@stigmer/protos 0.0.72 → 0.0.74

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js

@@ -118,55 +118,35 @@ export const McpServerCommandController = {
             kind: MethodKind.Unary,
         },
         /**
-         * Update the discovered capabilities (tools and resource templates) for an MCP server.
-         *
-         * Only modifies status.discovered_capabilities, leaving spec, validation
-         * state, and other status fields untouched.
-         *
-         * @internal
-         * Typical flow:
-         * 1. CLI calls getByReference(org/slug) to fetch the McpServer and its ID
-         * 2. CLI connects to the MCP server locally and queries tools/resources
-         * 3. CLI calls this RPC with the ID and discovered capabilities
-         *
-         * Authorization: Requires can_edit permission on the mcp_server resource.
-         *
-         * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateDiscoveredCapabilities
-         */
-        updateDiscoveredCapabilities: {
-            name: "updateDiscoveredCapabilities",
-            I: UpdateDiscoveredCapabilitiesInput,
-            O: McpServer,
-            kind: MethodKind.Unary,
-        },
-        /**
-         * Discover the capabilities of an MCP server by connecting to it.
+         * Connect to an MCP server: discover its tools and classify approval policies.
          *
          * Connects to the MCP server, enumerates tools and resource templates,
-         * and stores the result. Blocks until discovery completes (up to ~30 seconds)
-         * and returns the updated McpServer with populated
-         * status.discovered_capabilities.
+         * classifies tool approval policies via a lightweight LLM, and stores the
+         * results in status.discovered_capabilities and status.tool_approvals.
+         * Blocks until completion (up to ~30 seconds) and returns the updated McpServer.
          *
          * @internal
-         * Typical flow:
-         * 1. Web console ensures required credentials are saved in the user's personal environment
-         * 2. Web console calls discoverCapabilities with the MCP server ID
-         * 3. Backend resolves env vars from the user's personal environment
-         * 4. Backend starts a Temporal workflow; agent-runner connects to the MCP server
-         * 5. Discovered tools and resource templates are stored and returned
+         * Typical flows:
+         * - Web console: user clicks Connect, backend resolves env vars from the
+         *   user's personal environment, starts a Temporal workflow on the agent-runner.
+         * - CLI: `stigmer discover mcp-server <name>` calls connect with runtime_env
+         *   populated from local env vars, delegating discovery to the backend.
+         * - Graphton backfill: agent-runner calls connect on first execution when
+         *   status.discovered_capabilities is empty, passing runtime_env from the
+         *   execution context.
          *
          * Errors:
          * - FAILED_PRECONDITION: Required credentials missing from personal environment
          * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout
          * - NOT_FOUND: MCP server does not exist
          *
-         * Authorization: Requires can_edit permission on the mcp_server resource.
+         * Authorization: Requires can_connect permission on the mcp_server resource.
          *
-         * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.discoverCapabilities
+         * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.connect
          */
-        discoverCapabilities: {
-            name: "discoverCapabilities",
-            I: DiscoverCapabilitiesInput,
+        connect: {
+            name: "connect",
+            I: ConnectInput,
             O: McpServer,
             kind: MethodKind.Unary,
         },

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;;;;;;;WAaG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,4BAA4B,EAAE;YAC5B,IAAI,EAAE,8BAA8B;YACpC,CAAC,EAAE,iCAAiC;YACpC,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;;;;;;;WAaG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/command_pb.d.ts

@@ -1,6 +1,6 @@
 import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
 import type { McpServerSchema } from "./api_pb";
-import type { DiscoverCapabilitiesInputSchema, UpdateDiscoveredCapabilitiesInputSchema } from "./io_pb";
+import type { ConnectInputSchema } from "./io_pb";
 import type { ApiResourceDeleteInputSchema, UpdateVisibilityInputSchema } from "../../../commons/apiresource/io_pb";
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/command.proto.
@@ -114,54 +114,35 @@ export declare const McpServerCommandController: GenService<{
         output: typeof McpServerSchema;
     };
     /**
-     * Update the discovered capabilities (tools and resource templates) for an MCP server.
-     *
-     * Only modifies status.discovered_capabilities, leaving spec, validation
-     * state, and other status fields untouched.
-     *
-     * @internal
-     * Typical flow:
-     * 1. CLI calls getByReference(org/slug) to fetch the McpServer and its ID
-     * 2. CLI connects to the MCP server locally and queries tools/resources
-     * 3. CLI calls this RPC with the ID and discovered capabilities
-     *
-     * Authorization: Requires can_edit permission on the mcp_server resource.
-     *
-     * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateDiscoveredCapabilities
-     */
-    updateDiscoveredCapabilities: {
-        methodKind: "unary";
-        input: typeof UpdateDiscoveredCapabilitiesInputSchema;
-        output: typeof McpServerSchema;
-    };
-    /**
-     * Discover the capabilities of an MCP server by connecting to it.
+     * Connect to an MCP server: discover its tools and classify approval policies.
      *
      * Connects to the MCP server, enumerates tools and resource templates,
-     * and stores the result. Blocks until discovery completes (up to ~30 seconds)
-     * and returns the updated McpServer with populated
-     * status.discovered_capabilities.
+     * classifies tool approval policies via a lightweight LLM, and stores the
+     * results in status.discovered_capabilities and status.tool_approvals.
+     * Blocks until completion (up to ~30 seconds) and returns the updated McpServer.
      *
      * @internal
-     * Typical flow:
-     * 1. Web console ensures required credentials are saved in the user's personal environment
-     * 2. Web console calls discoverCapabilities with the MCP server ID
-     * 3. Backend resolves env vars from the user's personal environment
-     * 4. Backend starts a Temporal workflow; agent-runner connects to the MCP server
-     * 5. Discovered tools and resource templates are stored and returned
+     * Typical flows:
+     * - Web console: user clicks Connect, backend resolves env vars from the
+     *   user's personal environment, starts a Temporal workflow on the agent-runner.
+     * - CLI: `stigmer discover mcp-server <name>` calls connect with runtime_env
+     *   populated from local env vars, delegating discovery to the backend.
+     * - Graphton backfill: agent-runner calls connect on first execution when
+     *   status.discovered_capabilities is empty, passing runtime_env from the
+     *   execution context.
      *
      * Errors:
      * - FAILED_PRECONDITION: Required credentials missing from personal environment
      * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout
      * - NOT_FOUND: MCP server does not exist
      *
-     * Authorization: Requires can_edit permission on the mcp_server resource.
+     * Authorization: Requires can_connect permission on the mcp_server resource.
      *
-     * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.discoverCapabilities
+     * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.connect
      */
-    discoverCapabilities: {
+    connect: {
         methodKind: "unary";
-        input: typeof DiscoverCapabilitiesInputSchema;
+        input: typeof ConnectInputSchema;
         output: typeof McpServerSchema;
     };
 }>;

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js

@@ -6,11 +6,11 @@ import { file_ai_stigmer_agentic_mcpserver_v1_api } from "./api_pb";
 import { file_ai_stigmer_agentic_mcpserver_v1_io } from "./io_pb";
 import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb";
 import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
-import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "../../../iam/iampolicy/v1/rpcauthorization/method_options_pb";
+import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc/method_options_pb";
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/command.proto.
  */
-export const file_ai_stigmer_agentic_mcpserver_v1_command = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEylAkKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchJmCgZjcmVhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAQQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgCECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IBBAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkS1wEKHHVwZGF0ZURpc2NvdmVyZWRDYXBhYmlsaXRpZXMSQi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLlVwZGF0ZURpc2NvdmVyZWRDYXBhYmlsaXRpZXNJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIkfCuBhDCAQQLCINbWNwX3NlcnZlcl9pZCoudW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIGNhcGFiaWxpdGllcxLJAQoUZGlzY292ZXJDYXBhYmlsaXRpZXMSOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRpc2NvdmVyQ2FwYWJpbGl0aWVzSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciJJwrgYRQgEECwiDW1jcF9zZXJ2ZXJfaWQqMHVuYXV0aG9yaXplZCB0byBkaXNjb3ZlciBtY3Agc2VydmVyIGNhcGFiaWxpdGllcxoEoP8rLGIGcHJvdG8z", [file_ai_stigmer_agentic_mcpserver_v1_api, file_ai_stigmer_agentic_mcpserver_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options]);
+export const file_ai_stigmer_agentic_mcpserver_v1_command = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEylQcKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchJmCgZjcmVhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchoEoP8rLGIGcHJvdG8z", [file_ai_stigmer_agentic_mcpserver_v1_api, file_ai_stigmer_agentic_mcpserver_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options]);
 /**
  * McpServerCommandController provides write operations for MCP server resources.
  *

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,UAAU,CAAC;AAEpE,OAAO,EAAE,uCAAuC,EAAE,MAAM,SAAS,CAAC;AAElE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,8DAA8D,CAAC;AAEhJ;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,spDAAspD,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,CAAC,CAAC,CAAC;AAE35D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAgJlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,UAAU,CAAC;AAEpE,OAAO,EAAE,uCAAuC,EAAE,MAAM,SAAS,CAAC;AAElE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,k0CAAk0C,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEjjD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GA6HlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/io_pb.d.ts

@@ -1,6 +1,5 @@
 import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
 import type { ExecutionValue } from "../../executioncontext/v1/spec_pb";
-import type { DiscoveredCapabilities } from "./status_pb";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/io.proto.
@@ -29,48 +28,15 @@ export type McpServerId = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerId">
  */
 export declare const McpServerIdSchema: GenMessage<McpServerId>;
 /**
- * UpdateDiscoveredCapabilitiesInput is the request for the updateDiscoveredCapabilities RPC.
+ * ConnectInput is the request for the connect RPC.
  *
  * @internal
- * Used by:
- * - CLI: after `stigmer discover mcp-server <name>` connects locally, queries tools/resources,
- *   and pushes the results to stigmer-server.
- * - Agent-runner: future runtime cache refresh.
- *
- * The caller must first resolve the MCP server's system ID (e.g., via getByReference)
- * before calling this RPC.
- *
- * @generated from message ai.stigmer.agentic.mcpserver.v1.UpdateDiscoveredCapabilitiesInput
- */
-export type UpdateDiscoveredCapabilitiesInput = Message<"ai.stigmer.agentic.mcpserver.v1.UpdateDiscoveredCapabilitiesInput"> & {
-    /**
-     * System-generated ID of the MCP server to update.
-     * Obtained from McpServer.metadata.id (e.g., via getByReference).
-     *
-     * @generated from field: string mcp_server_id = 1;
-     */
-    mcpServerId: string;
-    /**
-     * Discovered tools and resource templates to store.
-     *
-     * @generated from field: ai.stigmer.agentic.mcpserver.v1.DiscoveredCapabilities discovered_capabilities = 2;
-     */
-    discoveredCapabilities?: DiscoveredCapabilities;
-};
-/**
- * Describes the message ai.stigmer.agentic.mcpserver.v1.UpdateDiscoveredCapabilitiesInput.
- * Use `create(UpdateDiscoveredCapabilitiesInputSchema)` to create a new message.
- */
-export declare const UpdateDiscoveredCapabilitiesInputSchema: GenMessage<UpdateDiscoveredCapabilitiesInput>;
-/**
- * DiscoverCapabilitiesInput is the request for the discoverCapabilities RPC.
- *
- * @internal
- * Triggers server-side MCP discovery: the backend creates an ephemeral
- * ExecutionContext with the resolved environment variables, starts a Temporal
- * workflow that connects to the MCP server (via the agent-runner), enumerates
- * tools and resource templates, and stores the result in
- * status.discovered_capabilities.
+ * Triggers server-side MCP discovery and tool approval classification:
+ * the backend creates an ephemeral ExecutionContext with the resolved
+ * environment variables, starts a Temporal workflow that connects to the
+ * MCP server (via the agent-runner), enumerates tools and resource
+ * templates, classifies tool approval policies, and stores the results
+ * in status.discovered_capabilities and status.tool_approvals.
  *
  * Environment variable resolution:
  * - When runtime_env is provided, the backend creates an ExecutionContext directly
@@ -78,23 +44,29 @@ export declare const UpdateDiscoveredCapabilitiesInputSchema: GenMessage<UpdateD
  * - When runtime_env is empty, the backend resolves values from the authenticated
  *   user's personal environment.
  *
+ * Callers:
+ * - Web console: calls connect after saving credentials to personal environment.
+ * - CLI: calls connect with runtime_env populated from local env vars.
+ * - Graphton backfill: calls connect with runtime_env from execution context
+ *   when status.discovered_capabilities is empty on first agent execution.
+ *
  * Prerequisites:
  * - The MCP server must exist and have a valid server_type (stdio or http)
  * - Either runtime_env must contain all required keys, or the keys must be
  *   present in the user's personal environment
  *
- * @generated from message ai.stigmer.agentic.mcpserver.v1.DiscoverCapabilitiesInput
+ * @generated from message ai.stigmer.agentic.mcpserver.v1.ConnectInput
  */
-export type DiscoverCapabilitiesInput = Message<"ai.stigmer.agentic.mcpserver.v1.DiscoverCapabilitiesInput"> & {
+export type ConnectInput = Message<"ai.stigmer.agentic.mcpserver.v1.ConnectInput"> & {
     /**
-     * System-generated ID of the MCP server to discover.
+     * System-generated ID of the MCP server to connect to.
      * Obtained from McpServer.metadata.id (e.g., via getByReference).
      *
      * @generated from field: string mcp_server_id = 1;
      */
     mcpServerId: string;
     /**
-     * Optional environment variable values for one-time discovery.
+     * Optional environment variable values for one-time use.
      * When empty, values are resolved from the user's personal environment.
      *
      * @generated from field: map<string, ai.stigmer.agentic.executioncontext.v1.ExecutionValue> runtime_env = 2;
@@ -104,7 +76,7 @@ export type DiscoverCapabilitiesInput = Message<"ai.stigmer.agentic.mcpserver.v1
     };
 };
 /**
- * Describes the message ai.stigmer.agentic.mcpserver.v1.DiscoverCapabilitiesInput.
- * Use `create(DiscoverCapabilitiesInputSchema)` to create a new message.
+ * Describes the message ai.stigmer.agentic.mcpserver.v1.ConnectInput.
+ * Use `create(ConnectInputSchema)` to create a new message.
  */
-export declare const DiscoverCapabilitiesInputSchema: GenMessage<DiscoverCapabilitiesInput>;
+export declare const ConnectInputSchema: GenMessage<ConnectInput>;

package/ai/stigmer/agentic/mcpserver/v1/io_pb.js

@@ -3,25 +3,19 @@
 /* eslint-disable */
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_agentic_executioncontext_v1_spec } from "../../executioncontext/v1/spec_pb";
-import { file_ai_stigmer_agentic_mcpserver_v1_status } from "./status_pb";
 import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb";
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/io.proto.
  */
-export const file_ai_stigmer_agentic_mcpserver_v1_io = /*@__PURE__*/ fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEipAEKIVVwZGF0ZURpc2NvdmVyZWRDYXBhYmlsaXRpZXNJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESYAoXZGlzY292ZXJlZF9jYXBhYmlsaXRpZXMYAiABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRpc2NvdmVyZWRDYXBhYmlsaXRpZXNCBrpIA8gBASKGAgoZRGlzY292ZXJDYXBhYmlsaXRpZXNJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESXwoLcnVudGltZV9lbnYYAiADKAsySi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRpc2NvdmVyQ2FwYWJpbGl0aWVzSW5wdXQuUnVudGltZUVudkVudHJ5GmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAFiBnByb3RvMw", [file_ai_stigmer_agentic_executioncontext_v1_spec, file_ai_stigmer_agentic_mcpserver_v1_status, file_buf_validate_validate]);
+export const file_ai_stigmer_agentic_mcpserver_v1_io = /*@__PURE__*/ fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi7AEKDENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESUgoLcnVudGltZV9lbnYYAiADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dC5SdW50aW1lRW52RW50cnkaaQoPUnVudGltZUVudkVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4AWIGcHJvdG8z", [file_ai_stigmer_agentic_executioncontext_v1_spec, file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.agentic.mcpserver.v1.McpServerId.
  * Use `create(McpServerIdSchema)` to create a new message.
  */
 export const McpServerIdSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_mcpserver_v1_io, 0);
 /**
- * Describes the message ai.stigmer.agentic.mcpserver.v1.UpdateDiscoveredCapabilitiesInput.
- * Use `create(UpdateDiscoveredCapabilitiesInputSchema)` to create a new message.
+ * Describes the message ai.stigmer.agentic.mcpserver.v1.ConnectInput.
+ * Use `create(ConnectInputSchema)` to create a new message.
  */
-export const UpdateDiscoveredCapabilitiesInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_mcpserver_v1_io, 1);
-/**
- * Describes the message ai.stigmer.agentic.mcpserver.v1.DiscoverCapabilitiesInput.
- * Use `create(DiscoverCapabilitiesInputSchema)` to create a new message.
- */
-export const DiscoverCapabilitiesInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_mcpserver_v1_io, 2);
+export const ConnectInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_mcpserver_v1_io, 1);
 //# sourceMappingURL=io_pb.js.map

package/ai/stigmer/agentic/mcpserver/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,gDAAgD,EAAE,MAAM,mCAAmC,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,ouBAAouB,EAAE,CAAC,gDAAgD,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoB92B;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAkD,aAAa,CACjH,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,gDAAgD,EAAE,MAAM,mCAAmC,CAAC;AACrG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,keAAke,EAAE,CAAC,gDAAgD,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoB/jB;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAkD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/query_pb.js

@@ -5,11 +5,11 @@ import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_agentic_mcpserver_v1_api } from "./api_pb";
 import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb";
 import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
-import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "../../../iam/iampolicy/v1/rpcauthorization/method_options_pb";
+import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc/method_options_pb";
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/query.proto.
  */
-export const file_ai_stigmer_agentic_mcpserver_v1_query = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMq8CChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIAxAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBGgSg/yssYgZwcm90bzM", [file_ai_stigmer_agentic_mcpserver_v1_api, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options]);
+export const file_ai_stigmer_agentic_mcpserver_v1_query = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMq8CChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIARAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBGgSg/yssYgZwcm90bzM", [file_ai_stigmer_agentic_mcpserver_v1_api, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options]);
 /**
  * McpServerQueryController provides read operations for MCP server resources.
  *

package/ai/stigmer/agentic/mcpserver/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,UAAU,CAAC;AAEpE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,8DAA8D,CAAC;AAEhJ;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,6gBAA6gB,EAAE,CAAC,wCAAwC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,CAAC,CAAC,CAAC;AAEzuB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAmChC,aAAa,CAChB,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,UAAU,CAAC;AAEpE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,6gBAA6gB,EAAE,CAAC,wCAAwC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEntB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAmChC,aAAa,CAChB,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.d.ts

@@ -1,5 +1,6 @@
 import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
 import type { EnvironmentSpec } from "../../environment/v1/spec_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/spec.proto.
@@ -88,24 +89,34 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
      */
     envSpec?: EnvironmentSpec;
     /**
-     * Default tool approval policies for this MCP server.
+     * Source/provenance of this MCP server definition.
+     * Populated by automated sync workflows (e.g. MCP Registry sync).
+     * Empty for hand-authored definitions like the system mcp-server-stigmer.
+     *
+     * @generated from field: ai.stigmer.agentic.mcpserver.v1.McpServerSource source = 10;
+     */
+    source?: McpServerSource;
+    /**
+     * Manual tool approval overrides set by the MCP server owner.
      *
      * @internal
-     * Tools listed here require user approval before execution by default.
-     * This is the first layer in the approval policy chain:
-     *   McpServer.default_tool_approvals → Agent.tool_approval_overrides → auto_approve_all
+     * These take precedence over system-generated `McpServerStatus.tool_approvals`.
+     * Never auto-modified — only changed by explicit user action (apply/update).
      *
      * Use cases:
-     * - Mark destructive operations as requiring approval by default
-     * - Protect sensitive data access across all agents using this server
+     * - Force approval for a tool the classifier marked as auto-approve
+     * - Exempt a safe tool the classifier flagged as needing approval
      * - Establish organization-wide safety policies for dangerous tools
      *
-     * Tools not listed here do not require approval by default.
-     * Agents can still add approval requirements via tool_approval_overrides.
+     * Policy chain (lowest to highest priority):
+     * 1. McpServerStatus.tool_approvals - System-generated defaults
+     * 2. McpServerSpec.pinned_tool_approvals - Manual overrides (this field)
+     * 3. Agent.McpServerUsage.tool_approval_overrides - Per-agent customization
+     * 4. AgentExecution.auto_approve_all - Runtime bypass
      *
-     * @generated from field: repeated ai.stigmer.agentic.mcpserver.v1.ToolApprovalPolicy default_tool_approvals = 9;
+     * @generated from field: repeated ai.stigmer.agentic.mcpserver.v1.ToolApprovalPolicy pinned_tool_approvals = 11;
      */
-    defaultToolApprovals: ToolApprovalPolicy[];
+    pinnedToolApprovals: ToolApprovalPolicy[];
 };
 /**
  * Describes the message ai.stigmer.agentic.mcpserver.v1.McpServerSpec.
@@ -137,9 +148,26 @@ export type StdioServerConfig = Message<"ai.stigmer.agentic.mcpserver.v1.StdioSe
     command: string;
     /**
      * Arguments to pass to the command.
+     *
+     * Argument values can reference environment variables using ${VAR_NAME} syntax.
+     * These placeholders are resolved at runtime from the execution environment
+     * (same source as HTTP header/query param placeholders). This enables MCP
+     * servers that take core configuration as positional CLI arguments (e.g.
+     * database connection URLs, directory paths) to be parameterized per-user
+     * through env_spec.
+     *
+     * Resolution uses strict mode: missing variables produce a clear error
+     * rather than passing a literal "${VAR}" to the subprocess.
+     *
+     * Note: resolved values appear in the subprocess argv, which is visible
+     * via /proc/<pid>/cmdline within the container. In the containerized
+     * agent-runner environment this is not a practical concern, but callers
+     * should be aware when debugging.
+     *
      * Examples:
-     * - For npx: ["-y", "@modelcontextprotocol/server-github"]
-     * - For python: ["-m", "mcp_server_sqlite", "--db-path", "/data/db.sqlite"]
+     *   ["-y", "@modelcontextprotocol/server-github"]
+     *   ["-y", "@modelcontextprotocol/server-postgres", "${POSTGRES_CONNECTION_URL}"]
+     *   ["-m", "mcp_server_sqlite", "--db-path", "${DB_PATH}/data.sqlite"]
      *
      * @generated from field: repeated string args = 2;
      */
@@ -245,9 +273,10 @@ export declare const HttpServerConfigSchema: GenMessage<HttpServerConfig>;
  * If a placeholder references a missing argument, it's replaced with "<unknown>".
  *
  * Policy chain (lowest to highest priority):
- * 1. McpServer.default_tool_approvals (this message) - Platform/org defaults
- * 2. Agent.McpServerUsage.tool_approval_overrides - Per-agent customization
- * 3. AgentExecution.auto_approve_all - Runtime bypass
+ * 1. McpServerStatus.tool_approvals - System-generated defaults
+ * 2. McpServerSpec.pinned_tool_approvals - Manual overrides
+ * 3. Agent.McpServerUsage.tool_approval_overrides - Per-agent customization
+ * 4. AgentExecution.auto_approve_all - Runtime bypass
  *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.ToolApprovalPolicy
  */
@@ -281,3 +310,59 @@ export type ToolApprovalPolicy = Message<"ai.stigmer.agentic.mcpserver.v1.ToolAp
  * Use `create(ToolApprovalPolicySchema)` to create a new message.
  */
 export declare const ToolApprovalPolicySchema: GenMessage<ToolApprovalPolicy>;
+/**
+ * McpServerSource tracks provenance for MCP server definitions that were
+ * imported from an external registry or catalog via automated sync.
+ *
+ * This enables:
+ * - Traceability: users can inspect the upstream source of any marketplace entry.
+ * - Freshness tracking: the platform knows when a definition was last synced.
+ * - Deprecation detection: if a server disappears from the source registry,
+ *   the sync workflow can flag it as deprecated.
+ * - Deduplication: source.registry_name is the natural key for upsert logic.
+ *
+ * @generated from message ai.stigmer.agentic.mcpserver.v1.McpServerSource
+ */
+export type McpServerSource = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSource"> & {
+    /**
+     * Registry or catalog this definition was sourced from.
+     * Example: "registry.modelcontextprotocol.io"
+     *
+     * @generated from field: string registry = 1;
+     */
+    registry: string;
+    /**
+     * Name/identifier in the source registry (exact, unmodified).
+     * This is the canonical key used for dedup and update matching.
+     * Example: "ai.exa/exa"
+     *
+     * @generated from field: string registry_name = 2;
+     */
+    registryName: string;
+    /**
+     * Version from the source registry at the time of last sync.
+     * Example: "3.1.3"
+     *
+     * @generated from field: string version = 3;
+     */
+    version: string;
+    /**
+     * Repository URL for the MCP server source code.
+     * Lets users inspect the upstream implementation for trust and transparency.
+     * Example: "https://github.com/exa-labs/exa-mcp-server"
+     *
+     * @generated from field: string repository_url = 4;
+     */
+    repositoryUrl: string;
+    /**
+     * Timestamp of last successful sync from the source.
+     *
+     * @generated from field: google.protobuf.Timestamp last_synced_at = 5;
+     */
+    lastSyncedAt?: Timestamp;
+};
+/**
+ * Describes the message ai.stigmer.agentic.mcpserver.v1.McpServerSource.
+ * Use `create(McpServerSourceSchema)` to create a new message.
+ */
+export declare const McpServerSourceSchema: GenMessage<McpServerSource>;

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.js

@@ -4,10 +4,11 @@
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_agentic_environment_v1_spec } from "../../environment/v1/spec_pb";
 import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/spec.proto.
  */
-export const file_ai_stigmer_agentic_mcpserver_v1_spec = /*@__PURE__*/ fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3NwZWMucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEinAMKDU1jcFNlcnZlclNwZWMSEwoLZGVzY3JpcHRpb24YASABKAkSEAoIaWNvbl91cmwYAiABKAkSDAoEdGFncxgDIAMoCRJDCgVzdGRpbxgEIAEoCzIyLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU3RkaW9TZXJ2ZXJDb25maWdIABJBCgRodHRwGAUgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5IdHRwU2VydmVyQ29uZmlnSAASHQoVZGVmYXVsdF9lbmFibGVkX3Rvb2xzGAcgAygJEkQKCGVudl9zcGVjGAggASgLMjIuYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U3BlYxJTChZkZWZhdWx0X3Rvb2xfYXBwcm92YWxzGAkgAygLMjMuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Ub29sQXBwcm92YWxQb2xpY3lCFAoLc2VydmVyX3R5cGUSBbpIAggBIk8KEVN0ZGlvU2VydmVyQ29uZmlnEhcKB2NvbW1hbmQYASABKAlCBrpIA8gBARIMCgRhcmdzGAIgAygJEhMKC3dvcmtpbmdfZGlyGAMgASgJIuACChBIdHRwU2VydmVyQ29uZmlnEhgKA3VybBgBIAEoCUILukgIyAEBcgOIAQESTwoHaGVhZGVycxgCIAMoCzI+LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuSHR0cFNlcnZlckNvbmZpZy5IZWFkZXJzRW50cnkSWAoMcXVlcnlfcGFyYW1zGAMgAygLMkIuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5IdHRwU2VydmVyQ29uZmlnLlF1ZXJ5UGFyYW1zRW50cnkSIwoPdGltZW91dF9zZWNvbmRzGAQgASgFQgq6SAcaBRisAigAGi4KDEhlYWRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGjIKEFF1ZXJ5UGFyYW1zRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJBChJUb29sQXBwcm92YWxQb2xpY3kSGgoJdG9vbF9uYW1lGAEgASgJQge6SARyAhABEg8KB21lc3NhZ2UYAiABKAliBnByb3RvMw", [file_ai_stigmer_agentic_environment_v1_spec, file_buf_validate_validate]);
+export const file_ai_stigmer_agentic_mcpserver_v1_spec = /*@__PURE__*/ fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3NwZWMucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEi3QMKDU1jcFNlcnZlclNwZWMSEwoLZGVzY3JpcHRpb24YASABKAkSEAoIaWNvbl91cmwYAiABKAkSDAoEdGFncxgDIAMoCRJDCgVzdGRpbxgEIAEoCzIyLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU3RkaW9TZXJ2ZXJDb25maWdIABJBCgRodHRwGAUgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5IdHRwU2VydmVyQ29uZmlnSAASHQoVZGVmYXVsdF9lbmFibGVkX3Rvb2xzGAcgAygJEkQKCGVudl9zcGVjGAggASgLMjIuYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U3BlYxJACgZzb3VyY2UYCiABKAsyMC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlclNvdXJjZRJSChVwaW5uZWRfdG9vbF9hcHByb3ZhbHMYCyADKAsyMy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLlRvb2xBcHByb3ZhbFBvbGljeUIUCgtzZXJ2ZXJfdHlwZRIFukgCCAEiTwoRU3RkaW9TZXJ2ZXJDb25maWcSFwoHY29tbWFuZBgBIAEoCUIGukgDyAEBEgwKBGFyZ3MYAiADKAkSEwoLd29ya2luZ19kaXIYAyABKAki4AIKEEh0dHBTZXJ2ZXJDb25maWcSGAoDdXJsGAEgASgJQgu6SAjIAQFyA4gBARJPCgdoZWFkZXJzGAIgAygLMj4uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5IdHRwU2VydmVyQ29uZmlnLkhlYWRlcnNFbnRyeRJYCgxxdWVyeV9wYXJhbXMYAyADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkh0dHBTZXJ2ZXJDb25maWcuUXVlcnlQYXJhbXNFbnRyeRIjCg90aW1lb3V0X3NlY29uZHMYBCABKAVCCrpIBxoFGKwCKAAaLgoMSGVhZGVyc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaMgoQUXVlcnlQYXJhbXNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIkEKElRvb2xBcHByb3ZhbFBvbGljeRIaCgl0b29sX25hbWUYASABKAlCB7pIBHICEAESDwoHbWVzc2FnZRgCIAEoCSKXAQoPTWNwU2VydmVyU291cmNlEhAKCHJlZ2lzdHJ5GAEgASgJEhUKDXJlZ2lzdHJ5X25hbWUYAiABKAkSDwoHdmVyc2lvbhgDIAEoCRIWCg5yZXBvc2l0b3J5X3VybBgEIAEoCRIyCg5sYXN0X3N5bmNlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBiBnByb3RvMw", [file_ai_stigmer_agentic_environment_v1_spec, file_buf_validate_validate, file_google_protobuf_timestamp]);
 /**
  * Describes the message ai.stigmer.agentic.mcpserver.v1.McpServerSpec.
  * Use `create(McpServerSpecSchema)` to create a new message.
@@ -28,4 +29,9 @@ export const HttpServerConfigSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_
  * Use `create(ToolApprovalPolicySchema)` to create a new message.
  */
 export const ToolApprovalPolicySchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_mcpserver_v1_spec, 3);
+/**
+ * Describes the message ai.stigmer.agentic.mcpserver.v1.McpServerSource.
+ * Use `create(McpServerSourceSchema)` to create a new message.
+ */
+export const McpServerSourceSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_mcpserver_v1_spec, 4);
 //# sourceMappingURL=spec_pb.js.map

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,4zCAA4zC,EAAE,CAAC,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA4Gp5C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA8C5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAkD5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,gmDAAgmD,EAAE,CAAC,2CAA2C,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAuHxtD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAmD5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA0D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}