@saadnvd1/agent-os 0.3.496 → 0.3.497

package/README.md

@@ -1113,6 +1113,15 @@ it may do on its own, and the lines that always come back to you as asks.
   written, so an orchestrator misled by text it read could run code that way.
   That's accepted: task agents can already write anywhere, so an allowlist
   on the orchestrator alone would buy little.
+- **MCP servers.** An orchestrator runs without prompts, so an MCP server's
+  tools are refused unless its workspace allows the server. Settings →
+  Workspaces lists the servers configured on the machine (names only: user
+  servers, connectors and plugin servers; never their env, headers or tokens)
+  as toggles, and `linear` is allowed by default. A ticked server adds a bare
+  `mcp__<server>` rule to the orchestrator's allowed tools, covering all its
+  tools. Its worker ends at its next turn boundary when the list changes, and
+  the next one starts with the new permissions. Sending a message, email or
+  post through a server stays a hard line the brief sends to `ask_saad`.
   Its chat worker checks every write in a PreToolUse hook before it runs, on
   the path with symlinks and `..` resolved as the system will, and refuses
   with the reason; the repositories are read from the database on each write,

package/app/api/mcp-servers/route.ts

@@ -0,0 +1,8 @@
+import { NextResponse } from "next/server";
+import { configuredMcpServers } from "@/lib/orchestrator/mcp-servers";
+
+// The names of the MCP servers configured on this machine, for choosing which
+// a workspace's orchestrator may use. Names only.
+export async function GET() {
+  return NextResponse.json({ servers: configuredMcpServers() });
+}

package/app/api/workspaces/[id]/route.ts

@@ -1,12 +1,19 @@
 import { NextRequest, NextResponse } from "next/server";
 import { deleteWorkspace, updateWorkspace } from "@/lib/workspaces";
+import { applyMcpServers } from "@/lib/orchestrator/mcp-servers";
 
 type RouteParams = { params: Promise<{ id: string }> };
 
 export async function PATCH(request: NextRequest, { params }: RouteParams) {
   const { id } = await params;
-  const { name, collapsed, sortOrder, maxRunningTasks, wakeTasksOnPR } =
-    await request.json();
+  const {
+    name,
+    collapsed,
+    sortOrder,
+    maxRunningTasks,
+    wakeTasksOnPR,
+    mcpServers,
+  } = await request.json();
   if (wakeTasksOnPR !== undefined && typeof wakeTasksOnPR !== "boolean")
     return NextResponse.json(
       { error: "wakeTasksOnPR is true or false" },
@@ -20,6 +27,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
       sortOrder,
       maxRunningTasks,
       wakeTasksOnPR,
+      mcpServers,
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -28,6 +36,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
   if (!workspace) {
     return NextResponse.json({ error: "Workspace not found" }, { status: 404 });
   }
+  if (mcpServers !== undefined) await applyMcpServers(id);
   return NextResponse.json({ workspace });
 }
 

package/components/Workspaces/McpServersForm.tsx

@@ -0,0 +1,54 @@
+"use client";
+
+import { Switch } from "@/components/ui/switch";
+import { useMcpServersQuery, useUpdateWorkspace } from "@/data/workspaces";
+import type { Workspace } from "@/lib/db";
+
+// Which MCP servers a workspace's orchestrator may use. Servers carry their
+// own auth, so none is allowed unless ticked here.
+export function McpServersForm({ workspace }: { workspace: Workspace }) {
+  const { data: configured = [] } = useMcpServersQuery();
+  const update = useUpdateWorkspace();
+  const allowed = workspace.orch_mcp_servers;
+  // A ticked server no longer configured stays listed, so it can be unticked.
+  const names = [...new Set([...configured, ...allowed])];
+
+  const toggle = (name: string, on: boolean) =>
+    update.mutate({
+      id: workspace.id,
+      mcpServers: on ? [...allowed, name] : allowed.filter((n) => n !== name),
+    });
+
+  return (
+    <div className="bg-muted/40 space-y-2 rounded-lg px-3 py-2.5">
+      <div>
+        <p className="text-sm font-medium">
+          MCP servers its orchestrator may use
+        </p>
+        <p className="text-muted-foreground text-xs">
+          All of a ticked server&apos;s tools are allowed. Sending a message,
+          email or post through one still goes to you as an ask. Takes effect at
+          its next turn.
+        </p>
+      </div>
+      {names.length === 0 ? (
+        <p className="text-muted-foreground text-xs">
+          No MCP servers are configured on this machine.
+        </p>
+      ) : (
+        names.map((name) => (
+          <label
+            key={name}
+            className="flex min-h-11 items-center justify-between gap-3 text-sm"
+          >
+            <span className="min-w-0 truncate">{name}</span>
+            <Switch
+              checked={allowed.includes(name)}
+              onCheckedChange={(on) => toggle(name, on)}
+            />
+          </label>
+        ))
+      )}
+    </div>
+  );
+}

package/components/Workspaces/WorkspaceSettings.tsx

@@ -5,6 +5,7 @@ import { useUpdateWorkspace, useWorkspacesQuery } from "@/data/workspaces";
 import { TaskLimitForm } from "./TaskLimitForm";
 import { RulesForm } from "./RulesForm";
 import { FreshStartForm } from "./FreshStartForm";
+import { McpServersForm } from "./McpServersForm";
 import { StallForm } from "./StallForm";
 import { WorkspaceModelsForm } from "./WorkspaceModelsForm";
 import { AwayWindowForm } from "@/components/Away/AwayWindowForm";
@@ -45,6 +46,7 @@ export function WorkspaceSettings() {
           />
           <RulesForm workspaceId={w.id} />
           <WorkspaceModelsForm workspaceId={w.id} />
+          <McpServersForm workspace={w} />
           <SettingToggle
             title="Wake tasks on CI failures and reviews"
             detail="A task's agent is messaged once when a check fails on its PR's head, with the log's tail, and when someone reviews or comments on it."

package/data/workspaces/index.ts

@@ -23,6 +23,17 @@ export function useWorkspacesQuery() {
   });
 }
 
+// The MCP servers configured on this machine (names only).
+export function useMcpServersQuery() {
+  return useQuery({
+    queryKey: [...workspaceKeys.all, "mcp-servers"],
+    queryFn: async () =>
+      (await json<{ servers: string[] }>(await fetch("/api/mcp-servers")))
+        .servers,
+    staleTime: 60000,
+  });
+}
+
 export function useCreateWorkspace() {
   const queryClient = useQueryClient();
   return useMutation({
@@ -55,6 +66,8 @@ export function useUpdateWorkspace() {
       maxRunningTasks?: number | null;
       // Message tasks about failing checks and reviews on their PRs.
       wakeTasksOnPR?: boolean;
+      // MCP servers its orchestrator may use, by name.
+      mcpServers?: string[];
     }) =>
       json(
         await fetch(`/api/workspaces/${id}`, {
@@ -63,7 +76,13 @@ export function useUpdateWorkspace() {
           body: JSON.stringify(updates),
         })
       ),
-    onMutate: async ({ id, maxRunningTasks, wakeTasksOnPR, ...updates }) => {
+    onMutate: async ({
+      id,
+      maxRunningTasks,
+      wakeTasksOnPR,
+      mcpServers,
+      ...updates
+    }) => {
       await queryClient.cancelQueries({ queryKey: workspaceKeys.list() });
       queryClient.setQueryData<Workspace[]>(workspaceKeys.list(), (prev) =>
         prev?.map((w) =>
@@ -77,6 +96,9 @@ export function useUpdateWorkspace() {
                 ...(wakeTasksOnPR !== undefined && {
                   wake_tasks_on_pr: wakeTasksOnPR,
                 }),
+                ...(mcpServers !== undefined && {
+                  orch_mcp_servers: mcpServers,
+                }),
               }
             : w
         )

package/lib/chat/runner.ts

@@ -901,3 +901,17 @@ export async function reattachChats(): Promise<void> {
   for (const id of queuedSessions(Date.now() - RESUME_WITHIN_MS))
     if (!live.has(id)) await resumeQueue(id);
 }
+
+// Asks a chat's worker to end at its next turn boundary, so the next message
+// starts one that reads its settings afresh (an orchestrator's permissions,
+// say). A worker already gone, or too old to understand, needs nothing.
+export async function retireChat(sessionId: string): Promise<void> {
+  const live =
+    registry.live.get(sessionId) ??
+    (runningWorkers().includes(sessionId)
+      ? await ensureLive(sessionId, false).catch(() => undefined)
+      : undefined);
+  if (!live || live.retireSent) return;
+  live.worker.command({ type: "retire" });
+  live.retireSent = true;
+}

package/lib/db/migrations.ts

@@ -1493,6 +1493,20 @@ const migrations: Migration[] = [
       add("task_queue", "started_by", "TEXT");
     },
   },
+  {
+    id: 66,
+    name: "workspace_orch_mcp_servers",
+    up: (db) => {
+      // The MCP servers (by name) a workspace's orchestrator may use.
+      const columns = db.prepare(`PRAGMA table_info(workspaces)`).all() as {
+        name: string;
+      }[];
+      if (!columns.some((c) => c.name === "orch_mcp_servers"))
+        db.exec(
+          `ALTER TABLE workspaces ADD COLUMN orch_mcp_servers TEXT NOT NULL DEFAULT '["linear"]'`
+        );
+    },
+  },
 ];
 
 // `upTo`: stop after this id (tests that start from an older database).

package/lib/db/types.ts

@@ -220,6 +220,8 @@ export interface Workspace {
   orch_max_running: number;
   orch_max_starts_per_hour: number;
   orch_brake: string | null;
+  // MCP servers (by name) its orchestrator may use.
+  orch_mcp_servers: string[];
   // Set while Saad has the orchestrator paused.
   orch_paused_at: string | null;
   // Tasks running at once before new ones queue (lib/tasks/queue.ts); null: no limit.

package/lib/orchestrator/brief.ts

@@ -124,6 +124,8 @@ Acting:
 - \`${TOOL_NAMES.disarm}\` (task): stop an armed task merging by itself.
 - \`${TOOL_NAMES.ask_saad}\` (title, detail, link?, kind, task?, sha?): park an item on Saad's asks list and carry on; it never waits.
 
+The MCP servers this workspace allows (Settings → Workspaces) are yours to use through their own tools, for reading and for additive, reversible changes. Anything outbound through them (sending a message, an email, a post) is a hard line: park it with \`ask_saad\`.
+
 Act through these tools, not the shell: they're scoped to this workspace and braked. The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files (env files, keys, ~/.ssh, ~/.aws). Tokenvault is available through \`tv\`: use a token inside the command that needs it (e.g. \`FOO="\$(tv get <project> <desc>)" cmd\`), never print, echo or log a value, and never send one off the machine except to the service it's for. The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. \`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.
 
 ## Untrusted text

package/lib/orchestrator/mcp-servers.ts

@@ -0,0 +1,93 @@
+/**
+ * The MCP servers an orchestrator may use. Its permissions are otherwise a
+ * fixed list (tool-names.ts); each workspace adds whole servers, by name, from
+ * Settings → Workspaces. Servers carry their own auth and some send outbound
+ * (a message, an email), so none is allowed unless named; the brief keeps
+ * those actions as hard lines for ask_saad.
+ *
+ * Only names are ever read from the Claude config: never env, headers, URLs
+ * or tokens.
+ */
+
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { ORCHESTRATOR_PERMISSIONS } from "./tool-names";
+import { getOrchestrator } from "./home";
+import { getWorkspace } from "../workspaces";
+import { retireChat } from "../chat/runner";
+
+export const DEFAULT_MCP_SERVERS = ["linear"];
+
+// How Claude Code names a server inside a tool name: anything outside
+// letters, digits, "_" and "-" becomes "_".
+export const toolPrefix = (server: string) =>
+  `mcp__${server.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
+
+// The permissions for an orchestrator whose workspace allows these servers:
+// a bare mcp__<server> rule allows all of that server's tools.
+export function orchestratorPermissions(servers: string[]) {
+  const rules = [...new Set(servers.map((s) => s.trim()).filter(Boolean))].map(
+    toolPrefix
+  );
+  return {
+    ...ORCHESTRATOR_PERMISSIONS,
+    allowedTools: [...ORCHESTRATOR_PERMISSIONS.allowedTools, ...rules],
+  };
+}
+
+const claudeDir = () =>
+  process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+
+function readJson(file: string): unknown {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+const keys = (value: unknown): string[] =>
+  value && typeof value === "object" && !Array.isArray(value)
+    ? Object.keys(value)
+    : [];
+
+// Names of the servers the agent sees on this machine: user-level servers
+// (~/.claude.json), connectors the account has connected, and the servers
+// of installed plugins.
+export function configuredMcpServers(): string[] {
+  const names = new Set<string>();
+  const user = readJson(
+    process.env.CLAUDE_CONFIG_DIR
+      ? path.join(claudeDir(), ".claude.json")
+      : path.join(os.homedir(), ".claude.json")
+  ) as Record<string, unknown> | null;
+  for (const name of keys(user?.mcpServers)) names.add(name);
+  const connectors = user?.claudeAiMcpEverConnected;
+  if (Array.isArray(connectors))
+    for (const c of connectors) if (typeof c === "string") names.add(c);
+
+  const installed = readJson(
+    path.join(claudeDir(), "plugins", "installed_plugins.json")
+  ) as { plugins?: Record<string, { installPath?: unknown }[]> } | null;
+  for (const [id, installs] of Object.entries(installed?.plugins ?? {})) {
+    const plugin = id.split("@")[0];
+    const dir = installs?.[0]?.installPath;
+    if (typeof dir !== "string") continue;
+    const file = readJson(path.join(dir, ".mcp.json")) as Record<
+      string,
+      unknown
+    > | null;
+    const servers = keys(file?.mcpServers).length ? file?.mcpServers : file;
+    for (const server of keys(servers)) names.add(`plugin:${plugin}:${server}`);
+  }
+  return [...names].sort((a, b) => a.localeCompare(b));
+}
+
+// A workspace's allowed servers changed: its orchestrator's worker ends at its
+// next turn boundary and the next one starts with the new permissions.
+export async function applyMcpServers(workspaceId: string): Promise<void> {
+  const orchestrator = getOrchestrator(workspaceId);
+  if (orchestrator && getWorkspace(workspaceId))
+    await retireChat(orchestrator.id).catch(() => {});
+}

package/lib/orchestrator/tools.ts

@@ -118,8 +118,10 @@ export function orchestratorTools(
 // What the orchestrator's agent sees of its tools: names, descriptions,
 // arguments and permissions. A worker after a deploy tells the agent its
 // tools changed only when this did.
-export function orchestratorToolsDigest(): string {
-  return toolsDigest(DESCRIPTIONS, TOOL_SHAPES, ORCHESTRATOR_PERMISSIONS);
+export function orchestratorToolsDigest(
+  permissions: object = ORCHESTRATOR_PERMISSIONS
+): string {
+  return toolsDigest(DESCRIPTIONS, TOOL_SHAPES, permissions);
 }
 
 export function toolsDigest(

package/lib/orchestrator/worker.ts

@@ -2,7 +2,9 @@ import type { Session } from "../db";
 import { agentEnv } from "../agents/launch";
 import { loadOrchestratorBrief } from "./brief";
 import { orchestratorToken } from "./home";
-import { ORCHESTRATOR_PERMISSIONS, ORCHESTRATOR_SERVER } from "./tool-names";
+import { ORCHESTRATOR_SERVER } from "./tool-names";
+import { orchestratorPermissions } from "./mcp-servers";
+import { getWorkspace } from "../workspaces";
 import {
   httpToolCaller,
   orchestratorTools,
@@ -19,6 +21,9 @@ export async function orchestratorExtras(
   session: Session
 ): Promise<RoleExtras> {
   const baseUrl = agentEnv(session.id).AGENTOS_URL;
+  const permissions = orchestratorPermissions(
+    getWorkspace(session.workspace_id ?? "")?.orch_mcp_servers ?? []
+  );
   return {
     systemAppend: await loadOrchestratorBrief(session),
     mcpServers: {
@@ -30,9 +35,9 @@ export async function orchestratorExtras(
         )
       ),
     },
-    ...ORCHESTRATOR_PERMISSIONS,
+    ...permissions,
     toolGuard: (tool, input) => orchestratorToolRefusal(session, tool, input),
-    toolsDigest: orchestratorToolsDigest(),
+    toolsDigest: orchestratorToolsDigest(permissions),
     refresh: {
       atTokens: refreshSettings().orchestratorTokens,
       role: "orchestrator",

package/lib/workspaces.ts

@@ -6,15 +6,39 @@
 import { randomUUID } from "crypto";
 import { db, type Workspace } from "./db";
 
-type WorkspaceRow = Omit<Workspace, "collapsed" | "wake_tasks_on_pr"> & {
+type WorkspaceRow = Omit<
+  Workspace,
+  "collapsed" | "wake_tasks_on_pr" | "orch_mcp_servers"
+> & {
   collapsed: number;
   wake_tasks_on_pr: number;
+  orch_mcp_servers: string;
 };
 
+function parseServers(raw: string): string[] {
+  try {
+    const list = JSON.parse(raw);
+    return Array.isArray(list)
+      ? list.filter((n): n is string => typeof n === "string")
+      : [];
+  } catch {
+    return [];
+  }
+}
+
+// A list of server names: trimmed, deduplicated, none empty.
+function serverNames(value: unknown, current: string[]): string[] {
+  if (value === undefined) return current;
+  if (!Array.isArray(value) || value.some((n) => typeof n !== "string"))
+    throw new Error("mcpServers is a list of server names");
+  return [...new Set(value.map((n: string) => n.trim()).filter(Boolean))];
+}
+
 const toWorkspace = (row: WorkspaceRow): Workspace => ({
   ...row,
   collapsed: !!row.collapsed,
   wake_tasks_on_pr: !!row.wake_tasks_on_pr,
+  orch_mcp_servers: parseServers(row.orch_mcp_servers),
 });
 
 export function listWorkspaces(): Workspace[] {
@@ -62,19 +86,21 @@ export function updateWorkspace(
     sortOrder?: number;
     maxRunningTasks?: number | null;
     wakeTasksOnPR?: boolean;
+    mcpServers?: string[];
   }
 ): Workspace | null {
   const existing = getWorkspace(id);
   if (!existing) return null;
   const name = updates.name?.trim() || existing.name;
   db.prepare(
-    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ? WHERE id = ?`
+    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ?, orch_mcp_servers = ? WHERE id = ?`
   ).run(
     name,
     (updates.collapsed ?? existing.collapsed) ? 1 : 0,
     updates.sortOrder ?? existing.sort_order,
     taskLimit(updates.maxRunningTasks, existing.max_running_tasks),
     (updates.wakeTasksOnPR ?? existing.wake_tasks_on_pr) ? 1 : 0,
+    JSON.stringify(serverNames(updates.mcpServers, existing.orch_mcp_servers)),
     id
   );
   return getWorkspace(id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.496",
+  "version": "0.3.497",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"