@moxxy/plugin-mcp 0.26.0

package/dist/admin/tools/add.js

@@ -0,0 +1,97 @@
+import { defineTool, MoxxyError } from '@moxxy/sdk';
+import { mcpConfigPath, mutateMcpConfig, readMcpConfig } from '../config-io.js';
+import { addServerInput, validateAddServerInput } from '../schema.js';
+export function buildAddServerTool(deps) {
+    const { registry, attachServer, detachServer, writeMcpUsageSkill } = deps;
+    return defineTool({
+        name: 'mcp_add_server',
+        description: 'Register a new MCP server in ~/.moxxy/mcp.json. Pick "stdio" for local commands ' +
+            '(npm/uv packages, scripts); pick "http" or "sse" for remote HTTP servers. The new ' +
+            'server\'s tools become available after the next moxxy restart. Call mcp_test_server ' +
+            'first if you want to verify connectivity before persisting. NEVER pass API keys or ' +
+            'tokens in plaintext: store the secret in the vault first (vault_set), then reference ' +
+            'it as "${vault:NAME}" in the env/header value — the placeholder is what gets ' +
+            'persisted, and it is resolved only at connect time.',
+        inputSchema: addServerInput,
+        permission: { action: 'prompt' },
+        handler: async (input) => {
+            const server = validateAddServerInput(input);
+            const cfg = await readMcpConfig();
+            if (cfg.servers.some((s) => s.name === server.name)) {
+                throw new MoxxyError({
+                    code: 'CONFIG_INVALID',
+                    message: `mcp_add_server: an MCP server named "${server.name}" already exists. ` +
+                        `Use mcp_remove_server first, or pick a different name.`,
+                });
+            }
+            // Hot-attach: connect + register tools BEFORE persisting. If
+            // attach fails (bad URL, missing command, schema mismatch),
+            // we never write a broken entry to disk.
+            const { toolNames, descriptors } = await attachServer(server);
+            // Cache descriptors so next boot can register lazy stubs
+            // without paying the connection cost up-front.
+            const stored = { ...server, cachedTools: descriptors };
+            // Persist under the shared config mutex, re-reading the latest
+            // catalog so a concurrent add/remove can't clobber the file. The
+            // duplicate check is repeated against the fresh read to catch a race
+            // where two adds for the same name both passed the initial check.
+            try {
+                await mutateMcpConfig((current) => {
+                    if (current.servers.some((s) => s.name === server.name)) {
+                        throw new MoxxyError({
+                            code: 'CONFIG_INVALID',
+                            message: `mcp_add_server: an MCP server named "${server.name}" already exists. ` +
+                                `Use mcp_remove_server first, or pick a different name.`,
+                        });
+                    }
+                    return { next: { servers: [...current.servers, stored] }, result: undefined };
+                });
+            }
+            catch (err) {
+                // attachServer already registered the live tools + opened a client, but
+                // persistence failed (e.g. a concurrent add for the same name won the
+                // race, or the file write threw). Roll the live registry back so we
+                // don't strand callable tools with no config entry + a leaked client.
+                await detachServer(server.name).catch(() => undefined);
+                throw err;
+            }
+            // Auto-create the usage skill so /skills surfaces the new
+            // server alongside hand-authored skills. Best-effort — if
+            // skill writing fails, the MCP attach still succeeded.
+            let skillResult = null;
+            if (input.autoSkill !== false) {
+                try {
+                    skillResult = await writeMcpUsageSkill(server, descriptors);
+                }
+                catch (err) {
+                    skillResult = null;
+                    // surface but don't fail the whole tool call
+                    return {
+                        ok: true,
+                        name: server.name,
+                        path: mcpConfigPath(),
+                        attached: registry !== null,
+                        tools: toolNames,
+                        skill: null,
+                        skillError: err instanceof Error ? err.message : String(err),
+                        note: 'Server attached + persisted; skill creation failed (see skillError).',
+                    };
+                }
+            }
+            return {
+                ok: true,
+                name: server.name,
+                path: mcpConfigPath(),
+                attached: registry !== null,
+                tools: toolNames,
+                skill: skillResult,
+                note: registry
+                    ? `Live in this session — ${toolNames.length} tool${toolNames.length === 1 ? '' : 's'} now callable.` +
+                        (skillResult ? ` Usage skill written to ${skillResult.path}.` : '') +
+                        ' Persisted; survives restart.'
+                    : 'Saved to config. Restart moxxy to load the tools (no live registry was wired into the admin plugin).',
+            };
+        },
+    });
+}
+//# sourceMappingURL=add.js.map

package/dist/admin/tools/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../src/admin/tools/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAgB,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAqBtE,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAC1E,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,kFAAkF;YAClF,oFAAoF;YACpF,sFAAsF;YACtF,qFAAqF;YACrF,uFAAuF;YACvF,+EAA+E;YAC/E,qDAAqD;QACvD,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,UAAU,CAAC;oBACnB,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EACL,wCAAwC,MAAM,CAAC,IAAI,oBAAoB;wBACvE,wDAAwD;iBAC3D,CAAC,CAAC;YACL,CAAC;YACD,6DAA6D;YAC7D,4DAA4D;YAC5D,yCAAyC;YACzC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9D,yDAAyD;YACzD,+CAA+C;YAC/C,MAAM,MAAM,GAAoB,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACxE,+DAA+D;YAC/D,iEAAiE;YACjE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE;oBAChC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxD,MAAM,IAAI,UAAU,CAAC;4BACnB,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EACL,wCAAwC,MAAM,CAAC,IAAI,oBAAoB;gCACvE,wDAAwD;yBAC3D,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAChF,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,sEAAsE;gBACtE,oEAAoE;gBACpE,sEAAsE;gBACtE,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACvD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,0DAA0D;YAC1D,0DAA0D;YAC1D,uDAAuD;YACvD,IAAI,WAAW,GAA+C,IAAI,CAAC;YACnE,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,WAAW,GAAG,IAAI,CAAC;oBACnB,6CAA6C;oBAC7C,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,aAAa,EAAE;wBACrB,QAAQ,EAAE,QAAQ,KAAK,IAAI;wBAC3B,KAAK,EAAE,SAAS;wBAChB,KAAK,EAAE,IAAI;wBACX,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBAC5D,IAAI,EAAE,sEAAsE;qBAC7E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,aAAa,EAAE;gBACrB,QAAQ,EAAE,QAAQ,KAAK,IAAI;gBAC3B,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,QAAQ;oBACZ,CAAC,CAAC,0BAA0B,SAAS,CAAC,MAAM,QAAQ,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gBAAgB;wBACnG,CAAC,WAAW,CAAC,CAAC,CAAC,2BAA2B,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,+BAA+B;oBACjC,CAAC,CAAC,sGAAsG;aAC3G,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/admin/tools/list.d.ts

@@ -0,0 +1,3 @@
+import { type ToolDef } from '@moxxy/sdk';
+export declare function buildListServersTool(): ToolDef;
+//# sourceMappingURL=list.d.ts.map

package/dist/admin/tools/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/admin/tools/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAGzD,wBAAgB,oBAAoB,IAAI,OAAO,CAe9C"}

package/dist/admin/tools/list.js

@@ -0,0 +1,16 @@
+import { defineTool, z } from '@moxxy/sdk';
+import { readMcpConfig } from '../config-io.js';
+export function buildListServersTool() {
+    return defineTool({
+        name: 'mcp_list_servers',
+        description: 'List every MCP server currently registered in ~/.moxxy/mcp.json. Returns name + transport kind + connection details (command/url) for each.',
+        inputSchema: z.object({}),
+        handler: async () => {
+            const cfg = await readMcpConfig();
+            return cfg.servers.map((s) => s.kind === undefined || s.kind === 'stdio'
+                ? { name: s.name, kind: 'stdio', command: s.command }
+                : { name: s.name, kind: s.kind, url: s.url });
+        },
+    });
+}
+//# sourceMappingURL=list.js.map

package/dist/admin/tools/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/admin/tools/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,CAAC,EAAgB,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,6IAA6I;QAC/I,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;YAClC,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3B,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;gBACxC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAgB,EAAE,OAAO,EAAG,CAAyB,CAAC,OAAO,EAAE;gBACvF,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAG,CAAqB,CAAC,GAAG,EAAE,CACpE,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/admin/tools/remove.d.ts

@@ -0,0 +1,6 @@
+import { type ToolDef } from '@moxxy/sdk';
+export interface RemoveServerToolDeps {
+    detachServer(name: string): Promise<boolean>;
+}
+export declare function buildRemoveServerTool(deps: RemoveServerToolDeps): ToolDef;
+//# sourceMappingURL=remove.d.ts.map

package/dist/admin/tools/remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.d.ts","sourceRoot":"","sources":["../../../src/admin/tools/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAIzD,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAqCzE"}

package/dist/admin/tools/remove.js

@@ -0,0 +1,41 @@
+import { defineTool, z } from '@moxxy/sdk';
+import { mutateMcpConfig } from '../config-io.js';
+import { serverNameSchema } from '../schema.js';
+export function buildRemoveServerTool(deps) {
+    const { detachServer } = deps;
+    return defineTool({
+        name: 'mcp_remove_server',
+        description: 'Remove an MCP server from ~/.moxxy/mcp.json and detach its tools from the live session. ' +
+            'The tools become uncallable immediately and the entry is gone on next restart.',
+        inputSchema: z.object({ name: serverNameSchema }),
+        permission: { action: 'prompt' },
+        handler: async ({ name }) => {
+            // Read-modify-write under the shared config mutex so a concurrent
+            // add/remove can't clobber the file.
+            const persisted = await mutateMcpConfig((cfg) => {
+                const filtered = cfg.servers.filter((s) => s.name !== name);
+                if (filtered.length === cfg.servers.length) {
+                    // Nothing matched — return the same reference to skip the write.
+                    return { next: cfg, result: false };
+                }
+                return { next: { servers: filtered }, result: true };
+            });
+            // Runtime detach runs OUTSIDE the config mutex (the live tool registry
+            // isn't guarded by it), so a concurrent same-name add could interleave
+            // between this persist and detach. Detach is best-effort and loosely
+            // coupled to the config — the entry is authoritative, the runtime map
+            // self-heals on the next attach/restart.
+            const detached = await detachServer(name);
+            if (!persisted && !detached) {
+                return { removed: false, name, note: `No MCP server named "${name}" was registered.` };
+            }
+            return {
+                removed: true,
+                name,
+                persistedChange: persisted,
+                detachedFromSession: detached,
+            };
+        },
+    });
+}
+//# sourceMappingURL=remove.js.map

package/dist/admin/tools/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../src/admin/tools/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,CAAC,EAAgB,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMhD,MAAM,UAAU,qBAAqB,CAAC,IAA0B;IAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC9B,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,0FAA0F;YAC1F,gFAAgF;QAClF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACjD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC1B,kEAAkE;YAClE,qCAAqC;YACrC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC3C,iEAAiE;oBACjE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBACtC,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,yCAAyC;YACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,IAAI,mBAAmB,EAAE,CAAC;YACzF,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,eAAe,EAAE,SAAS;gBAC1B,mBAAmB,EAAE,QAAQ;aAC9B,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/admin/tools/test.d.ts

@@ -0,0 +1,8 @@
+import { type ToolDef } from '@moxxy/sdk';
+import { type McpSecretResolver } from '../secrets.js';
+export interface TestServerToolDeps {
+    /** Resolves `${vault:NAME}` placeholders in env/header values at connect time. */
+    readonly secretResolver?: McpSecretResolver | null;
+}
+export declare function buildTestServerTool(deps?: TestServerToolDeps): ToolDef;
+//# sourceMappingURL=test.d.ts.map

package/dist/admin/tools/test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../../src/admin/tools/test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAKtD,OAAO,EAAwB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE7E,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACpD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAuE1E"}

package/dist/admin/tools/test.js

@@ -0,0 +1,73 @@
+import { defineTool } from '@moxxy/sdk';
+import { defaultClientFactory } from '../../client.js';
+import { MCP_CONNECT_TIMEOUT_MS, withTimeout } from '../../timeout.js';
+import { wrapMcpServerTools } from '../../wrap.js';
+import { addServerInput, validateAddServerInput } from '../schema.js';
+import { resolveServerSecrets } from '../secrets.js';
+export function buildTestServerTool(deps = {}) {
+    return defineTool({
+        name: 'mcp_test_server',
+        description: 'Connect to an MCP server WITHOUT saving it to config. Returns the list of tools the ' +
+            'server exposes if the connection succeeds, or a connection-error message. Useful for ' +
+            'sanity-checking before calling mcp_add_server. Credentials (env/header values) must be ' +
+            'vault references, never plaintext: store the secret first via vault_set, then pass ' +
+            '"${vault:NAME}" — it is resolved at connect time.',
+        inputSchema: addServerInput,
+        // Mirrors mcp_add_server: a stdio server is an arbitrary local
+        // executable we spawn, so gate behind a prompt rather than running
+        // unknown commands silently.
+        permission: { action: 'prompt' },
+        // Honest capability surface modeled on the Bash tool: for kind="stdio"
+        // this spawns a child process the user named (subprocess + broad fs,
+        // since the command can touch anything it likes); for http/sse it
+        // makes an outbound connection to an arbitrary URL (net: any). Advisory
+        // until @moxxy/plugin-security is enabled, then enforced at call time.
+        isolation: {
+            required: 'inproc',
+            capabilities: {
+                subprocess: true,
+                fs: { read: ['$cwd/**', '/tmp/**'], write: ['$cwd/**', '/tmp/**'] },
+                net: { mode: 'any' },
+                env: ['PATH', 'HOME', 'USER', 'SHELL', 'LANG', 'LC_ALL', 'TERM'],
+                timeMs: 600_000,
+            },
+        },
+        handler: async (input) => {
+            const server = validateAddServerInput(input);
+            let client = null;
+            try {
+                // Bound the connect + listTools handshake so a wedged / unreachable
+                // server surfaces as a readable connection error instead of hanging
+                // this tool call forever (defaultClientFactory + listTools take no
+                // AbortSignal). On timeout the inner `connect` may still resolve a
+                // client after we've rejected; the finally{} below closes whatever
+                // `client` we captured, so a late-opening handle isn't leaked.
+                client = await withTimeout(defaultClientFactory(await resolveServerSecrets(server, deps.secretResolver ?? null)), MCP_CONNECT_TIMEOUT_MS, `MCP connect "${server.name}"`);
+                const wrapped = await withTimeout(wrapMcpServerTools({ server, client }), MCP_CONNECT_TIMEOUT_MS, `MCP listTools "${server.name}"`);
+                return {
+                    ok: true,
+                    name: server.name,
+                    tools: wrapped.map((t) => ({ name: t.name, description: t.description })),
+                };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    name: server.name,
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+            finally {
+                if (client) {
+                    try {
+                        await client.close();
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                }
+            }
+        },
+    });
+}
+//# sourceMappingURL=test.js.map

package/dist/admin/tools/test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/admin/tools/test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAgB,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAA0B,MAAM,eAAe,CAAC;AAO7E,MAAM,UAAU,mBAAmB,CAAC,OAA2B,EAAE;IAC/D,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,sFAAsF;YACtF,uFAAuF;YACvF,yFAAyF;YACzF,qFAAqF;YACrF,mDAAmD;QACrD,WAAW,EAAE,cAAc;QAC3B,+DAA+D;QAC/D,mEAAmE;QACnE,6BAA6B;QAC7B,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,uEAAuE;QACvE,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,uEAAuE;QACvE,SAAS,EAAE;YACT,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE;gBACZ,UAAU,EAAE,IAAI;gBAChB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE;gBACnE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpB,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;gBAChE,MAAM,EAAE,OAAO;aAChB;SACF;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,MAAM,GAA4D,IAAI,CAAC;YAC3E,IAAI,CAAC;gBACH,oEAAoE;gBACpE,oEAAoE;gBACpE,mEAAmE;gBACnE,mEAAmE;gBACnE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,GAAG,MAAM,WAAW,CACxB,oBAAoB,CAAC,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,EACrF,sBAAsB,EACtB,gBAAgB,MAAM,CAAC,IAAI,GAAG,CAC/B,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACtC,sBAAsB,EACtB,kBAAkB,MAAM,CAAC,IAAI,GAAG,CACjC,CAAC;gBACF,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;iBAC1E,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/admin/types.d.ts

@@ -0,0 +1,107 @@
+import type { Skill, ToolDef } from '@moxxy/sdk';
+import type { McpClientLike, McpServerConfig, McpToolDescriptor } from '../types.js';
+import type { McpSecretResolver } from './secrets.js';
+/**
+ * Minimal skill-registry shape the admin plugin needs to auto-register
+ * a usage skill after `mcp_add_server`. Loose typing to keep this plugin
+ * free of an explicit @moxxy/core import.
+ */
+export interface AdminSkillRegistryLike {
+    register(skill: Skill): void;
+    byName(name: string): Skill | undefined;
+}
+/**
+ * Live runtime: live MCP clients keyed by server name plus the set of
+ * tool names each one registered into the session. Lets us close +
+ * unregister on `mcp_remove_server` and on shutdown without
+ * rediscovering anything. Module-scoped so the admin plugin and the
+ * shutdown hook share the same state; each Session that loads the
+ * plugin gets its own map via the closure in `buildMcpAdminPlugin`.
+ */
+export interface McpRuntimeHandle {
+    readonly client: McpClientLike;
+    readonly toolNames: ReadonlyArray<string>;
+}
+/**
+ * Tool-registry surface the admin plugin uses to hot-attach / detach
+ * MCP tools. Matches the `ToolRegistry` in @moxxy/core but typed loosely
+ * so we don't add an internal-dep on core from this plugin.
+ */
+export interface AdminToolRegistryLike {
+    has(name: string): boolean;
+    register(tool: ToolDef): void;
+    unregister(name: string): void;
+}
+/**
+ * On-disk catalog entry: connection config PLUS a cache of the tool
+ * descriptors the server last advertised, plus an enable/disable flag.
+ *
+ * Defined as an intersection (not `extends`) so the McpServerConfig
+ * discriminated union is preserved — `extends` would collapse it.
+ */
+export type McpStoredServer = McpServerConfig & {
+    readonly cachedTools?: ReadonlyArray<McpToolDescriptor>;
+    /** When true, the boot loader skips this entry — no lazy stubs are
+     *  registered and tools stay invisible. Lets the user keep the
+     *  connection config for later without paying for tool registration. */
+    readonly disabled?: boolean;
+};
+export interface McpStoredConfig {
+    readonly servers: ReadonlyArray<McpStoredServer>;
+}
+export interface BuildMcpAdminPluginOptions {
+    /**
+     * Live tool registry. When provided, `mcp_add_server` connects + wraps
+     * the server immediately and registers its tools into this registry —
+     * no restart needed. `mcp_remove_server` closes the client and
+     * unregisters. Pass `null` for pure-config behavior (write-only).
+     */
+    readonly toolRegistry: AdminToolRegistryLike | null;
+    /**
+     * Skill registry + skills dir. When provided, `mcp_add_server`
+     * auto-writes a deterministic usage skill (server-name + tool catalog)
+     * to disk and registers it so `/skills` and the system-prompt index
+     * surface the MCP server alongside hand-authored skills. The skill is
+     * generated from descriptors directly — no model call. Pass `null` to
+     * disable auto-skill creation.
+     */
+    readonly skillRegistry?: AdminSkillRegistryLike | null;
+    readonly userSkillsDir?: string;
+    /**
+     * Resolves `${vault:NAME}` placeholders in server env/header values at
+     * CONNECT time (every connect path: hot-attach, lazy attach, cache
+     * refresh, mcp_test_server). Wired from setup with the vault's
+     * `resolveString`; literal values pass through unchanged. The persisted
+     * catalog always keeps the placeholder form, never the plaintext.
+     */
+    readonly secretResolver?: McpSecretResolver | null;
+}
+/**
+ * Runtime control surface exposed alongside the admin Plugin. The TUI's
+ * /mcp slash command and the CLI's `moxxy mcp` subcommand use this to
+ * detach a server's live tools when disabling, or re-attach when
+ * enabling, without going through the model.
+ */
+export interface McpAdminApi {
+    /** Refresh + lazy-attach a server (used after enabling). */
+    enableAndAttach(name: string): Promise<{
+        toolNames: ReadonlyArray<string>;
+    } | null>;
+    /** Detach a server's live tools and close its client. */
+    detach(name: string): Promise<boolean>;
+    /**
+     * One-shot snapshot of every server configured in ~/.moxxy/mcp.json,
+     * joined with the runtime attach state. `enabled` reflects the persisted
+     * config (`disabled !== true`); `connected` is true when the server's
+     * tools are attached to the session (whether eagerly or via a lazy stub
+     * — both states make tools callable from a user's perspective). Used
+     * by the TUI status bar to show "mcp 2/3" style summaries.
+     */
+    listServers(): Promise<ReadonlyArray<McpServerStatus>>;
+}
+export interface McpServerStatus {
+    readonly name: string;
+    readonly enabled: boolean;
+    readonly connected: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACxD;;4EAEwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACpD;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACpF,yDAAyD;IACzD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC;;;;;;;OAOG;IACH,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/admin/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/admin/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/admin/types.ts"],"names":[],"mappings":""}

package/dist/admin.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Backward-compatibility façade. The real implementation lives in
+ * `./admin/` as cohesive sub-modules; this file just re-exports the
+ * symbols that consumers (and the package's own `src/index.ts`) import.
+ */
+export { buildMcpAdminPlugin, buildMcpAdminPluginWithApi, mcpAdminPlugin, mcpConfigPath, readMcpConfig, removeServerFromConfig, setServerDisabled, writeMcpConfig, resolveServerSecrets, type McpSecretResolver, type AdminSkillRegistryLike, type AdminToolRegistryLike, type BuildMcpAdminPluginOptions, type McpAdminApi, type McpRuntimeHandle, type McpServerStatus, type McpStoredConfig, type McpStoredServer, } from './admin/index.js';
+//# sourceMappingURL=admin.d.ts.map

package/dist/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC"}

package/dist/admin.js

@@ -0,0 +1,7 @@
+/**
+ * Backward-compatibility façade. The real implementation lives in
+ * `./admin/` as cohesive sub-modules; this file just re-exports the
+ * symbols that consumers (and the package's own `src/index.ts`) import.
+ */
+export { buildMcpAdminPlugin, buildMcpAdminPluginWithApi, mcpAdminPlugin, mcpConfigPath, readMcpConfig, removeServerFromConfig, setServerDisabled, writeMcpConfig, resolveServerSecrets, } from './admin/index.js';
+//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GAUrB,MAAM,kBAAkB,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Default MCP client factory + transport setup. Lives in its own module so
+ * both `index.ts` (the public surface) and `admin.ts` (the runtime
+ * admin/hot-attach tools) can pull `defaultClientFactory` without the two
+ * referencing each other — which is what would otherwise create the
+ * `admin.ts → index.ts → admin.ts` import cycle.
+ */
+import type { McpClientLike, McpPluginOptions, McpServerConfig } from './types.js';
+export declare function defaultClientFactory(server: McpServerConfig, options?: McpPluginOptions): Promise<McpClientLike>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAEV,aAAa,EAEb,gBAAgB,EAChB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAEpB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,gBAAkC,GAC1C,OAAO,CAAC,aAAa,CAAC,CAgCxB"}

package/dist/client.js

@@ -0,0 +1,73 @@
+/**
+ * Default MCP client factory + transport setup. Lives in its own module so
+ * both `index.ts` (the public surface) and `admin.ts` (the runtime
+ * admin/hot-attach tools) can pull `defaultClientFactory` without the two
+ * referencing each other — which is what would otherwise create the
+ * `admin.ts → index.ts → admin.ts` import cycle.
+ */
+export async function defaultClientFactory(server, options = { servers: [] }) {
+    const { Client } = (await import('@modelcontextprotocol/sdk/client/index.js'));
+    // Type the SDK boundary ONCE here; the rest of the factory works against the
+    // typed `McpClientUntyped` so a signature change in the SDK surfaces as a
+    // compile error rather than being papered over by per-call casts.
+    const client = new Client({ name: options.clientName ?? 'moxxy', version: options.clientVersion ?? '0.0.0' }, { capabilities: {} });
+    const transport = await createTransport(server);
+    await client.connect(transport);
+    return {
+        async listTools() {
+            const result = await client.listTools();
+            return { tools: (result.tools ?? []).map(toToolDescriptor) };
+        },
+        async callTool(args) {
+            const result = await client.callTool(args);
+            const out = {
+                content: result.content?.map(toContentBlock),
+                isError: result.isError,
+            };
+            return out;
+        },
+        async close() {
+            await client.close();
+        },
+    };
+}
+/** Narrow one SDK tool entry to our internal descriptor at the single boundary. */
+function toToolDescriptor(t) {
+    return t;
+}
+/** Narrow one SDK content block to our internal union at the single boundary. */
+function toContentBlock(block) {
+    return block;
+}
+async function createTransport(server) {
+    const kind = server.kind ?? 'stdio';
+    if (kind === 'stdio') {
+        const stdioServer = server;
+        const { StdioClientTransport } = (await import('@modelcontextprotocol/sdk/client/stdio.js'));
+        // Set stderr to 'ignore' so spawned subprocesses (mcp-remote, etc.)
+        // don't dump their boot logs into the moxxy TUI. The SDK defaults
+        // to 'inherit' which clobbers the chat with proxy-status lines on
+        // every boot. Set MOXXY_MCP_STDERR=inherit to opt back in for
+        // debugging.
+        const stderrMode = process.env.MOXXY_MCP_STDERR === 'inherit' ? 'inherit' : 'ignore';
+        return new StdioClientTransport({
+            command: stdioServer.command,
+            args: stdioServer.args ? [...stdioServer.args] : undefined,
+            env: stdioServer.env,
+            cwd: stdioServer.cwd,
+            stderr: stderrMode,
+        });
+    }
+    const httpish = server;
+    if (kind === 'sse') {
+        const { SSEClientTransport } = (await import('@modelcontextprotocol/sdk/client/sse.js'));
+        return new SSEClientTransport(new URL(httpish.url), {
+            requestInit: httpish.headers ? { headers: httpish.headers } : undefined,
+        });
+    }
+    const { StreamableHTTPClientTransport } = (await import('@modelcontextprotocol/sdk/client/streamableHttp.js'));
+    return new StreamableHTTPClientTransport(new URL(httpish.url), {
+        requestInit: httpish.headers ? { headers: httpish.headers } : undefined,
+    });
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuB,EACvB,UAA4B,EAAE,OAAO,EAAE,EAAE,EAAE;IAE3C,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAE5E,CAAC;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,MAAM,GAAqB,IAAI,MAAM,CACzC,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO,EAAE,EAClF,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO;QACL,KAAK,CAAC,SAAS;YACb,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAkB;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC;gBAC5C,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;YACF,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,CAA+D;IACvF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,KAAiD;IACvE,OAAO,KAAwB,CAAC;AAClC,CAAC;AAYD,KAAK,UAAU,eAAe,CAAC,MAAuB;IACpD,MAAM,IAAI,GAA6B,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC;IAC9D,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,MAAuG,CAAC;QAC5H,MAAM,EAAE,oBAAoB,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAQ1F,CAAC;QACF,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,aAAa;QACb,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpE,OAAO,IAAI,oBAAoB,CAAC;YAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,MAA2D,CAAC;IAC5E,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAEtF,CAAC;QACF,OAAO,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAClD,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE,6BAA6B,EAAE,GAAG,CAAC,MAAM,MAAM,CACrD,oDAAoD,CACrD,CAEA,CAAC;IACF,OAAO,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QAC7D,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+import { type Plugin } from '@moxxy/sdk';
+import type { McpClientLike, McpPluginOptions, McpServerConfig } from './types.js';
+export type { McpClientLike, McpContentBlock, McpPluginOptions, McpServerConfig, McpToolDescriptor, SseServerConfig, StdioServerConfig, StreamableHttpServerConfig, } from './types.js';
+export { wrapMcpServerTools } from './wrap.js';
+export { defaultToolNamePrefix } from './types.js';
+export { defaultClientFactory } from './client.js';
+export { buildMcpAdminPlugin, buildMcpAdminPluginWithApi, mcpAdminPlugin, mcpConfigPath, readMcpConfig, removeServerFromConfig, setServerDisabled, writeMcpConfig, resolveServerSecrets, type McpSecretResolver, type McpAdminApi, type McpServerStatus, type McpStoredConfig, type McpStoredServer, } from './admin.js';
+export interface CreateMcpPluginOptions extends McpPluginOptions {
+    /**
+     * Inject a custom client factory. Used by tests; production code uses the
+     * default factory that imports `@modelcontextprotocol/sdk`.
+     */
+    readonly clientFactory?: (server: McpServerConfig, options: McpPluginOptions) => Promise<McpClientLike>;
+}
+export declare function createMcpPlugin(opts: CreateMcpPluginOptions): Promise<Plugin>;
+export { mcpAdminPlugin as default } from './admin.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKnF,YAAY,EACV,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;IAC9D;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CACzG;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmDnF;AAKD,OAAO,EAAE,cAAc,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,50 @@
+import { definePlugin } from '@moxxy/sdk';
+import { defaultClientFactory } from './client.js';
+import { MCP_CONNECT_TIMEOUT_MS, withTimeout } from './timeout.js';
+import { wrapMcpServerTools } from './wrap.js';
+export { wrapMcpServerTools } from './wrap.js';
+export { defaultToolNamePrefix } from './types.js';
+export { defaultClientFactory } from './client.js';
+export { buildMcpAdminPlugin, buildMcpAdminPluginWithApi, mcpAdminPlugin, mcpConfigPath, readMcpConfig, removeServerFromConfig, setServerDisabled, writeMcpConfig, resolveServerSecrets, } from './admin.js';
+export async function createMcpPlugin(opts) {
+    const factory = opts.clientFactory ?? defaultClientFactory;
+    // Connect + list each server in PARALLEL: serial boot paid the sum of every
+    // server's spawn/handshake/listTools round-trip, so N servers serialized N
+    // latencies. allSettled bounds boot at the slowest server, not the sum,
+    // while still letting us close every successfully-opened client if any leg
+    // fails (the onShutdown hook is only wired once we RETURN the plugin).
+    const opened = [];
+    const results = await Promise.allSettled(opts.servers.map(async (server) => {
+        // Bound the connect handshake so a single wedged server spawn surfaces
+        // as a rejected leg rather than stalling boot until the transport's own
+        // (possibly absent) timeout fires. The leg's client, if it opened before
+        // the timeout, is still tracked in `opened` and closed in the failure
+        // cleanup below.
+        const client = await withTimeout(factory(server, opts), MCP_CONNECT_TIMEOUT_MS, `MCP connect "${server.name}"`);
+        // Record the client the instant it opens, before listTools — so even a
+        // listTools failure can't leak its child process / socket.
+        opened.push(client);
+        return withTimeout(wrapMcpServerTools({ server, client, toolNamePrefix: opts.toolNamePrefix }), MCP_CONNECT_TIMEOUT_MS, `MCP listTools "${server.name}"`);
+    }));
+    const failure = results.find((r) => r.status === 'rejected');
+    if (failure) {
+        await Promise.allSettled(opened.map((c) => c.close()));
+        throw failure.reason;
+    }
+    // Flatten in server order (map preserves index → deterministic tool order).
+    const tools = results.flatMap((r) => r.value);
+    const clients = opened;
+    return definePlugin({
+        name: '@moxxy/plugin-mcp',
+        version: '0.0.0',
+        tools,
+        hooks: {
+            onShutdown: async () => {
+                await Promise.allSettled(clients.map((c) => c.close()));
+            },
+        },
+    });
+}
+// Discovery entry: `createPluginLoader` requires a default Plugin export.
+export { mcpAdminPlugin as default } from './admin.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAY/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GAMrB,MAAM,YAAY,CAAC;AAUpB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAChC,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,iBAAiB;QACjB,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EACrB,sBAAsB,EACtB,gBAAgB,MAAM,CAAC,IAAI,GAAG,CAC/B,CAAC;QACF,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,WAAW,CAChB,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,EAC3E,sBAAsB,EACtB,kBAAkB,MAAM,CAAC,IAAI,GAAG,CACjC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAC7D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvD,MAAO,OAAiC,CAAC,MAAM,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA4E,CAAC,KAAK,CAAC,CAAC;IAC1H,MAAM,OAAO,GAAG,MAAM,CAAC;IAEvB,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,OAAO;QAChB,KAAK;QACL,KAAK,EAAE;YACL,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAID,0EAA0E;AAC1E,OAAO,EAAE,cAAc,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC"}