@jskit-ai/connectors-catalog 0.1.1

package/patterns/api-key-connection/PATTERN.md

@@ -0,0 +1,368 @@
+---
+id: connectors/api-key-connection
+title: API-key connections with portable JSON configuration
+summary: Compose provider operations, authorization and encrypted file storage from a CLI or application server.
+keywords: connectors, integrations, api-key, resend, firecrawl, clay, prestashop, clickhouse, semrush, granola, dbt, semantic-layer, metrics, x-twitter, cli, files
+requires: @jskit-ai/connectors-core, @jskit-ai/connectors-catalog
+---
+
+# API-key connections with portable JSON configuration
+
+## Use when
+
+Use for an API-key provider in the connector catalogue, owned by an application
+or explicitly authorized assistant. Resend and Firecrawl illustrate the wiring
+below; select other providers through their individual exports and setup guides.
+The runtime is imported library code. Configuration and
+connection state can both use text files; no database or app generator is
+required.
+
+## Do not use when
+
+Do not apply a single shared API key to individual users while claiming they
+have connected separate provider accounts. Do not use a local operator's
+identity policy in a web API. Provider account/subscription provisioning is an
+application-owner task, not something this pattern automatically activates. Logo.dev public
+images use the separate public-image pattern, without server verification.
+
+## Product decisions
+
+Choose the named integration slots, private environment, durable runtime
+location and authenticated authorization policy. The runtime directory belongs
+outside exported application source. Keep its encryption key stable across
+restarts and backups. A key rotation changes the environment binding; it does
+not require putting credentials into source.
+
+## Invariants
+
+- CLI and editor read and edit the same `integrations.json`.
+- Configuration contains references, never raw API keys.
+- Runtime connection state uses encrypted JSON outside source when using the file store.
+- Access is checked before credential resolution and every operation.
+- A successful provider read precedes Connected; saving fields does not.
+- ClickHouse accepts a database username and optional password reference. Only
+  omit that reference when an empty password is intended. For no Authorization
+  header, use `authentication: { method: "none" }`, omit `settings.username`,
+  and call `connectWithoutCredentials`; authorization and file storage still
+  apply. A missing explicit binding is always an error. Use the fixed
+  `tables.list`, `columns.list` and `rows.list` operations with typed parameters;
+  never interpolate SQL or assume verification grants access to every table.
+  See the [ClickHouse guide](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/clickhouse.md) for settings constraints,
+  administrator setup, pagination and the absence of an OAuth callback.
+- Provider settings use the provider's shared schema. Save the normalized
+  configuration returned by validation so CLI and UI defaults agree.
+- Changing a setting such as region or environment requires verification again.
+- Providers such as Algolia also require an application ID. Use their settings
+  schema and guide; never infer the request host from user operation input.
+- Twilio requires an Account SID and regional API Key SID in settings; its
+  primary secret reference resolves the API key secret. Do not substitute an
+  account Auth Token or construct credentials from the Account SID.
+- PostHog uses a public project token in a JSON body. Its `connectApiKey` call
+  needs `verificationInput: { distinct_id: "your-explicit-subject" }` to evaluate
+  flags; never invent a subject or send an event just to verify configuration.
+  The token cannot read private analytics or establish a login. Its guide
+  explains HTTP-200 quota failures and event acceptance versus ingestion.
+- Chargebee requires a site name without `.chargebee.com` and a key that can
+  read transactional data. Test/live sites have different keys; a second key
+  on one site does not create separate rate-limit capacity.
+- Ashby job reads use POST and can fail inside an HTTP-200 reply. Keep cursor
+  and incremental-sync checkpoints in application-owned state for the specific
+  connection; the adapter does not reset or advance them automatically.
+- Lexware's Public API key remains private. Sevdesk uses its token directly
+  in Authorization and includes people with `depth: 1` by default. Import the
+  respective provider; do not infer authentication or pagination from form labels.
+- Apollo searches already saved company accounts. Prospect search/enrichment
+  uses different endpoints and is not implemented by `accounts.search`.
+- Clay uses its Public API key and verifies identity before any search. Import
+  `clayProvider` from `@jskit-ai/connectors-catalog/server/clay`. Its guide supplies
+  the portable configuration. Authorize `searches.create` with a valid Clay
+  query, retain its `search_id` under that connection, then explicitly invoke
+  `searches.next` with `{ searchId, limit }`. Each POST advances an iterator;
+  do not replay interrupted requests or automatically consume remaining pages.
+  Verification does not prove search quota. Shared keys do not implement login.
+- Attention conversation results can contain transcript content even with
+  detailed transcripts disabled. Its documented key-provisioning API belongs
+  in an operator workflow, not the application's conversation-reading actions.
+- Telegram verification reads bot identity, never the update queue. Its token
+  identifies a bot, not an application user. Webhook reads do not set a webhook.
+- KLIPY verifies trending clips and supports explicit clip search. It defaults
+  to the high content filter and never invents a customer identifier.
+- Telegram and KLIPY credentials appear in the request path. Redact paths in
+  HTTP tracing; configuration and connection records retain only references.
+- Google Maps Platform requires `verificationInput: { address: "an explicit address" }`.
+  Verification makes a geocoding request and can incur provider usage charges.
+  Its optional browser-key reference is never resolved by the server adapter.
+  `ZERO_RESULTS` is a valid lookup; billing, quota and permission failures are not.
+- Mapbox token verification rejects HTTP-200 invalid-token replies. An active
+  token does not prove geocoding entitlement or validate its separate browser key.
+- WooCommerce and self-hosted WordPress require an operator-chosen HTTPS site
+  URL with its installation path. Configuration editors control where Basic
+  credentials go; private hosts are allowed, so the host owns network policy.
+  WooCommerce pairs its consumer key with a secret reference and verifies
+  product reads. WordPress pairs its username with an Application Password
+  reference and verifies users/me; public post reads alone cannot verify it.
+  Neither flow needs a global OAuth registration or a callback. Separate
+  application keys on the same site do not establish separate hosting capacity.
+- PrestaShop uses its Webservice API key as the Basic-auth username with an
+  empty password, preserving the store's installation subdirectory before
+  `/api`. It requests JSON product/order pages with explicit offset and limit.
+  Product verification does not establish order permission. Preserve the
+  provider's empty `[]` result, multilingual values and decimal strings; do
+  not invent OAuth credentials, automatic pagination or XML writes.
+- An optional frontend key reference is distinct from the primary backend key.
+  Only the application may deliberately expose a suitable search-only key;
+  successful backend verification does not verify that frontend key's restrictions.
+
+## Framework APIs
+
+Import configuration validation from connectors-core/shared/configuration,
+connection service and environment references from connectors-core/server,
+and the file store and credential protection from connectors-core/server/file-storage.
+Import the selected provider through its individual connectors-catalog/server export.
+Each provider guide names its useful operations, accepted inputs, credential
+bootstrap and current limits. Some keys allow sending or management beyond the
+implemented read operation; this pattern does not grant those extra operations.
+
+## Example files
+
+The application owns `integrations.json`:
+
+```json
+{
+  "schemaVersion": 1,
+  "registrations": {},
+  "integrations": {
+    "mail": {
+      "provider": "resend",
+      "displayName": "Sending domains",
+      "accountMode": "shared",
+      "scopes": [],
+      "authentication": { "method": "api-key", "secretRef": "env:RESEND_API_KEY" }
+    },
+    "web": {
+      "provider": "firecrawl",
+      "accountMode": "assistant",
+      "scopes": [],
+      "authentication": { "method": "api-key", "secretRef": "env:FIRECRAWL_API_KEY" }
+    }
+  }
+}
+```
+
+A server module or manually written CLI composes the same library calls:
+
+```js
+import { readFile } from "node:fs/promises";
+import { parseIntegrationConfiguration } from "@jskit-ai/connectors-core/shared/configuration";
+import { createConnectionService, createEnvironmentReferenceResolver } from "@jskit-ai/connectors-core/server";
+import { createFileConnectionStore, createCredentialProtection } from "@jskit-ai/connectors-core/server/file-storage";
+import { resendProvider } from "@jskit-ai/connectors-catalog/server/resend";
+import { firecrawlProvider } from "@jskit-ai/connectors-catalog/server/firecrawl";
+
+const providers = [resendProvider, firecrawlProvider];
+const configuration = parseIntegrationConfiguration(await readFile("integrations.json", "utf8"), { providers });
+const protection = createCredentialProtection({
+  keys: { current: Buffer.from(process.env.CONNECTOR_STORAGE_KEY, "base64") },
+  activeKeyId: "current"
+});
+const store = createFileConnectionStore({ directory: process.env.CONNECTOR_STATE_DIRECTORY, protection });
+const connections = createConnectionService({
+  configuration, providers, store,
+  resolveReference: createEnvironmentReferenceResolver(),
+  authorize: applicationConnectionPolicy
+});
+
+// context comes from the existing application's authentication or local operator policy.
+await connections.connectApiKey({ context, integrationId: "mail" });
+const domains = await connections.invoke({ context, integrationId: "mail", operation: "domains.list", input: { limit: 10 } });
+```
+
+`applicationConnectionPolicy` receives the context, slot, operation and account
+mode. It returns `{ applicationId, subjectId }` only after checking that the
+caller can perform that operation. Shared connections use a stable shared
+subject after membership checks. An operator-only CLI can identify the trusted
+OS process owner; web routes must derive identity from the authenticated
+session, not request parameters.
+
+## Semrush composition
+
+Import `semrushProvider` from `@jskit-ai/connectors-catalog/server/semrush` and
+supply the configuration in the [Semrush guide](https://github.com/mobily-enterprises/jskit-ai/blob/main/packages/connectors-catalog/docs/semrush.md). Reuse
+`createConnectionService`, the file store and the host policy shown above:
+
+```js
+await connections.connectApiKey({ context, integrationId: "seo" });
+const page = await connections.invoke({
+  context, integrationId: "seo", operation: "projects.list",
+  input: { scope: "OWN", limit: 25, offset: 0 }
+});
+// Authorize the chosen project for this application before reading it.
+const project = await connections.invoke({
+  context, integrationId: "seo", operation: "projects.get",
+  input: { projectId: authorizedProjectId }
+});
+```
+
+Use a V4 API-key reference, never a V3 key or an OAuth token. Preserve the
+returned pagination and provider permissions; do not enumerate later pages
+without an explicit application request. `connector_quota_limited` requires
+account-capacity handling, not a retry loop. Separate keys on one account do
+not create independent capacity. The captured OAuth scopes, provider onboarding
+and individual app-user connections remain separate unfinished work.
+
+## Verification
+
+Focused library tests use simulated HTTP responses and actual temporary JSON
+storage. They verify validation, provider requests, result shapes, isolation,
+rotation, rejected credentials, pagination, atomic replacement and restart.
+Automated editor tests verify portable file edits and field errors. No real
+provider use or generated sample application is needed for these checks.
+
+For future live acceptance, follow each provider's setup guide and invoke its
+read-only check explicitly. Resend lists domains; Firecrawl reads credits.
+`pages.scrape` is a separate, authorized operation that consumes credits.
+
+## Variation points
+
+Use `googleCalendarProvider` and OAuth lifecycle methods with the same file
+store for a Calendar connection. Use the optional Knex store only when the
+application explicitly owns a SQL database. Hosts with an established shared
+filesystem identity may set `directoryMode` and `fileMode` at store creation;
+the library creates files with those modes and never recursively repairs a tree.
+
+Expose the ordinary `createConnectorsFeature` status, verifyApiKey and disconnect
+actions, or compose the service inside an existing Feature. Business operations
+remain named application actions. The UI uses `IntegrationConfigurationFields`
+with the matching browser-safe definition; a host credential slot can write
+values through its existing secret-entry service while keeping references in
+configuration.
+
+## Avoid
+
+Do not turn provider metadata into arbitrary authenticated URL forwarding.
+Do not retry a paid or mutating request automatically. Do not mark an untested
+managed mode or an unimplemented provider operation available.
+
+
+## Granola meeting data
+
+Import `granolaProvider` from `@jskit-ai/connectors-catalog/server/granola` and
+compose the same API-key connection service and encrypted file store. The
+packaged `docs/granola.md` explains personal/workspace keys and ownership.
+Use a `grn_` key through a secret reference; no OAuth registration is required
+for this API-key mode. Personal notes access does not create per-user app login.
+
+```js
+const result = await connections.invoke({
+  context: authenticatedOwner, integrationId: "meetings", operation: "notes.list",
+  input: { created_after: "2026-09-01", page_size: 10 }
+});
+const note = await connections.invoke({
+  context: authenticatedOwner, integrationId: "meetings", operation: "notes.get",
+  input: { note_id: selectedNoteId }
+});
+```
+
+Use the provider's `not_` note IDs and `fol_` folder IDs, not UUIDs from browser
+URLs. `folders.list` supplies folder IDs; `transcripts.list` reads transcript
+pages. Keep cursors with the same connection and filters, and request each page
+explicitly. `notes.get` omits transcripts by default; `include: "transcript"`
+requests inline data, but a 413 asks the host to use paginated transcripts.
+Do not automatically retry or fetch every page.
+
+The host owns note selection and access policy, especially for a shared key.
+Preserve null private-note fields and optional speaker attribution; do not infer
+speaker identity from microphone/speaker source. Render provider text safely.
+A valid empty note list may mean no accessible processed notes. Saved configuration
+is not proof of key validity. Sharing a personal key shares its permitted data.
+The separate Granola MCP browser OAuth/DCR flow is not implemented by this adapter;
+do not send API keys to the MCP server or invent managed client credentials.
+
+## dbt Semantic Layer metadata
+
+Import `dbtSemanticLayerProvider` from
+`@jskit-ai/connectors-catalog/server/dbt-semantic-layer` and include it in the
+same `providers` array passed to both `parseIntegrationConfiguration` and
+`createConnectionService`. Use the ordinary file store and reference resolver
+shown above; no database, template generation or alternate transport is needed.
+
+Create a `dbt-semantic-layer` integration with `settings.host` and
+`settings.environmentId`. The latter must remain a decimal string, even in a
+CLI: converting it to a number can round large IDs. Store the service token in
+`authentication.secretRef`; permissions and warehouse credentials are configured
+in dbt. Use the guide's actual JSON, not an invented OAuth registration.
+
+The host authenticates callers and authorizes the application, integration and
+subject before every call. For an assistant, explicitly bind that identity to
+the allowed shared connection. A token's metadata access is not application
+login and does not make every user an authorized reader of that warehouse.
+
+After the operator supplies a token, call `connectApiKey` explicitly. Successful
+verification reads only `environmentInfo.dialect`. Keep configuration saving
+separate from connection verification. Display the returned connection status,
+and handle denied access or reconnection through the existing host UI.
+
+Use `metrics.list` to select metric names, `dimensions.list` with
+`metrics: [{ name: "order_total" }]` to discover compatible dimensions, and
+`savedQueries.list` to browse saved-query metadata. Do not silently select the
+first metric. All page operations accept `pageNum`, `pageSize` and optional
+`search`; keep paging user-driven and inspect the returned totals. One invoke
+makes one HTTP request. Empty lists and null descriptions are ordinary states.
+
+Inputs cannot override the configured host or environment. Preserve returned
+metadata as data, and escape it in UI rendering. Use `AbortSignal` when leaving
+a screen, avoid replaying failed requests automatically, and resolve rotated
+credentials through the original secret reference. Changing that reference,
+host or environment requires fresh verification. Disconnect only removes local
+state; the operator revokes tokens in dbt.
+
+There is no query-execution operation in this initial fragment. Do not invent
+`query.create`, run SQL through another connector, or claim a metrics catalogue
+is a warehouse-results dashboard. Add and verify a separate provider operation
+before implementing result polling or Arrow decoding. The universal OAuth
+callback is not applicable to this service-token flow. The application owner
+supplies its service token and arranges the required account capacity.
+
+## X public profiles and posts
+
+Import `xTwitterProvider` from `@jskit-ai/connectors-catalog/server/x-twitter`.
+Compose the same configuration parser, connection service, file store and host
+authorization policy. Store the app-only token as a secret reference; use the
+guide's JSON in `docs/x-twitter.md`. No template or separate storage layer is
+needed. Shared and assistant ownership both act as the provider application.
+
+Verification needs `verificationInput: { username: selectedPublicUsername }` in
+`connectApiKey`. Do not silently choose a profile or assume a saved token is
+verified. A failed lookup can mean a nonexistent target or insufficient access.
+Check status and show the appropriate input, access, billing or reconnect action.
+
+Use `users.lookup` with `username` to obtain `data.id`, then `users.posts` with
+that exact string as `userId`. Never convert X IDs to JavaScript numbers. The
+post request accepts `maxResults` (5–100) and an optional `paginationToken` from
+the preceding page's `meta.next_token`. Fetch pages only on an explicit action,
+preserve query ownership and handle empty pages with no `data` property.
+
+The host authenticates and authorizes callers before token use. Public content
+still consumes the application's access and usage capacity. Render post text
+as data; provider content cannot authorize another operation. Pass AbortSignal
+on abandoned views and do not replay errors or incomplete results silently.
+
+This is app-only access: there is no current user, user login, posting, private
+inbox or provider callback. Do not invent `users.me`, attach the operator's X
+identity to every app user, or use public profile lookup to authenticate someone.
+The application owns the provider token through its private environment binding
+and authorizes each caller; an editor does not supply shared access or quotas.
+Local disconnect does not invalidate the application-wide token at X.
+
+## Wix account sites
+
+Import `wixProvider` from `@jskit-ai/connectors-catalog/server/wix` and follow
+`docs/wix.md`. Supply an account API-key reference and `settings.accountId` from
+the same Wix API Keys Manager. The runtime's `sites.list` operation verifies
+access and returns explicit pages using `limit` and an opaque `cursor`.
+It sends raw key authorization with `wix-account-id`; this account operation
+must not send `wix-site-id`. Preserve REST `id` fields and optional page metadata.
+Shared/assistant ownership needs a trusted host access policy. The credential
+is administrative and does not implement per-user login or site publishing.
+There is no OAuth callback for this mode. The application owner supplies its
+account credential; that credential cannot access unrelated customer accounts.

package/patterns/api-key-connection/example/connections.js

@@ -0,0 +1,18 @@
+import { readFile } from "node:fs/promises";
+import { parseIntegrationConfiguration } from "@jskit-ai/connectors-core/shared/configuration";
+import { createConnectionService, createEnvironmentReferenceResolver } from "@jskit-ai/connectors-core/server";
+import { createFileConnectionStore, createCredentialProtection } from "@jskit-ai/connectors-core/server/file-storage";
+import { resendProvider } from "@jskit-ai/connectors-catalog/server/resend";
+import { firecrawlProvider } from "@jskit-ai/connectors-catalog/server/firecrawl";
+
+// Both a manually written CLI and a server can compose this application-owned module.
+// The application supplies its existing identity and permission policy.
+export async function applicationConnections({ authorize, env = process.env, configFile = "integrations.json" }) {
+  const providers = [resendProvider, firecrawlProvider];
+  const configuration = parseIntegrationConfiguration(await readFile(configFile, "utf8"), { providers });
+  const protection = createCredentialProtection({
+    keys: { current: Buffer.from(env.CONNECTOR_STORAGE_KEY, "base64") }, activeKeyId: "current"
+  });
+  const store = createFileConnectionStore({ directory: env.CONNECTOR_STATE_DIRECTORY, protection });
+  return createConnectionService({ configuration, providers, store, authorize, resolveReference: createEnvironmentReferenceResolver(env) });
+}

package/patterns/api-key-connection/example/integrations.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 1,
+  "registrations": {},
+  "integrations": {
+    "mail": {
+      "provider": "resend",
+      "displayName": "Sending domains",
+      "accountMode": "shared",
+      "scopes": [],
+      "authentication": { "method": "api-key", "secretRef": "env:RESEND_API_KEY" }
+    },
+    "web": {
+      "provider": "firecrawl",
+      "accountMode": "assistant",
+      "scopes": [],
+      "authentication": { "method": "api-key", "secretRef": "env:FIRECRAWL_API_KEY" }
+    }
+  }
+}

package/patterns/assistant-mcp/PATTERN.md

@@ -0,0 +1,110 @@
+---
+id: connectors/assistant-mcp
+title: Assistant MCP connections with portable files
+summary: Compose token-based MCP discovery and explicitly authorized tool calls using the shared connector runtime.
+keywords: connectors, integrations, mcp, n8n, sanity, assistant, files, cli
+requires: @jskit-ai/connectors-core, @jskit-ai/connectors-catalog
+---
+
+# Assistant MCP connections with portable files
+
+## Use when
+
+An existing assistant host or operator CLI needs n8n or Sanity MCP tools using
+an owner's token. Use the package runtime for protocol and credential handling,
+and source configuration for the same values edited by the UI.
+
+## Do not use when
+
+This is not application-user OAuth, a shared deployed-app account, local stdio
+or automatic assistant attachment. Do not enable tool calls on a public route
+using a hard-coded owner. The current fragments support token authentication.
+
+## Product decisions
+
+Choose the assistant owner and permitted tools. Existing host policy must decide
+which calls need explicit user approval. It also owns model tool presentation,
+argument validation, output handling and project/session access. Preserve the
+host's restrictions on temporary assistants; a configured connector is not
+permission to bypass them.
+
+## Invariants
+
+- Configuration and runtime state remain text files with the existing owners.
+- Tokens stay in Env; grants use the core's encrypted private file store.
+- `connectApiKey` initializes and lists tools without executing a tool.
+- Discovery is not blanket execution permission or proof of every tool's access.
+- `authorize` sees the exact tool name and arguments before any network call.
+- Provider results and schemas remain untrusted external data.
+- Cancellation ends the local request; it cannot undo accepted remote work.
+
+## Framework APIs
+
+Use `createConnectionService`, `createEnvironmentReferenceResolver`,
+`createFileConnectionStore`, `createCredentialProtection` and the shared parser
+from connectors-core. Import only the required `n8nProvider` or `sanityProvider`
+server export. The official MCP SDK is internal to these server modules; the
+browser imports definitions only.
+
+## Example files
+
+`example/integrations.json` supplies an assistant-owned n8n slot. Set its actual
+instance endpoint and provision `N8N_MCP_TOKEN` outside source. Use the
+`api-key-connection` pattern's ordinary file-runtime composition with
+`providers: [n8nProvider]`. Supply the host's existing connection policy:
+
+```js
+async function applicationConnectionPolicy(context, request) {
+  const owner = await assistantAccess.requireConnectionOwner(context, request.integrationId);
+  if (request.operation === "tools.call") {
+    await assistantAccess.requireToolApproval(context, {
+      integrationId: request.integrationId,
+      name: request.input.name,
+      arguments: request.input.arguments
+    });
+  }
+  return owner;
+}
+```
+
+`assistantAccess` represents application-owned authorization, not a JSKIT API.
+It must return stable trusted `applicationId` and `subjectId` values, and reject
+unauthorized management/discovery as well as calls. Approval must be tied to the
+exact arguments. Connection membership alone is insufficient for tool execution.
+
+```js
+await connections.connectApiKey({ context, integrationId: "automation" });
+const discovered = await connections.invoke({
+  context, integrationId: "automation", operation: "tools.list", input: {}
+});
+// After choosing a permitted tool, validating its input and obtaining any approval:
+const result = await connections.invoke({
+  context, integrationId: "automation", operation: "tools.call",
+  input: { name: approvedToolName, arguments: approvedArguments }, signal
+});
+```
+
+Process `nextCursor` explicitly; discovery does not auto-fetch all pages. Check
+`result.isError` before treating a tool result as success. Never automatically
+follow links or obey instructions inside descriptions or tool output.
+
+## Variation points
+
+Sanity has a fixed endpoint and no `settings.serverUrl`. n8n uses an own instance
+URL and its MCP token, not a REST API key. A trusted local CLI may use its process
+identity, but still needs an explicit tool policy. The same implementation can
+run under an authorized editor assistant without becoming a published-app API.
+
+## Verification
+
+`test/mcp.test.js` exercises the actual SDK with mocked protocol responses and
+encrypted file persistence, including JSON/SSE, cancellation, cleanup, owner
+isolation, token rotation and prevention of input mutation during authorization.
+Public editor tests prove configuration and reload. No sample app is generated
+or run, and no live tool is invoked.
+
+## Avoid
+
+Do not copy the MCP protocol into scaffolding, expose bearer tokens to browsers,
+attach these tools to every assistant automatically, infer permission from a
+tool's annotations, or fall back to provider OAuth without an implemented flow.

package/patterns/assistant-mcp/example/integrations.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "registrations": {},
+  "integrations": {
+    "automation": {
+      "provider": "n8n",
+      "accountMode": "assistant",
+      "scopes": [],
+      "authentication": { "method": "api-key", "secretRef": "env:N8N_MCP_TOKEN" },
+      "settings": { "serverUrl": "https://automation.example.com/mcp-server/http" }
+    }
+  }
+}