message: extractMcpErrorMessage(envelope.content),
+          details: { content: envelope.content }
+        });
+      }
+      return ToolResult.ok(raw);
+    }).pipe(
+      Effect5.catchTag(
+        "McpConnectionError",
+        ({ message }) => Effect5.succeed(
+          authToolFailure({
+            code: "connection_rejected",
+            message,
+            source: { id: String(credential.integration) },
+            credential: { kind: "upstream", label: String(credential.connection) }
+          })
+        )
+      ),
+      Effect5.withSpan("mcp.plugin.invoke_tool", {
+        attributes: {
+          "mcp.tool.name": String(toolRow.name),
+          "mcp.integration.slug": String(toolRow.integration)
+        }
+      })
+    ),
+    detect: ({ ctx, url }) => Effect5.gen(function* () {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
+      const trimmed = url.trim();
+      if (!trimmed) return null;
+      const parsed = yield* Effect5.try({
+        try: () => new URL(trimmed),
+        catch: (cause) => cause
+      }).pipe(Effect5.option);
+      if (Option4.isNone(parsed)) return null;
+      const name = parsed.value.hostname || "mcp";
+      const slug = deriveMcpNamespace({ endpoint: trimmed });
+      const connector = createMcpConnector({ transport: "remote", endpoint: trimmed });
+      const connected = yield* discoverTools(connector).pipe(
+        Effect5.map(() => true),
+        Effect5.catch(() => Effect5.succeed(false)),
+        Effect5.withSpan("mcp.plugin.discover_tools")
+      );
+      if (connected) {
+        return {
+          kind: MCP_PLUGIN_ID,
+          confidence: "high",
+          endpoint: trimmed,
+          name,
+          slug
+        };
+      }
+      const shape = yield* probeMcpEndpointShape(trimmed, { httpClientLayer });
+      if (shape.kind === "mcp") {
+        return {
+          kind: MCP_PLUGIN_ID,
+          confidence: "high",
+          endpoint: trimmed,
+          name,
+          slug
+        };
+      }
+      if (urlMatchesToken(parsed.value, "mcp")) {
+        return {
+          kind: MCP_PLUGIN_ID,
+          confidence: "low",
+          endpoint: trimmed,
+          name,
+          slug
+        };
+      }
+      return null;
+    }).pipe(
+      Effect5.catch(() => Effect5.succeed(null)),
+      Effect5.withSpan("mcp.plugin.detect", {
+        attributes: { "mcp.endpoint": url }
+      })
+    ),
+    // Honour upstream destructiveHint from MCP ToolAnnotations using the stamp
+    // persisted in each tool row's annotations.
+    resolveAnnotations: ({ toolRows }) => Effect5.sync(() => {
+      const out = {};
+      for (const row of toolRows) {
+        const stamp = readStamp(row.annotations);
+        const ann = stamp?.upstream;
+        if (ann?.destructiveHint === true) {
+          out[String(row.name)] = {
+            requiresApproval: true,
+            approvalDescription: ann.title ?? stamp?.toolName ?? String(row.name)
+          };
+        } else {
+          out[String(row.name)] = { requiresApproval: false };
+        }
+      }
+      return out;
+    }),
+    describeAuthMethods: describeMcpAuthMethods,
+    describeIntegrationDisplay: describeMcpIntegrationDisplay,
+    integrationConfigure: {
+      type: "mcp",
+      configure: ({ ctx, integration, config }) => Effect5.gen(function* () {
+        const next = parseMcpIntegrationConfig(config);
+        if (!next) return;
+        yield* ctx.core.integrations.update(integration, { config: next });
+      })
+    },
+    staticSources: (self) => [
+      {
+        id: "mcp",
+        kind: "executor",
+        name: "MCP",
+        tools: [
+          tool({
+            name: "probeEndpoint",
+            description: "Probe a remote MCP endpoint before adding it. If the result requires OAuth, run the core OAuth handoff (`oauth.probe`, `oauth.start`) to mint a connection; otherwise create a connection with `connections.create` carrying the API key or header value.",
+            inputSchema: McpProbeEndpointInputStandardSchema,
+            outputSchema: McpProbeEndpointOutputStandardSchema,
+            execute: (input) => self.probeEndpoint(input).pipe(
+              Effect5.map(ToolResult.ok),
+              Effect5.catchTag(
+                "McpConnectionError",
+                ({ message, transport }) => Effect5.succeed(mcpToolFailure("mcp_connection_failed", message, { transport }))
+              )
+            )
+          }),
+          tool({
+            name: "getServer",
+            description: "Inspect a registered MCP integration, including transport, endpoint/command, and auth template. Use this before creating a connection (`connections.create` / `oauth.start`).",
+            inputSchema: McpGetServerInputStandardSchema,
+            outputSchema: McpGetServerOutputStandardSchema,
+            execute: (input) => {
+              const args = input;
+              return Effect5.map(
+                self.getServer(args.slug),
+                (integration) => ToolResult.ok({ integration })
+              );
+            }
+          }),
+          tool({
+            name: "addServer",
+            description: "Register an MCP server in the catalog as an integration. Returns its `slug`. Then create a connection against it: for header/API-key auth call `connections.create` with the value; for OAuth-protected servers run `oauth.probe` + `oauth.start`. Tools are produced per-connection at connection create / refresh.",
+            annotations: {
+              requiresApproval: true,
+              approvalDescription: "Add an MCP server"
+            },
+            inputSchema: McpAddServerInputStandardSchema,
+            outputSchema: McpAddServerOutputStandardSchema,
+            execute: (rawInput) => {
+              const input = rawInput;
+              return self.addServer(input).pipe(
+                Effect5.map(ToolResult.ok),
+                Effect5.catchTag(
+                  "IntegrationAlreadyExistsError",
+                  ({ slug }) => Effect5.succeed(
+                    mcpToolFailure(
+                      "integration_already_exists",
+                      `Integration ${slug} already exists; update it instead of re-adding.`
+                    )
+                  )
+                )
+              );
+            }
+          })
+        ]
+      }
+    ]
+  };
+});
+
+export {
+  joinToolPath,
+  extractManifestFromListToolsResult,
+  deriveMcpNamespace,
+  userFacingProbeMessage,
+  mcpPlugin
+};
+//# sourceMappingURL=chunk-2TXHTMKM.js.map