@n8n/frontend-module-mcp 0.1.0

package/src/mcp.api.ts

@@ -0,0 +1,206 @@
+import type {
+	ApiKey,
+	InstanceMcpClientStatsResponseDto,
+	ListOAuthClientsResponseDto,
+	DeleteOAuthClientResponseDto,
+	McpClientConnectedPeriod,
+	McpClientTypeFilter,
+} from '@n8n/api-types';
+import type { McpAgent, McpWorkflow } from './mcp.types';
+import type { IRestApiContext } from '@n8n/rest-api-client';
+import { makeRestApiRequest, getFullApiResponse } from '@n8n/rest-api-client';
+
+export type McpSettingsResponse = {
+	mcpAccessEnabled: boolean;
+	autoExposeNewWorkflows: boolean;
+};
+
+export type ToggleWorkflowsMcpAccessTarget =
+	| { workflowIds: string[] }
+	| { projectId: string }
+	| { folderId: string }
+	| { allWorkflows: true };
+
+export type ToggleWorkflowsMcpAccessResponse = {
+	updatedCount: number;
+	unchangedCount: number;
+	skippedCount: number;
+	failedCount: number;
+	updatedIds?: string[];
+	unchangedIds?: string[];
+	autoExposeNewWorkflows?: boolean;
+};
+
+export type ToggleAgentsMcpAccessTarget =
+	| { agentIds: string[] }
+	| { projectId: string }
+	| { allAgents: true };
+
+export type ToggleAgentsMcpAccessResponse = {
+	updatedCount: number;
+	updatedIds?: string[];
+	unchangedIds?: string[];
+};
+
+export async function updateMcpSettings(
+	context: IRestApiContext,
+	settings: { mcpAccessEnabled?: boolean; autoExposeNewWorkflows?: boolean },
+): Promise<McpSettingsResponse> {
+	return await makeRestApiRequest(context, 'PATCH', '/mcp/settings', settings);
+}
+
+export async function fetchApiKey(context: IRestApiContext): Promise<ApiKey> {
+	return await makeRestApiRequest(context, 'GET', '/mcp/api-key');
+}
+
+export async function rotateApiKey(context: IRestApiContext): Promise<ApiKey> {
+	return await makeRestApiRequest(context, 'POST', '/mcp/api-key/rotate');
+}
+
+export async function getAllowedRedirectUris(
+	context: IRestApiContext,
+): Promise<{ uris: string[] }> {
+	return await makeRestApiRequest(context, 'GET', '/mcp/oauth/allowed-redirect-uris');
+}
+
+export async function updateAllowedRedirectUris(
+	context: IRestApiContext,
+	uris: string[],
+): Promise<{ success: boolean }> {
+	return await makeRestApiRequest(context, 'PATCH', '/mcp/oauth/allowed-redirect-uris', { uris });
+}
+
+/**
+ * Bulk-toggles MCP availability for a set of workflows scoped by either an
+ * explicit id list, a project, a folder (+ its descendants), or all
+ * workflows the user can update.
+ */
+export async function toggleWorkflowsMcpAccessApi(
+	context: IRestApiContext,
+	target: ToggleWorkflowsMcpAccessTarget,
+	availableInMCP: boolean,
+): Promise<ToggleWorkflowsMcpAccessResponse> {
+	return await makeRestApiRequest(context, 'PATCH', '/mcp/workflows/toggle-access', {
+		availableInMCP,
+		...target,
+	});
+}
+
+export type FetchOAuthClientsOptions = {
+	ownership?: 'mine' | 'all';
+	skip?: number;
+	take?: number;
+	name?: string;
+	ownerId?: string;
+	type?: McpClientTypeFilter;
+	connected?: McpClientConnectedPeriod;
+};
+
+export async function fetchOAuthClients(
+	context: IRestApiContext,
+	options: FetchOAuthClientsOptions = {},
+): Promise<ListOAuthClientsResponseDto> {
+	const params = Object.fromEntries(
+		Object.entries(options).filter(([, value]) => value !== undefined),
+	);
+	return await makeRestApiRequest(
+		context,
+		'GET',
+		'/mcp/oauth-clients',
+		Object.keys(params).length > 0 ? params : undefined,
+	);
+}
+
+export async function fetchInstanceMcpClientStats(
+	context: IRestApiContext,
+): Promise<InstanceMcpClientStatsResponseDto> {
+	return await makeRestApiRequest(context, 'GET', '/mcp/oauth-clients/instance-stats');
+}
+
+export async function deleteOAuthClient(
+	context: IRestApiContext,
+	clientId: string,
+	userId?: string,
+): Promise<DeleteOAuthClientResponseDto> {
+	return await makeRestApiRequest(
+		context,
+		'DELETE',
+		`/mcp/oauth-clients/${encodeURIComponent(clientId)}`,
+		userId ? { userId } : undefined,
+	);
+}
+
+export async function fetchMcpEligibleWorkflows(
+	context: IRestApiContext,
+	options?: { take?: number; skip?: number; query?: string },
+): Promise<{ count: number; data: McpWorkflow[] }> {
+	const params: Record<string, string | number> = {};
+
+	if (options?.take !== undefined) {
+		params.take = options.take;
+	}
+	if (options?.skip !== undefined) {
+		params.skip = options.skip;
+	}
+	if (options?.query) {
+		params.filter = JSON.stringify({ query: options.query });
+	}
+
+	return await getFullApiResponse<McpWorkflow[]>(context, 'GET', '/mcp/workflows', params);
+}
+
+/**
+ * Workflows already exposed to MCP, newest first. Uses the generic list endpoint:
+ * `/mcp/workflows` returns only workflows that are not exposed yet.
+ */
+export async function fetchMcpExposedWorkflows(
+	context: IRestApiContext,
+	options: { skip: number; take: number },
+): Promise<{ count: number; data: McpWorkflow[] }> {
+	return await getFullApiResponse<McpWorkflow[]>(context, 'GET', '/workflows', {
+		includeScopes: true,
+		filter: { isArchived: false, availableInMCP: true },
+		skip: options.skip,
+		take: options.take,
+		sortBy: 'updatedAt:desc',
+	});
+}
+
+/**
+ * Bulk-toggles MCP availability for a set of agents scoped by either an
+ * explicit id list, a project, or all agents the user can update.
+ */
+export async function toggleAgentsMcpAccessApi(
+	context: IRestApiContext,
+	target: ToggleAgentsMcpAccessTarget,
+	availableInMCP: boolean,
+): Promise<ToggleAgentsMcpAccessResponse> {
+	return await makeRestApiRequest(context, 'PATCH', '/mcp/agents/toggle-access', {
+		availableInMCP,
+		...target,
+	});
+}
+
+export async function fetchMcpAgents(
+	context: IRestApiContext,
+	options?: { take?: number; skip?: number; query?: string; availableInMCP?: boolean },
+): Promise<{ count: number; data: McpAgent[] }> {
+	const params: Record<string, string | number> = {};
+	const query = options?.query?.trim();
+	const filter = {
+		...(query ? { query } : {}),
+		...(options?.availableInMCP !== undefined ? { availableInMCP: options.availableInMCP } : {}),
+	};
+
+	if (options?.take !== undefined) {
+		params.take = options.take;
+	}
+	if (options?.skip !== undefined) {
+		params.skip = options.skip;
+	}
+	if (Object.keys(filter).length > 0) {
+		params.filter = JSON.stringify(filter);
+	}
+
+	return await getFullApiResponse<McpAgent[]>(context, 'GET', '/mcp/agents', params);
+}

package/src/mcp.clients.catalog.test.ts

@@ -0,0 +1,63 @@
+import { getMcpClientCatalog } from './mcp.clients.catalog';
+
+const SERVER_URL = 'https://acme.app.n8n.cloud/mcp-server/http';
+
+describe('getMcpClientCatalog', () => {
+	const catalog = getMcpClientCatalog(SERVER_URL);
+	const clients = catalog.flatMap((group) => group.clients);
+
+	it('should group the clients by category in picker order', () => {
+		expect(catalog.map((group) => group.id)).toEqual(['cli', 'web', 'ide']);
+		expect(catalog.map((group) => group.clients.map((client) => client.id))).toEqual([
+			['claude-code', 'codex', 'gemini-cli'],
+			['claude-ai', 'chatgpt', 'mistral-vibe'],
+			['cursor', 'vscode', 'windsurf'],
+		]);
+	});
+
+	it('should embed the server URL in every install command and config snippet', () => {
+		for (const client of clients) {
+			if (client.installCommand) expect(client.installCommand).toContain(SERVER_URL);
+			if (client.configSnippet) expect(client.configSnippet).toContain(SERVER_URL);
+		}
+	});
+
+	it('should build the Cursor deep link with a base64 config payload', () => {
+		const cursor = clients.find((client) => client.id === 'cursor');
+		const config = new URL(cursor!.deepLink!.replace('cursor://', 'https://cursor.test/'))
+			.searchParams;
+		expect(config.get('name')).toBe('n8n');
+		expect(JSON.parse(atob(config.get('config')!))).toEqual({ url: SERVER_URL });
+	});
+
+	it('should build the VS Code deep link with a URL-encoded JSON payload', () => {
+		const vscode = clients.find((client) => client.id === 'vscode');
+		const encoded = vscode!.deepLink!.replace('vscode:mcp/install?', '');
+		expect(JSON.parse(decodeURIComponent(encoded))).toEqual({
+			name: 'n8n',
+			type: 'http',
+			url: SERVER_URL,
+		});
+	});
+
+	it('should prefill the server URL in the Mistral Vibe connector template link', () => {
+		const vibe = clients.find((client) => client.id === 'mistral-vibe');
+		const params = new URL(vibe!.addUrl!).searchParams;
+		expect(params.get('template')).toBe('n8n');
+		expect(params.get('server_url')).toBe(SERVER_URL);
+	});
+
+	it('should give web connector URLs as https and every CLI an install command', () => {
+		const web = catalog.find((group) => group.id === 'web')!;
+		// A one-click connector URL is optional per web client, but when present it must be https.
+		for (const client of web.clients) {
+			if (client.addUrl) expect(client.addUrl).toMatch(/^https:\/\//);
+		}
+
+		const cli = catalog.find((group) => group.id === 'cli')!;
+		for (const client of cli.clients) {
+			expect(client.installCommand).toBeTruthy();
+			expect(client.configSnippet).toBeTruthy();
+		}
+	});
+});

package/src/mcp.clients.catalog.ts

@@ -0,0 +1,183 @@
+import type { Component } from 'vue';
+
+import ClaudeIcon from './assets/client-icons/claude.svg?component';
+import CodexIcon from './assets/client-icons/codex.svg?component';
+import CursorIcon from './assets/client-icons/cursor.svg?component';
+import GeminiIcon from './assets/client-icons/gemini.svg?component';
+import MistralIcon from './assets/client-icons/mistral.svg?component';
+import OpenAiIcon from './assets/client-icons/openai.svg?component';
+import VsCodeIcon from './assets/client-icons/vscode.svg?component';
+
+export type McpSetupCategory = 'cli' | 'web' | 'ide';
+
+export interface McpClientSetup {
+	id: string;
+	/** Brand name, not translatable. */
+	name: string;
+	category: McpSetupCategory;
+	/** Brand mark; null falls back to the neutral MCP icon (Windsurf has no official inlineable mark). */
+	icon: Component | null;
+	installCommand?: string;
+	/** Snippet for the client's MCP config file (JSON, or TOML for Codex). */
+	configSnippet?: string;
+	/** Command that triggers the client's OAuth login; clients without one use '/mcp' in-app. */
+	authCommand?: string;
+	/** One-click install deep link (IDEs). */
+	deepLink?: string;
+	/** Connector-settings page for one-click web clients. */
+	addUrl?: string;
+}
+
+export interface McpClientCategoryGroup {
+	id: McpSetupCategory;
+	clients: McpClientSetup[];
+}
+
+/**
+ * The "Connect a client" setup catalogue, in picker order. Each client carries
+ * the per-category payload its setup steps render: CLIs an install command +
+ * config + auth step, web clients a one-click connector URL (when the client
+ * supports one), IDEs a deep link (when the editor supports one) + manual config.
+ */
+export function getMcpClientCatalog(serverUrl: string): McpClientCategoryGroup[] {
+	const claudeSnippet = `{
+  "mcpServers": {
+    "n8n": {
+      "type": "http",
+      "url": "${serverUrl}"
+    }
+  }
+}`;
+	// Cursor treats a bare `url` as SSE; n8n's endpoint is streamable HTTP, so the
+	// transport must be stated explicitly.
+	const cursorSnippet = `{
+  "mcpServers": {
+    "n8n": {
+      "type": "streamable-http",
+      "url": "${serverUrl}"
+    }
+  }
+}`;
+	// Codex routes HTTP MCP servers through its Rust client, which older builds only
+	// enable behind this feature flag (newer builds ignore it).
+	const codexSnippet = `[features]
+experimental_use_rmcp_client = true
+
+[mcp_servers.n8n]
+url = "${serverUrl}"`;
+	const geminiSnippet = `{
+  "mcpServers": {
+    "n8n": {
+      "httpUrl": "${serverUrl}"
+    }
+  }
+}`;
+	const vscodeSnippet = `{
+  "servers": {
+    "n8n": {
+      "type": "http",
+      "url": "${serverUrl}"
+    }
+  }
+}`;
+	const windsurfSnippet = `{\n  "mcpServers": {\n    "n8n": {\n      "serverUrl": "${serverUrl}"\n    }\n  }\n}`;
+
+	// One-click deep links, exactly as each editor expects: Cursor takes base64 of
+	// `{"url": …}` in a `config` query param, VS Code a URL-encoded JSON object.
+	const cursorDeepLink = `cursor://anysphere.cursor-deeplink/mcp/install?name=n8n&config=${btoa(
+		`{"url":"${serverUrl}"}`,
+	)}`;
+	const vscodeDeepLink = `vscode:mcp/install?${encodeURIComponent(
+		`{"name":"n8n","type":"http","url":"${serverUrl}"}`,
+	)}`;
+
+	return [
+		{
+			id: 'cli',
+			clients: [
+				{
+					id: 'claude-code',
+					name: 'Claude Code',
+					category: 'cli',
+					icon: ClaudeIcon,
+					installCommand: `claude mcp add --transport http n8n ${serverUrl}`,
+					configSnippet: claudeSnippet,
+				},
+				{
+					id: 'codex',
+					name: 'Codex',
+					category: 'cli',
+					icon: CodexIcon,
+					installCommand: `codex mcp add n8n --url "${serverUrl}"`,
+					configSnippet: codexSnippet,
+					authCommand: 'codex mcp login n8n',
+				},
+				{
+					id: 'gemini-cli',
+					name: 'Gemini CLI',
+					category: 'cli',
+					icon: GeminiIcon,
+					installCommand: `gemini mcp add --transport http n8n ${serverUrl}`,
+					configSnippet: geminiSnippet,
+				},
+			],
+		},
+		{
+			id: 'web',
+			clients: [
+				{
+					id: 'claude-ai',
+					name: 'Claude.ai',
+					category: 'web',
+					icon: ClaudeIcon,
+					addUrl: 'https://claude.ai/directory/connectors/n8n',
+				},
+				{
+					id: 'chatgpt',
+					name: 'ChatGPT',
+					category: 'web',
+					icon: OpenAiIcon,
+				},
+				{
+					id: 'mistral-vibe',
+					name: 'Mistral Vibe',
+					category: 'web',
+					icon: MistralIcon,
+					// Opens Vibe's built-in n8n connector template with the server URL prefilled,
+					// so the user only has to click Connect.
+					addUrl: `https://chat.mistral.ai/connections/marketplace?search=n8n&template=n8n&server_url=${encodeURIComponent(
+						serverUrl,
+					)}`,
+				},
+			],
+		},
+		{
+			id: 'ide',
+			clients: [
+				{
+					id: 'cursor',
+					name: 'Cursor',
+					category: 'ide',
+					icon: CursorIcon,
+					deepLink: cursorDeepLink,
+					configSnippet: cursorSnippet,
+				},
+				{
+					id: 'vscode',
+					name: 'VS Code',
+					category: 'ide',
+					icon: VsCodeIcon,
+					deepLink: vscodeDeepLink,
+					configSnippet: vscodeSnippet,
+				},
+				{
+					id: 'windsurf',
+					name: 'Windsurf',
+					category: 'ide',
+					icon: null,
+					configSnippet: windsurfSnippet,
+				},
+			],
+		},
+	];
+}

package/src/mcp.constants.ts

@@ -0,0 +1,45 @@
+import type { IconName } from '@n8n/design-system';
+
+export const MCP_ENDPOINT = 'mcp-server/http';
+export const MCP_DOCS_PAGE_URL = 'https://docs.n8n.io/connect/connect-to-n8n-mcp-server';
+
+// Display groups for the MCP OAuth consent scope picker, keyed by the
+// `resource:` prefix of the scopes in MCP_INSTANCE_SCOPES (@n8n/api-types).
+export const MCP_SCOPE_GROUPS: Array<{ key: string; resources: readonly string[] }> = [
+	{ key: 'workflows', resources: ['workflow', 'tag'] },
+	{ key: 'executions', resources: ['execution'] },
+	{ key: 'agents', resources: ['agent'] },
+	{ key: 'credentials', resources: ['credential'] },
+	{ key: 'dataTables', resources: ['dataTable'] },
+	{ key: 'projectsAndFolders', resources: ['project'] },
+	{ key: 'communityNodes', resources: ['communityPackage'] },
+	{ key: 'preferences', resources: ['aiPreference'] },
+];
+
+/** Icons per scope resource prefix, shown in the client details modal. */
+export const MCP_SCOPE_RESOURCE_ICONS: Record<string, IconName> = {
+	workflow: 'workflow',
+	execution: 'history',
+	agent: 'robot',
+	credential: 'key-round',
+	dataTable: 'table',
+	project: 'folder',
+	tag: 'tags',
+	communityPackage: 'package-open',
+	aiPreference: 'sliders-horizontal',
+};
+export const MCP_SETTINGS_VIEW = 'McpSettings';
+export const MCP_WORKFLOWS_VIEW = 'McpSettingsWorkflows';
+export const MCP_AGENTS_VIEW = 'McpSettingsAgents';
+export const MCP_CLIENTS_VIEW = 'McpSettingsClients';
+export const MCP_STORE = 'mcp';
+
+export const LOADING_INDICATOR_TIMEOUT = 200;
+export const MCP_TOOLTIP_DELAY = 100;
+
+/** How many of the user's own connected clients the settings overview previews inline. */
+export const MCP_CLIENTS_PREVIEW_LIMIT = 3;
+
+export const MCP_CONNECT_POPOVER_WIDTH = 460;
+
+export const UNKNOWN_COUNT_VALUE = '—';

package/src/mcp.module.test.ts

@@ -0,0 +1,106 @@
+import { i18nInstance, setLanguage } from '@n8n/i18n';
+import type { Scope } from '@n8n/permissions';
+import { useRBACStore } from '@n8n/stores/rbac.store';
+import { createPinia, setActivePinia } from 'pinia';
+
+import {
+	MCP_AGENTS_VIEW,
+	MCP_CLIENTS_VIEW,
+	MCP_SETTINGS_VIEW,
+	MCP_WORKFLOWS_VIEW,
+} from './mcp.constants';
+import { MCPModule } from './mcp.module';
+
+describe('MCPModule', () => {
+	const settingsPage = () => MCPModule.settingsPages?.find((item) => item.id === 'settings-mcp');
+
+	const withScopes = (scopes: Scope[]) => {
+		useRBACStore().setGlobalScopes(scopes);
+		return settingsPage();
+	};
+
+	beforeEach(() => {
+		setActivePinia(createPinia());
+	});
+
+	describe('settings sidebar item', () => {
+		it('should hide the item from a user without an MCP scope', () => {
+			expect(withScopes([])?.available).toBe(false);
+		});
+
+		it('should hide the item from a user holding only an unrelated scope', () => {
+			expect(withScopes(['workflow:read'])?.available).toBe(false);
+		});
+
+		it.each<Scope>(['mcp:manage', 'mcp:oauth', 'mcpApiKey:create', 'mcpApiKey:rotate'])(
+			'should show the item to a user with the %s scope',
+			(scope) => {
+				expect(withScopes([scope])?.available).toBe(true);
+			},
+		);
+
+		it('should re-evaluate availability when scopes change after registration', () => {
+			const item = withScopes([]);
+			expect(item?.available).toBe(false);
+
+			useRBACStore().addGlobalScope('mcp:oauth');
+
+			expect(item?.available).toBe(true);
+		});
+	});
+
+	describe('label', () => {
+		const MCP_LABEL_KEY = 'settings.mcp';
+
+		afterEach(() => {
+			setLanguage('en');
+		});
+
+		it('should read the label from i18n', () => {
+			expect(settingsPage()?.label).toBe('Instance-level MCP');
+		});
+
+		it('should follow a language change after registration', () => {
+			const item = settingsPage();
+
+			// `Object.fromEntries`, because a dotted i18n key is not a lintable
+			// object-literal property name.
+			i18nInstance.global.mergeLocaleMessage(
+				'de',
+				Object.fromEntries([[MCP_LABEL_KEY, 'MCP-Zugriff']]),
+			);
+			setLanguage('de');
+
+			expect(item?.label).toBe('MCP-Zugriff');
+		});
+
+		it('should read i18n lazily, not when the descriptor is imported', () => {
+			// The shell imports the descriptor at boot, before `App.vue` sets the language.
+			const descriptor = Object.getOwnPropertyDescriptor(settingsPage(), 'label');
+
+			expect(typeof descriptor?.get).toBe('function');
+			expect(descriptor?.value).toBeUndefined();
+		});
+	});
+
+	describe('routes', () => {
+		it('should keep the route names and paths', () => {
+			expect(MCPModule.routes?.map(({ path, name }) => ({ path, name }))).toEqual([
+				{ path: 'mcp', name: MCP_SETTINGS_VIEW },
+				{ path: 'mcp/workflows', name: MCP_WORKFLOWS_VIEW },
+				{ path: 'mcp/agents', name: MCP_AGENTS_VIEW },
+				{ path: 'mcp/clients', name: MCP_CLIENTS_VIEW },
+			]);
+		});
+
+		it('should load every view lazily, so the shell does not pull them in at boot', () => {
+			for (const route of MCPModule.routes ?? []) {
+				expect(typeof route.component).toBe('function');
+			}
+		});
+	});
+
+	it('should register no modals: the connect dialogs belong to their views', () => {
+		expect(MCPModule).not.toHaveProperty('modals');
+	});
+});

package/src/mcp.module.ts

@@ -0,0 +1,90 @@
+import { useI18n } from '@n8n/i18n';
+import { defineFrontendModule } from '@n8n/frontend-module-sdk';
+import { useRBACStore } from '@n8n/stores/rbac.store';
+import {
+	MCP_AGENTS_VIEW,
+	MCP_CLIENTS_VIEW,
+	MCP_SETTINGS_VIEW,
+	MCP_WORKFLOWS_VIEW,
+} from './mcp.constants';
+
+const SettingsMCPView = async () => await import('./SettingsMCPView.vue');
+const SettingsMCPWorkflowsView = async () => await import('./SettingsMCPWorkflowsView.vue');
+const SettingsMCPAgentsView = async () => await import('./SettingsMCPAgentsView.vue');
+const SettingsMCPClientsView = async () => await import('./SettingsMCPClientsView.vue');
+
+export const MCPModule = defineFrontendModule({
+	id: 'mcp',
+	name: 'MCP Server',
+	description: 'Access your n8n instance through MCP clients',
+	icon: 'mcp',
+	routes: [
+		{
+			path: 'mcp',
+			name: MCP_SETTINGS_VIEW,
+			component: SettingsMCPView,
+			meta: {
+				layout: 'settings',
+				middleware: ['authenticated', 'custom'],
+				telemetry: {
+					pageCategory: 'settings',
+				},
+			},
+		},
+		{
+			path: 'mcp/workflows',
+			name: MCP_WORKFLOWS_VIEW,
+			component: SettingsMCPWorkflowsView,
+			meta: {
+				layout: 'settings',
+				middleware: ['authenticated', 'custom'],
+				telemetry: {
+					pageCategory: 'settings',
+				},
+			},
+		},
+		{
+			path: 'mcp/agents',
+			name: MCP_AGENTS_VIEW,
+			component: SettingsMCPAgentsView,
+			meta: {
+				layout: 'settings',
+				middleware: ['authenticated', 'custom'],
+				telemetry: {
+					pageCategory: 'settings',
+				},
+			},
+		},
+		{
+			path: 'mcp/clients',
+			name: MCP_CLIENTS_VIEW,
+			component: SettingsMCPClientsView,
+			meta: {
+				layout: 'settings',
+				middleware: ['authenticated', 'custom'],
+				telemetry: {
+					pageCategory: 'settings',
+				},
+			},
+		},
+	],
+	settingsPages: [
+		{
+			id: 'settings-mcp',
+			icon: 'mcp',
+			get label() {
+				return useI18n().baseText('settings.mcp');
+			},
+			position: 'top',
+			route: { to: { name: MCP_SETTINGS_VIEW } },
+			get available() {
+				return useRBACStore().hasScope([
+					'mcp:manage',
+					'mcp:oauth',
+					'mcpApiKey:create',
+					'mcpApiKey:rotate',
+				]);
+			},
+		},
+	],
+});