@stigmer/react 3.1.6 → 3.1.7

package/mcp-server/OAuthRequiredNotice.js

@@ -0,0 +1,29 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { cn } from "@stigmer/theme";
+/**
+ * Sets accurate expectations for connecting an **OAuth-only** MCP server —
+ * one whose hosted endpoint rejects manually-entered static tokens
+ * (`spec.auth.oauth_only`, e.g. Notion, Monday).
+ *
+ * Without this notice a user might expect the (now-hidden) manual token
+ * option and wonder why only "Sign in" is offered. It explains, in one line,
+ * that OAuth is required and a pasted API token would be rejected — turning a
+ * silent constraint into a clear one (Nielsen: visibility of system status).
+ *
+ * Self-gating: renders `null` unless the server is `oauth_only`. Callers
+ * render it unconditionally next to their Connect action, mirroring
+ * {@link StdioSandboxNotice}.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. No
+ * Console-specific dependencies — safe for platform-builder embedding.
+ */
+export function OAuthRequiredNotice({ oauthOnly, className, }) {
+    if (!oauthOnly)
+        return null;
+    return (_jsxs("div", { role: "status", className: cn("bg-muted-subtle text-muted-foreground flex items-start gap-2.5 rounded-lg border border-transparent px-4 py-3", className), children: [_jsx(KeyIcon, { className: "mt-0.5 size-4 shrink-0" }), _jsx("p", { className: "text-xs leading-relaxed", children: "This server requires OAuth. Sign in to connect \u2014 its hosted endpoint rejects manually-entered API tokens, so a pasted token won't work here." })] }));
+}
+function KeyIcon({ className }) {
+    return (_jsxs("svg", { width: "16", height: "16", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "1.5", strokeLinecap: "round", strokeLinejoin: "round", className: className, "aria-hidden": "true", children: [_jsx("circle", { cx: "5", cy: "11", r: "2.5" }), _jsx("path", { d: "M6.8 9.2 13 3" }), _jsx("path", { d: "M11 5l1.5 1.5" }), _jsx("path", { d: "M9 7l1.5 1.5" })] }));
+}
+//# sourceMappingURL=OAuthRequiredNotice.js.map

package/mcp-server/OAuthRequiredNotice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthRequiredNotice.js","sourceRoot":"","sources":["../../src/mcp-server/OAuthRequiredNotice.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAapC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,SAAS,EACT,SAAS,GACgB;IACzB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,OAAO,CACL,eACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,EAAE,CACX,+GAA+G,EAC/G,SAAS,CACV,aAED,KAAC,OAAO,IAAC,SAAS,EAAC,wBAAwB,GAAG,EAC9C,YAAG,SAAS,EAAC,yBAAyB,kKAIlC,IACA,CACP,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,EAAE,SAAS,EAA0B;IACpD,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,SAAS,EAAE,SAAS,iBACR,MAAM,aAElB,iBAAQ,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,KAAK,GAAG,EACjC,eAAM,CAAC,EAAC,eAAe,GAAG,EAC1B,eAAM,CAAC,EAAC,eAAe,GAAG,EAC1B,eAAM,CAAC,EAAC,cAAc,GAAG,IACrB,CACP,CAAC;AACJ,CAAC"}

package/mcp-server/StdioSandboxNotice.d.ts

@@ -0,0 +1,43 @@
+import type { DeploymentMode } from "@stigmer/sdk";
+import type { McpServerSpec } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+/** The `server_type` oneof discriminator from an MCP server's spec. */
+type McpServerType = McpServerSpec["serverType"];
+/**
+ * Whether an MCP server's transport is stdio while connected to Stigmer Cloud.
+ *
+ * stdio servers run as a subprocess inside an isolated Daytona sandbox in the
+ * cloud — not on the user's own computer. This predicate identifies exactly
+ * that combination so the connect UI can set accurate expectations. HTTP
+ * servers and any transport in local mode return `false`.
+ *
+ * Pure and framework-free so it can be unit-tested without rendering.
+ */
+export declare function isStdioInCloud(mode: DeploymentMode, serverType: McpServerType | undefined): boolean;
+/** Props for {@link StdioSandboxNotice}. */
+export interface StdioSandboxNoticeProps {
+    /** The MCP server's `spec.serverType` oneof. */
+    readonly serverType: McpServerType | undefined;
+    /** Additional CSS class names for the root container. */
+    readonly className?: string;
+}
+/**
+ * Sets accurate expectations for connecting an **stdio** MCP server from
+ * **Stigmer Cloud**.
+ *
+ * stdio servers are a supported cloud capability — Stigmer runs them in an
+ * isolated Daytona sandbox. But that sandbox is not the user's own machine,
+ * so a server that expects access to local files, applications, or a private
+ * network (e.g. a filesystem server) won't behave as the user intends. This
+ * notice explains that up front; Connect itself stays enabled because
+ * self-contained servers work fine.
+ *
+ * Self-gating: reads the deployment mode from context and renders `null`
+ * unless the server is stdio and the backend is cloud. Callers render it
+ * unconditionally next to their Connect action.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. No
+ * Console-specific dependencies — safe for platform-builder embedding.
+ */
+export declare function StdioSandboxNotice({ serverType, className, }: StdioSandboxNoticeProps): import("react/jsx-runtime").JSX.Element | null;
+export {};
+//# sourceMappingURL=StdioSandboxNotice.d.ts.map

package/mcp-server/StdioSandboxNotice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StdioSandboxNotice.d.ts","sourceRoot":"","sources":["../../src/mcp-server/StdioSandboxNotice.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yDAAyD,CAAC;AAG7F,uEAAuE;AACvE,KAAK,aAAa,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;AAEjD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,aAAa,GAAG,SAAS,GACpC,OAAO,CAET;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,gDAAgD;IAChD,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG,SAAS,CAAC;IAC/C,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,UAAU,EACV,SAAS,GACV,EAAE,uBAAuB,kDAoBzB"}

package/mcp-server/StdioSandboxNotice.js

@@ -0,0 +1,45 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { cn } from "@stigmer/theme";
+import { useDeploymentMode } from "../deployment-mode.js";
+/**
+ * Whether an MCP server's transport is stdio while connected to Stigmer Cloud.
+ *
+ * stdio servers run as a subprocess inside an isolated Daytona sandbox in the
+ * cloud — not on the user's own computer. This predicate identifies exactly
+ * that combination so the connect UI can set accurate expectations. HTTP
+ * servers and any transport in local mode return `false`.
+ *
+ * Pure and framework-free so it can be unit-tested without rendering.
+ */
+export function isStdioInCloud(mode, serverType) {
+    return mode === "cloud" && serverType?.case === "stdio";
+}
+/**
+ * Sets accurate expectations for connecting an **stdio** MCP server from
+ * **Stigmer Cloud**.
+ *
+ * stdio servers are a supported cloud capability — Stigmer runs them in an
+ * isolated Daytona sandbox. But that sandbox is not the user's own machine,
+ * so a server that expects access to local files, applications, or a private
+ * network (e.g. a filesystem server) won't behave as the user intends. This
+ * notice explains that up front; Connect itself stays enabled because
+ * self-contained servers work fine.
+ *
+ * Self-gating: reads the deployment mode from context and renders `null`
+ * unless the server is stdio and the backend is cloud. Callers render it
+ * unconditionally next to their Connect action.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. No
+ * Console-specific dependencies — safe for platform-builder embedding.
+ */
+export function StdioSandboxNotice({ serverType, className, }) {
+    const mode = useDeploymentMode();
+    if (!isStdioInCloud(mode, serverType))
+        return null;
+    return (_jsxs("div", { role: "status", className: cn("bg-muted-subtle text-muted-foreground flex items-start gap-2.5 rounded-lg border border-transparent px-4 py-3", className), children: [_jsx(SandboxIcon, { className: "mt-0.5 size-4 shrink-0" }), _jsx("p", { className: "text-xs leading-relaxed", children: "This stdio server runs in an isolated cloud sandbox, not on your own computer. Tools that need access to your local files, applications, or private network won't be available here." })] }));
+}
+function SandboxIcon({ className }) {
+    return (_jsxs("svg", { width: "16", height: "16", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "1.5", strokeLinecap: "round", strokeLinejoin: "round", className: className, "aria-hidden": "true", children: [_jsx("path", { d: "M2 5.5 8 2.5l6 3-6 3-6-3Z" }), _jsx("path", { d: "M2 5.5v5l6 3 6-3v-5" }), _jsx("path", { d: "M8 8.5v5" })] }));
+}
+//# sourceMappingURL=StdioSandboxNotice.js.map

package/mcp-server/StdioSandboxNotice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StdioSandboxNotice.js","sourceRoot":"","sources":["../../src/mcp-server/StdioSandboxNotice.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAGpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK1D;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAoB,EACpB,UAAqC;IAErC,OAAO,IAAI,KAAK,OAAO,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC;AAC1D,CAAC;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,UAAU,EACV,SAAS,GACe;IACxB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,OAAO,CACL,eACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,EAAE,CACX,+GAA+G,EAC/G,SAAS,CACV,aAED,KAAC,WAAW,IAAC,SAAS,EAAC,wBAAwB,GAAG,EAClD,YAAG,SAAS,EAAC,yBAAyB,qMAIlC,IACA,CACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,EAAE,SAAS,EAA0B;IACxD,OAAO,CACL,eACE,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,KAAK,EACjB,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,SAAS,EAAE,SAAS,iBACR,MAAM,aAElB,eAAM,CAAC,EAAC,2BAA2B,GAAG,EACtC,eAAM,CAAC,EAAC,qBAAqB,GAAG,EAChC,eAAM,CAAC,EAAC,UAAU,GAAG,IACjB,CACP,CAAC;AACJ,CAAC"}

package/mcp-server/useMcpServerCredentials.d.ts

@@ -141,6 +141,18 @@ export interface UseMcpServerCredentialsReturn {
      * link (when vendor approval is granted).
      */
     readonly canBringOwnApp: boolean;
+    /**
+     * `true` when a manually-entered static token is a valid way to
+     * authenticate this server. `false` for `oauth_only` servers whose
+     * hosted endpoint rejects static tokens (`spec.auth.oauth_only`), where
+     * OAuth is the sole credential path.
+     *
+     * Connect surfaces use this to decide whether to offer the "enter token
+     * manually" affordance — offering it on an `oauth_only` server would send
+     * the user down a path that cannot succeed. Always `true` for manual-only
+     * and PAT-capable servers.
+     */
+    readonly manualEntrySupported: boolean;
     /**
      * When `true`, the user has opted to bypass OAuth and enter the
      * `target_env_var` token manually. In this state:

package/mcp-server/useMcpServerCredentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useMcpServerCredentials.d.ts","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerCredentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wDAAwD,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,2DAA2D,CAAC;AAK3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnD,uDAAuD;AACvD,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IAChD;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,oBAAoB,EAAE,cAAc,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,SAAS,EAAE,SAAS,GAAG,IAAI,GAC1B,6BAA6B,CAuG/B"}
+{"version":3,"file":"useMcpServerCredentials.d.ts","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerCredentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wDAAwD,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,2DAA2D,CAAC;AAK3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnD,uDAAuD;AACvD,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IAChD;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,oBAAoB,EAAE,cAAc,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,SAAS,EAAE,SAAS,GAAG,IAAI,GAC1B,6BAA6B,CAgH/B"}

package/mcp-server/useMcpServerCredentials.js

@@ -81,6 +81,13 @@ export function useMcpServerCredentials(org, mcpServer) {
     const authMode = auth ? "oauth" : "manual";
     const oauthTargetEnvVar = auth?.targetEnvVar || null;
     const tokenLifetimeHint = auth?.tokenLifetimeHint || null;
+    // A static token is a valid credential for every server except those whose
+    // endpoint declares it rejects them (`oauth_only`). This is the single source
+    // of truth the connect surfaces consult before offering manual entry.
+    const manualEntrySupported = !auth?.oauthOnly;
+    // Defensively force manual override off for oauth_only servers so no surface
+    // can enter a dead-end manual-entry state, even if a stale toggle is set.
+    const effectiveManualOverride = manualOverride && manualEntrySupported;
     const oauthStatus = mcpServer?.status?.oauthStatus;
     const isVendorApprovalPending = authMode === "oauth" &&
         oauthStatus?.vendorApprovalStatus === VendorApprovalStatus.PENDING;
@@ -106,14 +113,14 @@ export function useMcpServerCredentials(org, mcpServer) {
     }, [mcpServer, existingKeys]);
     const requiredMissing = useMemo(() => allMissingVariables.filter((v) => !v.optional), [allMissingVariables]);
     const missingVariables = useMemo(() => {
-        if (!oauthTargetEnvVar || manualOverride)
+        if (!oauthTargetEnvVar || effectiveManualOverride)
             return requiredMissing;
         return requiredMissing.filter((v) => v.key !== oauthTargetEnvVar);
-    }, [requiredMissing, oauthTargetEnvVar, manualOverride]);
+    }, [requiredMissing, oauthTargetEnvVar, effectiveManualOverride]);
     const isReady = !personalEnv.isLoading &&
         !grantStatus.isLoading &&
         missingVariables.length === 0 &&
-        (authMode === "manual" || manualOverride || isOAuthConnected);
+        (authMode === "manual" || effectiveManualOverride || isOAuthConnected);
     const saveCredentials = useCallback(async (values) => {
         await personalEnv.getOrCreate();
         await personalEnv.addVariables(values);
@@ -136,6 +143,7 @@ export function useMcpServerCredentials(org, mcpServer) {
         effectiveOAuthSource,
         isOrgOAuthApp,
         canBringOwnApp,
+        manualEntrySupported,
         missingVariables,
         isReady,
         isLoading: personalEnv.isLoading || grantStatus.isLoading,
@@ -143,7 +151,7 @@ export function useMcpServerCredentials(org, mcpServer) {
         saveCredentials,
         isSaving: personalEnv.isMutating,
         refetch,
-        manualOverride,
+        manualOverride: effectiveManualOverride,
         setManualOverride,
     };
 }

package/mcp-server/useMcpServerCredentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"useMcpServerCredentials.js","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerCredentials.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIvD,OAAO,EAAE,cAAc,EAAE,MAAM,2DAA2D,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAiK/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAkB,EAClB,SAA2B;IAE3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAsB,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,iBAAiB,GAAG,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC;IACrD,MAAM,iBAAiB,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAC;IAE1D,MAAM,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC;IACnD,MAAM,uBAAuB,GAC3B,QAAQ,KAAK,OAAO;QACpB,WAAW,EAAE,oBAAoB,KAAK,oBAAoB,CAAC,OAAO,CAAC;IACrE,MAAM,uBAAuB,GAC3B,QAAQ,KAAK,OAAO;QACpB,CAAC,WAAW,EAAE,oBAAoB,KAAK,oBAAoB,CAAC,OAAO;YACjE,WAAW,EAAE,oBAAoB,KAAK,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,qBAAqB,GAAG,WAAW,EAAE,qBAAqB,IAAI,IAAI,CAAC;IAEzE,MAAM,oBAAoB,GACxB,WAAW,EAAE,oBAAoB;QACjC,cAAc,CAAC,4BAA4B,CAAC;IAC9C,MAAM,aAAa,GACjB,oBAAoB,KAAK,cAAc,CAAC,6BAA6B,CAAC;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,cAAc,GAClB,QAAQ,KAAK,OAAO,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC;IAE3D,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAC/D,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAClC,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC;IAEvE,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EACrE,CAAC,WAAW,CAAC,WAAW,CAAC,CAC1B,CAAC;IAEF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;QAC5C,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE7E,OAAO,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CACvC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAE9B,MAAM,eAAe,GAAG,OAAO,CAC7B,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACpD,CAAC,mBAAmB,CAAC,CACtB,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,IAAI,CAAC,iBAAiB,IAAI,cAAc;YAAE,OAAO,eAAe,CAAC;QACjE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IACpE,CAAC,EAAE,CAAC,eAAe,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;IAEzD,MAAM,OAAO,GACX,CAAC,WAAW,CAAC,SAAS;QACtB,CAAC,WAAW,CAAC,SAAS;QACtB,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,IAAI,gBAAgB,CAAC,CAAC;IAEhE,MAAM,eAAe,GAAG,WAAW,CACjC,KAAK,EAAE,MAAmC,EAAiB,EAAE;QAC3D,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,WAAW,CAAC,OAAO,EAAE,CAAC;QACtB,WAAW,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAE/B,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;QAC9C,aAAa,EAAE,gBAAgB;QAC/B,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,iBAAiB;QACjB,uBAAuB;QACvB,uBAAuB;QACvB,qBAAqB;QACrB,oBAAoB;QACpB,aAAa;QACb,cAAc;QACd,gBAAgB;QAChB,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS;QACzD,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK;QAC7C,eAAe;QACf,QAAQ,EAAE,WAAW,CAAC,UAAU;QAChC,OAAO;QACP,cAAc;QACd,iBAAiB;KAClB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useMcpServerCredentials.js","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerCredentials.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIvD,OAAO,EAAE,cAAc,EAAE,MAAM,2DAA2D,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AA6K/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAkB,EAClB,SAA2B;IAE3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAsB,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,iBAAiB,GAAG,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC;IACrD,MAAM,iBAAiB,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAC;IAE1D,2EAA2E;IAC3E,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;IAC9C,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,uBAAuB,GAAG,cAAc,IAAI,oBAAoB,CAAC;IAEvE,MAAM,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC;IACnD,MAAM,uBAAuB,GAC3B,QAAQ,KAAK,OAAO;QACpB,WAAW,EAAE,oBAAoB,KAAK,oBAAoB,CAAC,OAAO,CAAC;IACrE,MAAM,uBAAuB,GAC3B,QAAQ,KAAK,OAAO;QACpB,CAAC,WAAW,EAAE,oBAAoB,KAAK,oBAAoB,CAAC,OAAO;YACjE,WAAW,EAAE,oBAAoB,KAAK,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,qBAAqB,GAAG,WAAW,EAAE,qBAAqB,IAAI,IAAI,CAAC;IAEzE,MAAM,oBAAoB,GACxB,WAAW,EAAE,oBAAoB;QACjC,cAAc,CAAC,4BAA4B,CAAC;IAC9C,MAAM,aAAa,GACjB,oBAAoB,KAAK,cAAc,CAAC,6BAA6B,CAAC;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,cAAc,GAClB,QAAQ,KAAK,OAAO,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC;IAE3D,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAC/D,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAClC,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC;IAEvE,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EACrE,CAAC,WAAW,CAAC,WAAW,CAAC,CAC1B,CAAC;IAEF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;QAC5C,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE7E,OAAO,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CACvC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAE9B,MAAM,eAAe,GAAG,OAAO,CAC7B,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACpD,CAAC,mBAAmB,CAAC,CACtB,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,IAAI,CAAC,iBAAiB,IAAI,uBAAuB;YAAE,OAAO,eAAe,CAAC;QAC1E,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IACpE,CAAC,EAAE,CAAC,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GACX,CAAC,WAAW,CAAC,SAAS;QACtB,CAAC,WAAW,CAAC,SAAS;QACtB,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,QAAQ,KAAK,QAAQ,IAAI,uBAAuB,IAAI,gBAAgB,CAAC,CAAC;IAEzE,MAAM,eAAe,GAAG,WAAW,CACjC,KAAK,EAAE,MAAmC,EAAiB,EAAE;QAC3D,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,WAAW,CAAC,OAAO,EAAE,CAAC;QACtB,WAAW,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAE/B,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;QAC9C,aAAa,EAAE,gBAAgB;QAC/B,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,iBAAiB;QACjB,uBAAuB;QACvB,uBAAuB;QACvB,qBAAqB;QACrB,oBAAoB;QACpB,aAAa;QACb,cAAc;QACd,oBAAoB;QACpB,gBAAgB;QAChB,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS;QACzD,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK;QAC7C,eAAe;QACf,QAAQ,EAAE,WAAW,CAAC,UAAU;QAChC,OAAO;QACP,cAAc,EAAE,uBAAuB;QACvC,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/react",
-  "version": "3.1.6",
+  "version": "3.1.7",
   "description": "React provider and client hook for the Stigmer platform SDK",
   "license": "Apache-2.0",
   "type": "module",
@@ -37,7 +37,7 @@
   "dependencies": {
     "@bufbuild/protovalidate": "^1.1.1",
     "@dagrejs/dagre": "^1.1.4",
-    "@stigmer/theme": "3.1.6",
+    "@stigmer/theme": "3.1.7",
     "diff": "^8.0.3",
     "fflate": "^0.8.2",
     "hast-util-to-jsx-runtime": "^2.3.6",
@@ -60,8 +60,8 @@
     "@codemirror/state": "^6.0.0",
     "@codemirror/view": "^6.0.0",
     "@lezer/highlight": "^1.0.0",
-    "@stigmer/protos": "3.1.6",
-    "@stigmer/sdk": "3.1.6",
+    "@stigmer/protos": "3.1.7",
+    "@stigmer/sdk": "3.1.7",
     "@tanstack/react-table": "^8.20.0",
     "@xyflow/react": "^12.0.0",
     "elkjs": "^0.9.0",

package/src/mcp-server/McpServerConnectDialog.tsx

@@ -11,6 +11,8 @@ import { useMcpServerConnect } from "./useMcpServerConnect.js";
 import { useDisconnectOAuth } from "./useDisconnectOAuth.js";
 import { EnvVarForm } from "../environment/EnvVarForm.js";
 import { ErrorMessage } from "../error/ErrorMessage.js";
+import { StdioSandboxNotice } from "./StdioSandboxNotice.js";
+import { OAuthRequiredNotice } from "./OAuthRequiredNotice.js";
 
 /** Props for {@link McpServerConnectDialog}. */
 export interface McpServerConnectDialogProps {
@@ -276,6 +278,9 @@ function ConnectDialogContent({
         </p>
       )}
 
+      <StdioSandboxNotice serverType={mcpServer.spec?.serverType} className="mb-4" />
+      <OAuthRequiredNotice oauthOnly={mcpServer.spec?.auth?.oauthOnly} className="mb-4" />
+
       {activeError && (
         <div className="mb-4">
           <ErrorMessage
@@ -295,7 +300,11 @@ function ConnectDialogContent({
           phase={oauth.phase}
           onSignIn={handleOAuthSignIn}
           isVendorApprovalBlocked={creds.isVendorApprovalBlocked}
-          onSwitchToManual={() => creds.setManualOverride(true)}
+          onSwitchToManual={
+            creds.manualEntrySupported
+              ? () => creds.setManualOverride(true)
+              : undefined
+          }
           disabled={isConnectingPhase}
         />
       )}
@@ -408,7 +417,8 @@ function OAuthSection({
   readonly phase: OAuthConnectPhase;
   readonly onSignIn: () => void;
   readonly isVendorApprovalBlocked: boolean;
-  readonly onSwitchToManual: () => void;
+  /** When omitted (e.g. `oauth_only` servers), no manual-entry link is shown. */
+  readonly onSwitchToManual?: () => void;
   readonly disabled?: boolean;
 }) {
   if (isConnected) {
@@ -445,19 +455,21 @@ function OAuthSection({
         {isInProgress && <LoadingSpinner size="sm" />}
         {isInProgress ? (phaseLabel[phase] ?? "Connecting...") : "Sign in with OAuth"}
       </button>
-      {isVendorApprovalBlocked && (
+      {isVendorApprovalBlocked && onSwitchToManual && (
         <p className="text-xs text-muted-foreground">
           OAuth sign-in is pending vendor approval. You can enter your token manually instead.
         </p>
       )}
-      <button
-        type="button"
-        onClick={onSwitchToManual}
-        disabled={disabled || isInProgress}
-        className="text-xs text-muted-foreground underline hover:text-foreground"
-      >
-        Enter token manually
-      </button>
+      {onSwitchToManual && (
+        <button
+          type="button"
+          onClick={onSwitchToManual}
+          disabled={disabled || isInProgress}
+          className="text-xs text-muted-foreground underline hover:text-foreground"
+        >
+          Enter token manually
+        </button>
+      )}
     </div>
   );
 }

package/src/mcp-server/McpServerDetailView.tsx

@@ -20,6 +20,8 @@ import { useMcpServerConnect } from "./useMcpServerConnect.js";
 import { useMcpServerCredentials } from "./useMcpServerCredentials.js";
 import { useMcpServerOAuthConnect } from "./useMcpServerOAuthConnect.js";
 import type { OAuthConnectPhase } from "./useMcpServerOAuthConnect.js";
+import { StdioSandboxNotice } from "./StdioSandboxNotice.js";
+import { OAuthRequiredNotice } from "./OAuthRequiredNotice.js";
 import { useDisconnectOAuth } from "./useDisconnectOAuth.js";
 import { useOrgOAuthApp } from "./useOrgOAuthApp.js";
 import { OAuthAppForm } from "./OAuthAppForm.js";
@@ -488,7 +490,10 @@ export function McpServerDetailView({
       )}
 
       <Section title="Connection">
+        <StdioSandboxNotice serverType={spec?.serverType} className="mb-3" />
+        <OAuthRequiredNotice oauthOnly={spec?.auth?.oauthOnly} className="mb-3" />
         <ConnectBar
+          manualEntrySupported={credentials.manualEntrySupported}
           isConnecting={connection.isConnecting || oauth.isInProgress}
           connectionError={combinedError}
           onConnect={handleConnectClick}
@@ -709,6 +714,7 @@ function ConnectBar({
   isRemovingOrgApp,
   removeOrgAppError,
   onClearRemoveOrgAppError,
+  manualEntrySupported,
   manualOverride,
   onManualOverride,
   onBackToOAuth,
@@ -742,6 +748,8 @@ function ConnectBar({
   readonly isRemovingOrgApp: boolean;
   readonly removeOrgAppError: Error | null;
   readonly onClearRemoveOrgAppError: () => void;
+  /** `false` for `oauth_only` servers — the manual-entry link is suppressed. */
+  readonly manualEntrySupported: boolean;
   readonly manualOverride: boolean;
   readonly onManualOverride: () => void;
   readonly onBackToOAuth: () => void;
@@ -1047,8 +1055,11 @@ function ConnectBar({
         </div>
       )}
 
-      {/* Secondary actions: manual entry, BYOA, back to OAuth */}
-      {authMode === "oauth" && !isOAuthConnected && !isOAuthBusy && !isConnecting && (
+      {/* Secondary actions: manual entry, BYOA, back to OAuth. Suppressed
+          entirely for oauth_only servers with no BYOA option, so no empty
+          action bar renders. */}
+      {authMode === "oauth" && !isOAuthConnected && !isOAuthBusy && !isConnecting &&
+        (manualOverride || manualEntrySupported || canBringOwnApp) && (
         <div className="flex items-center gap-3 border-t border-border px-3 py-1.5">
           {manualOverride ? (
             <button
@@ -1060,13 +1071,15 @@ function ConnectBar({
             </button>
           ) : (
             <>
-              <button
-                type="button"
-                onClick={onManualOverride}
-                className="text-[11px] text-muted-foreground underline decoration-muted-foreground/40 underline-offset-2 hover:text-foreground hover:decoration-foreground"
-              >
-                Enter token manually
-              </button>
+              {manualEntrySupported && (
+                <button
+                  type="button"
+                  onClick={onManualOverride}
+                  className="text-[11px] text-muted-foreground underline decoration-muted-foreground/40 underline-offset-2 hover:text-foreground hover:decoration-foreground"
+                >
+                  Enter token manually
+                </button>
+              )}
               {canBringOwnApp && !isVendorApprovalBlocked && (
                 <button
                   type="button"

package/src/mcp-server/McpServerPicker.tsx

@@ -404,6 +404,8 @@ export function McpServerPicker({
     const auth = entry.mcpServer.spec?.auth;
     const oauthTargetEnvVar = auth?.targetEnvVar || null;
     const hasOAuth = !!auth;
+    // oauth_only endpoints reject static tokens — never offer manual entry.
+    const manualEntrySupported = !auth?.oauthOnly;
     const isManualOverride = manualOverrideKeys.has(view.serverKey);
 
     const entryMissingVars =
@@ -454,15 +456,16 @@ export function McpServerPicker({
           }
         : undefined;
 
-    const handleSwitchToManual = hasOAuth
-      ? () => {
-          setManualOverrideKeys((prev) => {
-            const next = new Set(prev);
-            next.add(view.serverKey);
-            return next;
-          });
-        }
-      : undefined;
+    const handleSwitchToManual =
+      hasOAuth && manualEntrySupported
+        ? () => {
+            setManualOverrideKeys((prev) => {
+              const next = new Set(prev);
+              next.add(view.serverKey);
+              return next;
+            });
+          }
+        : undefined;
 
     const handleSwitchToOAuth =
       hasOAuth && isManualOverride

package/src/mcp-server/OAuthRequiredNotice.tsx

@@ -0,0 +1,77 @@
+"use client";
+
+import { cn } from "@stigmer/theme";
+
+/** Props for {@link OAuthRequiredNotice}. */
+export interface OAuthRequiredNoticeProps {
+  /**
+   * The server's `spec.auth.oauth_only` flag. When `true`, the endpoint
+   * rejects manually-entered static tokens and OAuth is the only path.
+   */
+  readonly oauthOnly: boolean | undefined;
+  /** Additional CSS class names for the root container. */
+  readonly className?: string;
+}
+
+/**
+ * Sets accurate expectations for connecting an **OAuth-only** MCP server —
+ * one whose hosted endpoint rejects manually-entered static tokens
+ * (`spec.auth.oauth_only`, e.g. Notion, Monday).
+ *
+ * Without this notice a user might expect the (now-hidden) manual token
+ * option and wonder why only "Sign in" is offered. It explains, in one line,
+ * that OAuth is required and a pasted API token would be rejected — turning a
+ * silent constraint into a clear one (Nielsen: visibility of system status).
+ *
+ * Self-gating: renders `null` unless the server is `oauth_only`. Callers
+ * render it unconditionally next to their Connect action, mirroring
+ * {@link StdioSandboxNotice}.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. No
+ * Console-specific dependencies — safe for platform-builder embedding.
+ */
+export function OAuthRequiredNotice({
+  oauthOnly,
+  className,
+}: OAuthRequiredNoticeProps) {
+  if (!oauthOnly) return null;
+
+  return (
+    <div
+      role="status"
+      className={cn(
+        "bg-muted-subtle text-muted-foreground flex items-start gap-2.5 rounded-lg border border-transparent px-4 py-3",
+        className,
+      )}
+    >
+      <KeyIcon className="mt-0.5 size-4 shrink-0" />
+      <p className="text-xs leading-relaxed">
+        This server requires OAuth. Sign in to connect — its hosted endpoint
+        rejects manually-entered API tokens, so a pasted token won&apos;t work
+        here.
+      </p>
+    </div>
+  );
+}
+
+function KeyIcon({ className }: { className?: string }) {
+  return (
+    <svg
+      width="16"
+      height="16"
+      viewBox="0 0 16 16"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.5"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      className={className}
+      aria-hidden="true"
+    >
+      <circle cx="5" cy="11" r="2.5" />
+      <path d="M6.8 9.2 13 3" />
+      <path d="M11 5l1.5 1.5" />
+      <path d="M9 7l1.5 1.5" />
+    </svg>
+  );
+}

package/src/mcp-server/StdioSandboxNotice.tsx

@@ -0,0 +1,98 @@
+"use client";
+
+import { cn } from "@stigmer/theme";
+import type { DeploymentMode } from "@stigmer/sdk";
+import type { McpServerSpec } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { useDeploymentMode } from "../deployment-mode.js";
+
+/** The `server_type` oneof discriminator from an MCP server's spec. */
+type McpServerType = McpServerSpec["serverType"];
+
+/**
+ * Whether an MCP server's transport is stdio while connected to Stigmer Cloud.
+ *
+ * stdio servers run as a subprocess inside an isolated Daytona sandbox in the
+ * cloud — not on the user's own computer. This predicate identifies exactly
+ * that combination so the connect UI can set accurate expectations. HTTP
+ * servers and any transport in local mode return `false`.
+ *
+ * Pure and framework-free so it can be unit-tested without rendering.
+ */
+export function isStdioInCloud(
+  mode: DeploymentMode,
+  serverType: McpServerType | undefined,
+): boolean {
+  return mode === "cloud" && serverType?.case === "stdio";
+}
+
+/** Props for {@link StdioSandboxNotice}. */
+export interface StdioSandboxNoticeProps {
+  /** The MCP server's `spec.serverType` oneof. */
+  readonly serverType: McpServerType | undefined;
+  /** Additional CSS class names for the root container. */
+  readonly className?: string;
+}
+
+/**
+ * Sets accurate expectations for connecting an **stdio** MCP server from
+ * **Stigmer Cloud**.
+ *
+ * stdio servers are a supported cloud capability — Stigmer runs them in an
+ * isolated Daytona sandbox. But that sandbox is not the user's own machine,
+ * so a server that expects access to local files, applications, or a private
+ * network (e.g. a filesystem server) won't behave as the user intends. This
+ * notice explains that up front; Connect itself stays enabled because
+ * self-contained servers work fine.
+ *
+ * Self-gating: reads the deployment mode from context and renders `null`
+ * unless the server is stdio and the backend is cloud. Callers render it
+ * unconditionally next to their Connect action.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. No
+ * Console-specific dependencies — safe for platform-builder embedding.
+ */
+export function StdioSandboxNotice({
+  serverType,
+  className,
+}: StdioSandboxNoticeProps) {
+  const mode = useDeploymentMode();
+  if (!isStdioInCloud(mode, serverType)) return null;
+
+  return (
+    <div
+      role="status"
+      className={cn(
+        "bg-muted-subtle text-muted-foreground flex items-start gap-2.5 rounded-lg border border-transparent px-4 py-3",
+        className,
+      )}
+    >
+      <SandboxIcon className="mt-0.5 size-4 shrink-0" />
+      <p className="text-xs leading-relaxed">
+        This stdio server runs in an isolated cloud sandbox, not on your own
+        computer. Tools that need access to your local files, applications, or
+        private network won&apos;t be available here.
+      </p>
+    </div>
+  );
+}
+
+function SandboxIcon({ className }: { className?: string }) {
+  return (
+    <svg
+      width="16"
+      height="16"
+      viewBox="0 0 16 16"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.5"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      className={className}
+      aria-hidden="true"
+    >
+      <path d="M2 5.5 8 2.5l6 3-6 3-6-3Z" />
+      <path d="M2 5.5v5l6 3 6-3v-5" />
+      <path d="M8 8.5v5" />
+    </svg>
+  );
+}

package/src/mcp-server/__tests__/OAuthRequiredNotice.test.tsx

@@ -0,0 +1,25 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { render, screen, cleanup } from "@testing-library/react";
+import { OAuthRequiredNotice } from "../OAuthRequiredNotice";
+
+afterEach(cleanup);
+
+describe("OAuthRequiredNotice", () => {
+  it("renders the OAuth-required caveat when oauth_only is true", () => {
+    render(<OAuthRequiredNotice oauthOnly={true} />);
+    expect(screen.getByRole("status")).toBeTruthy();
+    expect(screen.getByText(/requires OAuth/i)).toBeTruthy();
+    // It explains why manual entry is gone, not just that OAuth is used.
+    expect(screen.getByText(/rejects manually-entered API tokens/i)).toBeTruthy();
+  });
+
+  it("renders nothing when oauth_only is false", () => {
+    const { container } = render(<OAuthRequiredNotice oauthOnly={false} />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it("renders nothing when oauth_only is undefined", () => {
+    const { container } = render(<OAuthRequiredNotice oauthOnly={undefined} />);
+    expect(container.firstChild).toBeNull();
+  });
+});