@rudderhq/shared 0.5.2-canary.2 → 0.6.0

package/dist/validators/mcp.d.ts

@@ -0,0 +1,2780 @@
+import { z } from "zod";
+export declare const mcpConnectionProviderSchema: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+export declare const mcpConnectionTransportSchema: z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>;
+export declare const mcpConnectionAccessModeSchema: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+export declare const mcpConnectionStatusSchema: z.ZodEnum<["draft", "authorizing", "selecting_scope", "active", "needs_reauth", "disabled", "revoked", "error"]>;
+export declare const mcpOAuthGrantStatusSchema: z.ZodEnum<["active", "needs_reauth", "revoked", "error"]>;
+export declare const mcpAgentBindingStatusSchema: z.ZodEnum<["active", "disabled", "revoked"]>;
+export declare const mcpStdioSafeConfigSchema: z.ZodEffects<z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    cwd: z.ZodOptional<z.ZodString>;
+    staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+    forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}>, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}>;
+export declare const mcpStreamableHttpSafeConfigSchema: z.ZodEffects<z.ZodObject<{
+    url: z.ZodOptional<z.ZodString>;
+    staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+    headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+    secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+    toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}>, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}>;
+export declare const mcpConnectionSecretsMutationSchema: z.ZodEffects<z.ZodObject<{
+    env: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    bearerToken: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
+    bearerToken?: string | undefined;
+}, {
+    env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
+    bearerToken?: string | undefined;
+}>, {
+    env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
+    bearerToken?: string | undefined;
+}, {
+    env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
+    bearerToken?: string | undefined;
+}>;
+export declare const mcpLegacyManualSafeConfigSchema: z.ZodObject<{
+    legacyConfigRetained: z.ZodLiteral<true>;
+}, "strict", z.ZodTypeAny, {
+    legacyConfigRetained: true;
+}, {
+    legacyConfigRetained: true;
+}>;
+export declare const mcpCuratedSafeConfigSchema: z.ZodObject<{
+    featureGroups: z.ZodObject<{
+        mode: z.ZodLiteral<"provider_default">;
+        excluded: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        mode: "provider_default";
+        excluded: string[];
+    }, {
+        mode: "provider_default";
+        excluded: string[];
+    }>;
+}, "strict", z.ZodTypeAny, {
+    featureGroups: {
+        mode: "provider_default";
+        excluded: string[];
+    };
+}, {
+    featureGroups: {
+        mode: "provider_default";
+        excluded: string[];
+    };
+}>;
+export declare const mcpConnectionSafeConfigSchema: z.ZodUnion<[z.ZodEffects<z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    cwd: z.ZodOptional<z.ZodString>;
+    staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+    forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}>, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}, {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    staticEnv?: Record<string, string> | undefined;
+    forwardedEnv?: string[] | undefined;
+    secretEnvNames?: string[] | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+}>, z.ZodEffects<z.ZodObject<{
+    url: z.ZodOptional<z.ZodString>;
+    staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+    headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+    secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+    toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}>, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}, {
+    url?: string | undefined;
+    toolAllowlist?: string[] | undefined;
+    toolDenylist?: string[] | undefined;
+    staticHeaders?: Record<string, string> | undefined;
+    headersFromEnv?: Record<string, string> | undefined;
+    bearerTokenEnvVar?: string | undefined;
+    secretHeaderNames?: string[] | undefined;
+    hasBearerToken?: boolean | undefined;
+}>, z.ZodObject<{
+    legacyConfigRetained: z.ZodLiteral<true>;
+}, "strict", z.ZodTypeAny, {
+    legacyConfigRetained: true;
+}, {
+    legacyConfigRetained: true;
+}>, z.ZodObject<{
+    featureGroups: z.ZodObject<{
+        mode: z.ZodLiteral<"provider_default">;
+        excluded: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        mode: "provider_default";
+        excluded: string[];
+    }, {
+        mode: "provider_default";
+        excluded: string[];
+    }>;
+}, "strict", z.ZodTypeAny, {
+    featureGroups: {
+        mode: "provider_default";
+        excluded: string[];
+    };
+}, {
+    featureGroups: {
+        mode: "provider_default";
+        excluded: string[];
+    };
+}>]>;
+export declare const createMcpConnectionSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    name: z.ZodString;
+    displayName: z.ZodString;
+    provider: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+    transport: z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>;
+    externalScope: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+    accessMode: z.ZodOptional<z.ZodEnum<["provider_default", "read_only", "read_write"]>>;
+    safeConfig: z.ZodDefault<z.ZodUnion<[z.ZodEffects<z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        cwd: z.ZodOptional<z.ZodString>;
+        staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, z.ZodEffects<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, z.ZodObject<{
+        legacyConfigRetained: z.ZodLiteral<true>;
+    }, "strict", z.ZodTypeAny, {
+        legacyConfigRetained: true;
+    }, {
+        legacyConfigRetained: true;
+    }>, z.ZodObject<{
+        featureGroups: z.ZodObject<{
+            mode: z.ZodLiteral<"provider_default">;
+            excluded: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "provider_default";
+            excluded: string[];
+        }, {
+            mode: "provider_default";
+            excluded: string[];
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }>]>>;
+    startupTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    toolTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    required: z.ZodDefault<z.ZodBoolean>;
+    secrets: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        env: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerToken: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }>, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    externalScope?: string | null | undefined;
+}, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    provider: "supabase" | "linear" | "notion" | "custom";
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}>, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    externalScope?: string | null | undefined;
+}, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    provider: "supabase" | "linear" | "notion" | "custom";
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}>, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    externalScope?: string | null | undefined;
+}, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    provider: "supabase" | "linear" | "notion" | "custom";
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}>, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    externalScope?: string | null | undefined;
+}, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    provider: "supabase" | "linear" | "notion" | "custom";
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}>, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    externalScope?: string | null | undefined;
+}, {
+    displayName: string;
+    name: string;
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    provider: "supabase" | "linear" | "notion" | "custom";
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}>;
+export declare const updateMcpConnectionSchema: z.ZodEffects<z.ZodObject<{
+    displayName: z.ZodOptional<z.ZodString>;
+    externalScope: z.ZodOptional<z.ZodNullable<z.ZodOptional<z.ZodString>>>;
+    accessMode: z.ZodOptional<z.ZodEnum<["provider_default", "read_only", "read_write"]>>;
+    safeConfig: z.ZodOptional<z.ZodUnion<[z.ZodEffects<z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        cwd: z.ZodOptional<z.ZodString>;
+        staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, z.ZodEffects<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, z.ZodObject<{
+        legacyConfigRetained: z.ZodLiteral<true>;
+    }, "strict", z.ZodTypeAny, {
+        legacyConfigRetained: true;
+    }, {
+        legacyConfigRetained: true;
+    }>, z.ZodObject<{
+        featureGroups: z.ZodObject<{
+            mode: z.ZodLiteral<"provider_default">;
+            excluded: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "provider_default";
+            excluded: string[];
+        }, {
+            mode: "provider_default";
+            excluded: string[];
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }>]>>;
+    startupTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    toolTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    required: z.ZodOptional<z.ZodBoolean>;
+    secrets: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        env: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerToken: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }>, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    displayName?: string | undefined;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}, {
+    displayName?: string | undefined;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}>, {
+    displayName?: string | undefined;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}, {
+    displayName?: string | undefined;
+    accessMode?: "provider_default" | "read_only" | "read_write" | undefined;
+    safeConfig?: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    } | undefined;
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    externalScope?: string | null | undefined;
+    startupTimeoutMs?: number | undefined;
+    toolTimeoutMs?: number | undefined;
+    required?: boolean | undefined;
+}>;
+export declare const mcpConnectionMergedConfigSchema: z.ZodEffects<z.ZodObject<{
+    provider: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+    transport: z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>;
+    accessMode: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+    safeConfig: z.ZodUnion<[z.ZodEffects<z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        cwd: z.ZodOptional<z.ZodString>;
+        staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, z.ZodEffects<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, z.ZodObject<{
+        legacyConfigRetained: z.ZodLiteral<true>;
+    }, "strict", z.ZodTypeAny, {
+        legacyConfigRetained: true;
+    }, {
+        legacyConfigRetained: true;
+    }>, z.ZodObject<{
+        featureGroups: z.ZodObject<{
+            mode: z.ZodLiteral<"provider_default">;
+            excluded: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "provider_default";
+            excluded: string[];
+        }, {
+            mode: "provider_default";
+            excluded: string[];
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }>]>;
+    enabled: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+}, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+}>, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+}, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+}>;
+/**
+ * Mutation-aware validation target for create, secret rotation, or a safe
+ * config change that alters secret declarations.
+ */
+export declare const mcpConnectionMutationConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    secrets: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        env: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerToken: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }>, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    }>>;
+    provider: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+    transport: z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>;
+    accessMode: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+    safeConfig: z.ZodUnion<[z.ZodEffects<z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        cwd: z.ZodOptional<z.ZodString>;
+        staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, z.ZodEffects<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, z.ZodObject<{
+        legacyConfigRetained: z.ZodLiteral<true>;
+    }, "strict", z.ZodTypeAny, {
+        legacyConfigRetained: true;
+    }, {
+        legacyConfigRetained: true;
+    }>, z.ZodObject<{
+        featureGroups: z.ZodObject<{
+            mode: z.ZodLiteral<"provider_default">;
+            excluded: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "provider_default";
+            excluded: string[];
+        }, {
+            mode: "provider_default";
+            excluded: string[];
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }>]>;
+    enabled: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+}, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+}>, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+}, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+}>, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+}, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    secrets?: {
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+        bearerToken?: string | undefined;
+    } | undefined;
+}>;
+export declare const mcpConnectionSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    orgId: z.ZodString;
+    name: z.ZodString;
+    displayName: z.ZodString;
+    provider: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+    transport: z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>;
+    externalScope: z.ZodNullable<z.ZodString>;
+    accessMode: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+    status: z.ZodEnum<["draft", "authorizing", "selecting_scope", "active", "needs_reauth", "disabled", "revoked", "error"]>;
+    safeConfig: z.ZodUnion<[z.ZodEffects<z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        cwd: z.ZodOptional<z.ZodString>;
+        staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    }>, z.ZodEffects<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+        headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+        toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }, {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    }>, z.ZodObject<{
+        legacyConfigRetained: z.ZodLiteral<true>;
+    }, "strict", z.ZodTypeAny, {
+        legacyConfigRetained: true;
+    }, {
+        legacyConfigRetained: true;
+    }>, z.ZodObject<{
+        featureGroups: z.ZodObject<{
+            mode: z.ZodLiteral<"provider_default">;
+            excluded: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "provider_default";
+            excluded: string[];
+        }, {
+            mode: "provider_default";
+            excluded: string[];
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }, {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    }>]>;
+    startupTimeoutMs: z.ZodNumber;
+    toolTimeoutMs: z.ZodNumber;
+    enabled: z.ZodBoolean;
+    required: z.ZodBoolean;
+    hasCredentials: z.ZodBoolean;
+    lastDiscoveredAt: z.ZodNullable<z.ZodString>;
+    activatedAt: z.ZodNullable<z.ZodString>;
+    disabledAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "disabled" | "error" | "revoked" | "draft" | "authorizing" | "selecting_scope" | "needs_reauth";
+    id: string;
+    orgId: string;
+    displayName: string;
+    createdAt: string;
+    updatedAt: string;
+    revokedAt: string | null;
+    name: string;
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    externalScope: string | null;
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    hasCredentials: boolean;
+    lastDiscoveredAt: string | null;
+    activatedAt: string | null;
+    disabledAt: string | null;
+}, {
+    status: "active" | "disabled" | "error" | "revoked" | "draft" | "authorizing" | "selecting_scope" | "needs_reauth";
+    id: string;
+    orgId: string;
+    displayName: string;
+    createdAt: string;
+    updatedAt: string;
+    revokedAt: string | null;
+    name: string;
+    accessMode: "provider_default" | "read_only" | "read_write";
+    transport: "stdio" | "streamable_http" | "legacy_manual";
+    safeConfig: {
+        command: string;
+        args?: string[] | undefined;
+        cwd?: string | undefined;
+        staticEnv?: Record<string, string> | undefined;
+        forwardedEnv?: string[] | undefined;
+        secretEnvNames?: string[] | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+    } | {
+        url?: string | undefined;
+        toolAllowlist?: string[] | undefined;
+        toolDenylist?: string[] | undefined;
+        staticHeaders?: Record<string, string> | undefined;
+        headersFromEnv?: Record<string, string> | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        secretHeaderNames?: string[] | undefined;
+        hasBearerToken?: boolean | undefined;
+    } | {
+        legacyConfigRetained: true;
+    } | {
+        featureGroups: {
+            mode: "provider_default";
+            excluded: string[];
+        };
+    };
+    enabled: boolean;
+    provider: "supabase" | "linear" | "notion" | "custom";
+    externalScope: string | null;
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    hasCredentials: boolean;
+    lastDiscoveredAt: string | null;
+    activatedAt: string | null;
+    disabledAt: string | null;
+}>;
+export declare const mcpProviderCatalogEntrySchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+    label: z.ZodString;
+    curated: z.ZodBoolean;
+    requiresOAuth: z.ZodBoolean;
+    requiresScopeSelection: z.ZodBoolean;
+    scopeLabel: z.ZodString;
+    transports: z.ZodArray<z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>, "many">;
+    accessModes: z.ZodArray<z.ZodEnum<["provider_default", "read_only", "read_write"]>, "many">;
+    defaultAccessMode: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+}, "strict", z.ZodTypeAny, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}>, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}>;
+export declare const mcpProviderCatalogSchema: z.ZodArray<z.ZodEffects<z.ZodObject<{
+    id: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+    label: z.ZodString;
+    curated: z.ZodBoolean;
+    requiresOAuth: z.ZodBoolean;
+    requiresScopeSelection: z.ZodBoolean;
+    scopeLabel: z.ZodString;
+    transports: z.ZodArray<z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>, "many">;
+    accessModes: z.ZodArray<z.ZodEnum<["provider_default", "read_only", "read_write"]>, "many">;
+    defaultAccessMode: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+}, "strict", z.ZodTypeAny, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}>, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}, {
+    id: "supabase" | "linear" | "notion" | "custom";
+    label: string;
+    curated: boolean;
+    requiresOAuth: boolean;
+    requiresScopeSelection: boolean;
+    scopeLabel: string;
+    transports: ("stdio" | "streamable_http" | "legacy_manual")[];
+    accessModes: ("provider_default" | "read_only" | "read_write")[];
+    defaultAccessMode: "provider_default" | "read_only" | "read_write";
+}>, "many">;
+export declare const mcpOAuthStartSchema: z.ZodObject<{}, "strict", z.ZodTypeAny, {}, {}>;
+export declare const mcpOAuthStartResponseSchema: z.ZodObject<{
+    connectionId: z.ZodString;
+    authorizationUrl: z.ZodString;
+    expiresAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    connectionId: string;
+    authorizationUrl: string;
+    expiresAt: string;
+}, {
+    connectionId: string;
+    authorizationUrl: string;
+    expiresAt: string;
+}>;
+export declare const mcpOAuthCallbackSchema: z.ZodEffects<z.ZodObject<{
+    state: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+    errorDescription: z.ZodOptional<z.ZodString>;
+    iss: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    state: string;
+    code?: string | undefined;
+    error?: string | undefined;
+    errorDescription?: string | undefined;
+    iss?: string | undefined;
+}, {
+    state: string;
+    code?: string | undefined;
+    error?: string | undefined;
+    errorDescription?: string | undefined;
+    iss?: string | undefined;
+}>, {
+    state: string;
+    code?: string | undefined;
+    error?: string | undefined;
+    errorDescription?: string | undefined;
+    iss?: string | undefined;
+}, {
+    state: string;
+    code?: string | undefined;
+    error?: string | undefined;
+    errorDescription?: string | undefined;
+    iss?: string | undefined;
+}>;
+export declare const mcpScopeSelectionSchema: z.ZodObject<{
+    connectionId: z.ZodString;
+    externalScope: z.ZodString;
+    accessMode: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+}, "strict", z.ZodTypeAny, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    externalScope: string;
+    connectionId: string;
+}, {
+    accessMode: "provider_default" | "read_only" | "read_write";
+    externalScope: string;
+    connectionId: string;
+}>;
+export declare const mcpExternalScopeOptionSchema: z.ZodObject<{
+    id: z.ZodString;
+    displayName: z.ZodString;
+    metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    displayName: string;
+    metadata: Record<string, unknown>;
+}, {
+    id: string;
+    displayName: string;
+    metadata?: Record<string, unknown> | undefined;
+}>;
+export declare const mcpOAuthGrantSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    connectionId: z.ZodString;
+    providerSubject: z.ZodNullable<z.ZodString>;
+    providerScopes: z.ZodArray<z.ZodString, "many">;
+    externalScopeMetadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    status: z.ZodEnum<["active", "needs_reauth", "revoked", "error"]>;
+    hasCredentials: z.ZodBoolean;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    lastRefreshedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "error" | "revoked" | "needs_reauth";
+    id: string;
+    createdAt: string;
+    updatedAt: string;
+    revokedAt: string | null;
+    hasCredentials: boolean;
+    connectionId: string;
+    expiresAt: string | null;
+    providerSubject: string | null;
+    providerScopes: string[];
+    externalScopeMetadata: Record<string, unknown>;
+    lastRefreshedAt: string | null;
+}, {
+    status: "active" | "error" | "revoked" | "needs_reauth";
+    id: string;
+    createdAt: string;
+    updatedAt: string;
+    revokedAt: string | null;
+    hasCredentials: boolean;
+    connectionId: string;
+    expiresAt: string | null;
+    providerSubject: string | null;
+    providerScopes: string[];
+    externalScopeMetadata: Record<string, unknown>;
+    lastRefreshedAt: string | null;
+}>;
+export declare const mcpDiscoveredToolSchema: z.ZodObject<{
+    id: z.ZodString;
+    connectionId: z.ZodString;
+    externalToolName: z.ZodString;
+    rudderToolName: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    outputSchema: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    enabled: z.ZodBoolean;
+    removedAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    description: string | null;
+    externalToolName: string;
+    rudderToolName: string;
+    inputSchema: Record<string, unknown>;
+    enabled: boolean;
+    connectionId: string;
+    outputSchema: Record<string, unknown> | null;
+    removedAt: string | null;
+}, {
+    id: string;
+    description: string | null;
+    externalToolName: string;
+    rudderToolName: string;
+    inputSchema: Record<string, unknown>;
+    enabled: boolean;
+    connectionId: string;
+    outputSchema: Record<string, unknown> | null;
+    removedAt: string | null;
+}>;
+export declare const mcpAgentBindingSchema: z.ZodObject<{
+    id: z.ZodString;
+    connectionId: z.ZodString;
+    agentId: z.ZodString;
+    status: z.ZodEnum<["active", "disabled", "revoked"]>;
+    enabledToolIds: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "disabled" | "revoked";
+    agentId: string;
+    id: string;
+    enabledToolIds: string[];
+    connectionId: string;
+}, {
+    status: "active" | "disabled" | "revoked";
+    agentId: string;
+    id: string;
+    enabledToolIds: string[];
+    connectionId: string;
+}>;
+export declare const mcpAgentConnectionSummarySchema: z.ZodObject<{
+    connection: z.ZodObject<{
+        id: z.ZodString;
+        orgId: z.ZodString;
+        name: z.ZodString;
+        displayName: z.ZodString;
+        provider: z.ZodEnum<["supabase", "linear", "notion", "custom"]>;
+        transport: z.ZodEnum<["stdio", "streamable_http", "legacy_manual"]>;
+        externalScope: z.ZodNullable<z.ZodString>;
+        accessMode: z.ZodEnum<["provider_default", "read_only", "read_write"]>;
+        status: z.ZodEnum<["draft", "authorizing", "selecting_scope", "active", "needs_reauth", "disabled", "revoked", "error"]>;
+        safeConfig: z.ZodUnion<[z.ZodEffects<z.ZodObject<{
+            command: z.ZodString;
+            args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            cwd: z.ZodOptional<z.ZodString>;
+            staticEnv: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+            forwardedEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            secretEnvNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        }, {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        }>, {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        }, {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        }>, z.ZodEffects<z.ZodObject<{
+            url: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+            headersFromEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+            secretHeaderNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            hasBearerToken: z.ZodOptional<z.ZodBoolean>;
+            toolAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            toolDenylist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        }, {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        }>, {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        }, {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        }>, z.ZodObject<{
+            legacyConfigRetained: z.ZodLiteral<true>;
+        }, "strict", z.ZodTypeAny, {
+            legacyConfigRetained: true;
+        }, {
+            legacyConfigRetained: true;
+        }>, z.ZodObject<{
+            featureGroups: z.ZodObject<{
+                mode: z.ZodLiteral<"provider_default">;
+                excluded: z.ZodArray<z.ZodString, "many">;
+            }, "strict", z.ZodTypeAny, {
+                mode: "provider_default";
+                excluded: string[];
+            }, {
+                mode: "provider_default";
+                excluded: string[];
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            featureGroups: {
+                mode: "provider_default";
+                excluded: string[];
+            };
+        }, {
+            featureGroups: {
+                mode: "provider_default";
+                excluded: string[];
+            };
+        }>]>;
+        startupTimeoutMs: z.ZodNumber;
+        toolTimeoutMs: z.ZodNumber;
+        enabled: z.ZodBoolean;
+        required: z.ZodBoolean;
+        hasCredentials: z.ZodBoolean;
+        lastDiscoveredAt: z.ZodNullable<z.ZodString>;
+        activatedAt: z.ZodNullable<z.ZodString>;
+        disabledAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        status: "active" | "disabled" | "error" | "revoked" | "draft" | "authorizing" | "selecting_scope" | "needs_reauth";
+        id: string;
+        orgId: string;
+        displayName: string;
+        createdAt: string;
+        updatedAt: string;
+        revokedAt: string | null;
+        name: string;
+        accessMode: "provider_default" | "read_only" | "read_write";
+        transport: "stdio" | "streamable_http" | "legacy_manual";
+        safeConfig: {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        } | {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        } | {
+            legacyConfigRetained: true;
+        } | {
+            featureGroups: {
+                mode: "provider_default";
+                excluded: string[];
+            };
+        };
+        enabled: boolean;
+        provider: "supabase" | "linear" | "notion" | "custom";
+        externalScope: string | null;
+        startupTimeoutMs: number;
+        toolTimeoutMs: number;
+        required: boolean;
+        hasCredentials: boolean;
+        lastDiscoveredAt: string | null;
+        activatedAt: string | null;
+        disabledAt: string | null;
+    }, {
+        status: "active" | "disabled" | "error" | "revoked" | "draft" | "authorizing" | "selecting_scope" | "needs_reauth";
+        id: string;
+        orgId: string;
+        displayName: string;
+        createdAt: string;
+        updatedAt: string;
+        revokedAt: string | null;
+        name: string;
+        accessMode: "provider_default" | "read_only" | "read_write";
+        transport: "stdio" | "streamable_http" | "legacy_manual";
+        safeConfig: {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        } | {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        } | {
+            legacyConfigRetained: true;
+        } | {
+            featureGroups: {
+                mode: "provider_default";
+                excluded: string[];
+            };
+        };
+        enabled: boolean;
+        provider: "supabase" | "linear" | "notion" | "custom";
+        externalScope: string | null;
+        startupTimeoutMs: number;
+        toolTimeoutMs: number;
+        required: boolean;
+        hasCredentials: boolean;
+        lastDiscoveredAt: string | null;
+        activatedAt: string | null;
+        disabledAt: string | null;
+    }>;
+    binding: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        connectionId: z.ZodString;
+        agentId: z.ZodString;
+        status: z.ZodEnum<["active", "disabled", "revoked"]>;
+        enabledToolIds: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        status: "active" | "disabled" | "revoked";
+        agentId: string;
+        id: string;
+        enabledToolIds: string[];
+        connectionId: string;
+    }, {
+        status: "active" | "disabled" | "revoked";
+        agentId: string;
+        id: string;
+        enabledToolIds: string[];
+        connectionId: string;
+    }>>;
+    tools: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        connectionId: z.ZodString;
+        externalToolName: z.ZodString;
+        rudderToolName: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        outputSchema: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        enabled: z.ZodBoolean;
+        removedAt: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        description: string | null;
+        externalToolName: string;
+        rudderToolName: string;
+        inputSchema: Record<string, unknown>;
+        enabled: boolean;
+        connectionId: string;
+        outputSchema: Record<string, unknown> | null;
+        removedAt: string | null;
+    }, {
+        id: string;
+        description: string | null;
+        externalToolName: string;
+        rudderToolName: string;
+        inputSchema: Record<string, unknown>;
+        enabled: boolean;
+        connectionId: string;
+        outputSchema: Record<string, unknown> | null;
+        removedAt: string | null;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    tools: {
+        id: string;
+        description: string | null;
+        externalToolName: string;
+        rudderToolName: string;
+        inputSchema: Record<string, unknown>;
+        enabled: boolean;
+        connectionId: string;
+        outputSchema: Record<string, unknown> | null;
+        removedAt: string | null;
+    }[];
+    connection: {
+        status: "active" | "disabled" | "error" | "revoked" | "draft" | "authorizing" | "selecting_scope" | "needs_reauth";
+        id: string;
+        orgId: string;
+        displayName: string;
+        createdAt: string;
+        updatedAt: string;
+        revokedAt: string | null;
+        name: string;
+        accessMode: "provider_default" | "read_only" | "read_write";
+        transport: "stdio" | "streamable_http" | "legacy_manual";
+        safeConfig: {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        } | {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        } | {
+            legacyConfigRetained: true;
+        } | {
+            featureGroups: {
+                mode: "provider_default";
+                excluded: string[];
+            };
+        };
+        enabled: boolean;
+        provider: "supabase" | "linear" | "notion" | "custom";
+        externalScope: string | null;
+        startupTimeoutMs: number;
+        toolTimeoutMs: number;
+        required: boolean;
+        hasCredentials: boolean;
+        lastDiscoveredAt: string | null;
+        activatedAt: string | null;
+        disabledAt: string | null;
+    };
+    binding: {
+        status: "active" | "disabled" | "revoked";
+        agentId: string;
+        id: string;
+        enabledToolIds: string[];
+        connectionId: string;
+    } | null;
+}, {
+    tools: {
+        id: string;
+        description: string | null;
+        externalToolName: string;
+        rudderToolName: string;
+        inputSchema: Record<string, unknown>;
+        enabled: boolean;
+        connectionId: string;
+        outputSchema: Record<string, unknown> | null;
+        removedAt: string | null;
+    }[];
+    connection: {
+        status: "active" | "disabled" | "error" | "revoked" | "draft" | "authorizing" | "selecting_scope" | "needs_reauth";
+        id: string;
+        orgId: string;
+        displayName: string;
+        createdAt: string;
+        updatedAt: string;
+        revokedAt: string | null;
+        name: string;
+        accessMode: "provider_default" | "read_only" | "read_write";
+        transport: "stdio" | "streamable_http" | "legacy_manual";
+        safeConfig: {
+            command: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            staticEnv?: Record<string, string> | undefined;
+            forwardedEnv?: string[] | undefined;
+            secretEnvNames?: string[] | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+        } | {
+            url?: string | undefined;
+            toolAllowlist?: string[] | undefined;
+            toolDenylist?: string[] | undefined;
+            staticHeaders?: Record<string, string> | undefined;
+            headersFromEnv?: Record<string, string> | undefined;
+            bearerTokenEnvVar?: string | undefined;
+            secretHeaderNames?: string[] | undefined;
+            hasBearerToken?: boolean | undefined;
+        } | {
+            legacyConfigRetained: true;
+        } | {
+            featureGroups: {
+                mode: "provider_default";
+                excluded: string[];
+            };
+        };
+        enabled: boolean;
+        provider: "supabase" | "linear" | "notion" | "custom";
+        externalScope: string | null;
+        startupTimeoutMs: number;
+        toolTimeoutMs: number;
+        required: boolean;
+        hasCredentials: boolean;
+        lastDiscoveredAt: string | null;
+        activatedAt: string | null;
+        disabledAt: string | null;
+    };
+    binding: {
+        status: "active" | "disabled" | "revoked";
+        agentId: string;
+        id: string;
+        enabledToolIds: string[];
+        connectionId: string;
+    } | null;
+}>;
+export declare const upsertMcpAgentBindingSchema: z.ZodObject<{
+    status: z.ZodOptional<z.ZodEnum<["active", "disabled", "revoked"]>>;
+    enabledToolIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    status?: "active" | "disabled" | "revoked" | undefined;
+    enabledToolIds?: string[] | undefined;
+}, {
+    status?: "active" | "disabled" | "revoked" | undefined;
+    enabledToolIds?: string[] | undefined;
+}>;
+export declare const updateMcpAgentBindingSchema: z.ZodEffects<z.ZodObject<{
+    status: z.ZodOptional<z.ZodEnum<["active", "disabled", "revoked"]>>;
+    enabledToolIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    status?: "active" | "disabled" | "revoked" | undefined;
+    enabledToolIds?: string[] | undefined;
+}, {
+    status?: "active" | "disabled" | "revoked" | undefined;
+    enabledToolIds?: string[] | undefined;
+}>, {
+    status?: "active" | "disabled" | "revoked" | undefined;
+    enabledToolIds?: string[] | undefined;
+}, {
+    status?: "active" | "disabled" | "revoked" | undefined;
+    enabledToolIds?: string[] | undefined;
+}>;
+export declare const managedExternalMcpBindingSchema: z.ZodObject<{
+    bindingId: z.ZodString;
+    serverName: z.ZodString;
+    toolPolicy: z.ZodObject<{
+        mode: z.ZodLiteral<"allowlist">;
+        allowedToolNames: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    }, {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    }>;
+    required: z.ZodBoolean;
+    startupTimeoutMs: z.ZodNumber;
+    toolTimeoutMs: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    bindingId: string;
+    serverName: string;
+    toolPolicy: {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    };
+}, {
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    bindingId: string;
+    serverName: string;
+    toolPolicy: {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    };
+}>;
+export declare const managedExternalMcpBindingsSchema: z.ZodArray<z.ZodObject<{
+    bindingId: z.ZodString;
+    serverName: z.ZodString;
+    toolPolicy: z.ZodObject<{
+        mode: z.ZodLiteral<"allowlist">;
+        allowedToolNames: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    }, {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    }>;
+    required: z.ZodBoolean;
+    startupTimeoutMs: z.ZodNumber;
+    toolTimeoutMs: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    bindingId: string;
+    serverName: string;
+    toolPolicy: {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    };
+}, {
+    startupTimeoutMs: number;
+    toolTimeoutMs: number;
+    required: boolean;
+    bindingId: string;
+    serverName: string;
+    toolPolicy: {
+        mode: "allowlist";
+        allowedToolNames: string[];
+    };
+}>, "many">;
+export type CreateMcpConnection = z.infer<typeof createMcpConnectionSchema>;
+export type UpdateMcpConnection = z.infer<typeof updateMcpConnectionSchema>;
+export type McpOAuthStart = z.infer<typeof mcpOAuthStartSchema>;
+export type McpOAuthCallback = z.infer<typeof mcpOAuthCallbackSchema>;
+export type McpScopeSelection = z.infer<typeof mcpScopeSelectionSchema>;
+export type UpsertMcpAgentBinding = z.infer<typeof upsertMcpAgentBindingSchema>;
+export type UpdateMcpAgentBinding = z.infer<typeof updateMcpAgentBindingSchema>;
+//# sourceMappingURL=mcp.d.ts.map