@sweny-ai/core 0.1.39 → 0.1.41

package/dist/cli/credentials.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Read env vars into the flat credential map expected by buildAutoMcpServers
+ * and buildSkillMcpServers.
+ *
+ * Several env vars have two accepted spellings — the user-facing one
+ * (`NR_API_KEY`, `JIRA_BASE_URL`, `SENTRY_BASE_URL`, …) used in init.ts,
+ * config.ts, and docs, and the canonical one used by the MCP wiring layer
+ * (`NEW_RELIC_API_KEY`, `JIRA_URL`, `SENTRY_URL`, …). We accept either
+ * spelling and write the value under the canonical key the wiring functions
+ * look up. The user-facing spelling wins on conflict (it's what docs tell
+ * users to set).
+ */
+export declare function buildCredentialMap(env?: NodeJS.ProcessEnv): Record<string, string>;

package/dist/cli/credentials.js

@@ -0,0 +1,60 @@
+/**
+ * Read env vars into the flat credential map expected by buildAutoMcpServers
+ * and buildSkillMcpServers.
+ *
+ * Several env vars have two accepted spellings — the user-facing one
+ * (`NR_API_KEY`, `JIRA_BASE_URL`, `SENTRY_BASE_URL`, …) used in init.ts,
+ * config.ts, and docs, and the canonical one used by the MCP wiring layer
+ * (`NEW_RELIC_API_KEY`, `JIRA_URL`, `SENTRY_URL`, …). We accept either
+ * spelling and write the value under the canonical key the wiring functions
+ * look up. The user-facing spelling wins on conflict (it's what docs tell
+ * users to set).
+ */
+export function buildCredentialMap(env = process.env) {
+    const creds = {};
+    // [aliases…, canonical lookup key]
+    // Earlier aliases win on conflict — first non-empty match populates the canonical key.
+    const sources = [
+        [["GITHUB_TOKEN"], "GITHUB_TOKEN"],
+        [["GITLAB_TOKEN"], "GITLAB_TOKEN"],
+        [["GITLAB_URL"], "GITLAB_URL"],
+        [["LINEAR_API_KEY"], "LINEAR_API_KEY"],
+        // User-facing JIRA_BASE_URL → canonical JIRA_URL (the key the MCP layer reads).
+        [["JIRA_BASE_URL", "JIRA_URL"], "JIRA_URL"],
+        [["JIRA_EMAIL"], "JIRA_EMAIL"],
+        [["JIRA_API_TOKEN"], "JIRA_API_TOKEN"],
+        [["DD_API_KEY"], "DD_API_KEY"],
+        [["DD_APP_KEY"], "DD_APP_KEY"],
+        [["SENTRY_AUTH_TOKEN"], "SENTRY_AUTH_TOKEN"],
+        [["SENTRY_ORG"], "SENTRY_ORG"],
+        // User-facing SENTRY_BASE_URL → canonical SENTRY_URL.
+        [["SENTRY_BASE_URL", "SENTRY_URL"], "SENTRY_URL"],
+        // User-facing NR_* → canonical NEW_RELIC_*.
+        [["NR_API_KEY", "NEW_RELIC_API_KEY"], "NEW_RELIC_API_KEY"],
+        [["NR_REGION", "NEW_RELIC_REGION"], "NEW_RELIC_REGION"],
+        [["BETTERSTACK_API_TOKEN"], "BETTERSTACK_API_TOKEN"],
+        [["BETTERSTACK_TELEMETRY_TOKEN"], "BETTERSTACK_TELEMETRY_TOKEN"],
+        [["BETTERSTACK_UPTIME_TOKEN"], "BETTERSTACK_UPTIME_TOKEN"],
+        [["BETTERSTACK_SOURCE_ID"], "BETTERSTACK_SOURCE_ID"],
+        [["BETTERSTACK_TABLE_NAME"], "BETTERSTACK_TABLE_NAME"],
+        [["SLACK_BOT_TOKEN"], "SLACK_BOT_TOKEN"],
+        [["SLACK_TEAM_ID"], "SLACK_TEAM_ID"],
+        // mcp.ts accepts either NOTION_TOKEN or NOTION_API_KEY — populate both
+        // canonical keys so either env-var name reaches the wiring layer.
+        [["NOTION_TOKEN"], "NOTION_TOKEN"],
+        [["NOTION_API_KEY"], "NOTION_API_KEY"],
+        [["PAGERDUTY_API_TOKEN"], "PAGERDUTY_API_TOKEN"],
+        [["MONDAY_TOKEN"], "MONDAY_TOKEN"],
+        [["ASANA_ACCESS_TOKEN"], "ASANA_ACCESS_TOKEN"],
+    ];
+    for (const [aliases, canonical] of sources) {
+        for (const alias of aliases) {
+            const v = env[alias];
+            if (v) {
+                creds[canonical] = v;
+                break;
+            }
+        }
+    }
+    return creds;
+}

package/dist/cli/credentials.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/credentials.test.js

@@ -0,0 +1,172 @@
+import { describe, it, expect } from "vitest";
+import { buildCredentialMap } from "./credentials.js";
+import { buildSkillMcpServers } from "../mcp.js";
+// ─────────────────────────────────────────────────────────────────────
+// Integration tests: env vars → buildCredentialMap → buildSkillMcpServers
+// ─────────────────────────────────────────────────────────────────────
+//
+// These tests catch env-var name drift between:
+//   - the user-facing env var name (what docs / init.ts / config.ts read)
+//   - the canonical key the MCP wiring functions look up
+//
+// Unit tests in mcp.test.ts inject the credentials map directly. That
+// validates each MCP wiring path but cannot catch a buildCredentialMap
+// that puts the value under the wrong key. THESE tests close that gap
+// by going through the real env-var → canonical-key translation.
+//
+// If a future contributor renames an env var and forgets to update both
+// sides, one of these will fail loudly.
+describe("buildCredentialMap ↔ buildSkillMcpServers integration", () => {
+    // ── New Relic: NR_API_KEY user-facing → NEW_RELIC_API_KEY canonical ──
+    it("user setting NR_API_KEY auto-wires the New Relic MCP", () => {
+        const creds = buildCredentialMap({ NR_API_KEY: "NRAK-abc" });
+        expect(creds.NEW_RELIC_API_KEY).toBe("NRAK-abc");
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["newrelic"]),
+            credentials: creds,
+        });
+        expect(mcps.newrelic).toBeDefined();
+        expect(mcps.newrelic?.url).toBe("https://mcp.newrelic.com/mcp/");
+    });
+    it("user setting NR_REGION=eu picks the EU New Relic endpoint", () => {
+        const creds = buildCredentialMap({ NR_API_KEY: "NRAK-abc", NR_REGION: "eu" });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["newrelic"]),
+            credentials: creds,
+        });
+        expect(mcps.newrelic?.url).toBe("https://mcp.eu.newrelic.com/mcp/");
+    });
+    it("user setting NEW_RELIC_API_KEY (canonical name) also works", () => {
+        const creds = buildCredentialMap({ NEW_RELIC_API_KEY: "NRAK-xyz" });
+        expect(creds.NEW_RELIC_API_KEY).toBe("NRAK-xyz");
+    });
+    // ── Sentry: SENTRY_BASE_URL user-facing → SENTRY_URL canonical ──
+    it("user setting SENTRY_BASE_URL for self-hosted reaches the MCP layer", () => {
+        const creds = buildCredentialMap({
+            SENTRY_AUTH_TOKEN: "sntrys_abc",
+            SENTRY_BASE_URL: "https://sentry.acme.com",
+        });
+        expect(creds.SENTRY_URL).toBe("https://sentry.acme.com");
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: creds,
+        });
+        expect(mcps.sentry).toBeDefined();
+        expect(mcps.sentry?.env?.SENTRY_HOST).toBe("sentry.acme.com");
+    });
+    it("user setting SENTRY_URL (canonical name) also reaches MCP layer", () => {
+        const creds = buildCredentialMap({
+            SENTRY_AUTH_TOKEN: "sntrys_abc",
+            SENTRY_URL: "https://sentry.acme.com",
+        });
+        expect(creds.SENTRY_URL).toBe("https://sentry.acme.com");
+    });
+    it("default sentry.io URL does not set SENTRY_HOST", () => {
+        const creds = buildCredentialMap({ SENTRY_AUTH_TOKEN: "sntrys_abc" });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: creds,
+        });
+        expect(mcps.sentry).toBeDefined();
+        expect(mcps.sentry?.env?.SENTRY_HOST).toBeUndefined();
+    });
+    // ── Jira: JIRA_BASE_URL user-facing → JIRA_URL canonical ──
+    it("user setting JIRA_BASE_URL auto-wires the Jira MCP", () => {
+        const creds = buildCredentialMap({
+            JIRA_BASE_URL: "https://acme.atlassian.net",
+            JIRA_EMAIL: "alice@acme.com",
+            JIRA_API_TOKEN: "tok_abc",
+        });
+        expect(creds.JIRA_URL).toBe("https://acme.atlassian.net");
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["jira"]),
+            credentials: creds,
+        });
+        expect(mcps.jira).toBeDefined();
+        expect(mcps.jira?.env?.JIRA_URL).toBe("https://acme.atlassian.net");
+    });
+    it("user setting JIRA_URL (canonical name) also auto-wires Jira", () => {
+        const creds = buildCredentialMap({
+            JIRA_URL: "https://acme.atlassian.net",
+            JIRA_EMAIL: "alice@acme.com",
+            JIRA_API_TOKEN: "tok_abc",
+        });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["jira"]),
+            credentials: creds,
+        });
+        expect(mcps.jira).toBeDefined();
+    });
+    it("Jira MCP is NOT wired without all 3 creds", () => {
+        const creds = buildCredentialMap({
+            JIRA_BASE_URL: "https://acme.atlassian.net",
+            JIRA_EMAIL: "alice@acme.com",
+            // missing JIRA_API_TOKEN
+        });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["jira"]),
+            credentials: creds,
+        });
+        expect(mcps.jira).toBeUndefined();
+    });
+    // ── Notion: both env-var spellings ──
+    it("user setting NOTION_API_KEY (official Notion name) auto-wires Notion MCP", () => {
+        const creds = buildCredentialMap({ NOTION_API_KEY: "secret_abc" });
+        expect(creds.NOTION_API_KEY).toBe("secret_abc");
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["notion"]),
+            credentials: creds,
+        });
+        expect(mcps.notion).toBeDefined();
+        expect(mcps.notion?.env?.NOTION_TOKEN).toBe("secret_abc");
+    });
+    it("user setting NOTION_TOKEN auto-wires Notion MCP", () => {
+        const creds = buildCredentialMap({ NOTION_TOKEN: "secret_xyz" });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["notion"]),
+            credentials: creds,
+        });
+        expect(mcps.notion?.env?.NOTION_TOKEN).toBe("secret_xyz");
+    });
+    // ── BetterStack token fallbacks ──
+    it("user setting BETTERSTACK_API_TOKEN auto-wires BetterStack MCP", () => {
+        const creds = buildCredentialMap({ BETTERSTACK_API_TOKEN: "bs_abc" });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: creds,
+        });
+        expect(mcps.betterstack).toBeDefined();
+        expect(mcps.betterstack?.headers?.Authorization).toBe("Bearer bs_abc");
+    });
+    it("user setting BETTERSTACK_TELEMETRY_TOKEN reaches the MCP layer", () => {
+        const creds = buildCredentialMap({ BETTERSTACK_TELEMETRY_TOKEN: "bs_tel_abc" });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: creds,
+        });
+        expect(mcps.betterstack?.headers?.Authorization).toBe("Bearer bs_tel_abc");
+    });
+    // ── Happy-path: all the common providers at once ──
+    it("end-to-end: a typical SRE triage env wires every expected MCP", () => {
+        const creds = buildCredentialMap({
+            GITHUB_TOKEN: "ghp_abc",
+            LINEAR_API_KEY: "lin_abc",
+            DD_API_KEY: "dd_api",
+            DD_APP_KEY: "dd_app",
+            SLACK_BOT_TOKEN: "xoxb-abc",
+        });
+        const mcps = buildSkillMcpServers({
+            referencedSkills: new Set(["github", "linear", "datadog", "slack"]),
+            credentials: creds,
+        });
+        expect(Object.keys(mcps).sort()).toEqual(["datadog", "github", "linear", "slack"]);
+    });
+    it("returns empty creds for an empty env", () => {
+        expect(buildCredentialMap({})).toEqual({});
+    });
+    it("ignores empty-string env values (treats them as unset)", () => {
+        const creds = buildCredentialMap({ GITHUB_TOKEN: "", LINEAR_API_KEY: "lin_abc" });
+        expect(creds.GITHUB_TOKEN).toBeUndefined();
+        expect(creds.LINEAR_API_KEY).toBe("lin_abc");
+    });
+});

package/dist/cli/main.js

@@ -10,9 +10,9 @@ import { execute } from "../executor.js";
 import { triageWorkflow, implementWorkflow, seedContentWorkflow } from "../workflows/index.js";
 import { consoleLogger } from "../types.js";
 import { ClaudeClient } from "../claude.js";
-import { createSkillMap } from "../skills/index.js";
+import { createSkillMap, validateWorkflowSkills } from "../skills/index.js";
 import { configuredSkills } from "../skills/custom-loader.js";
-import { buildAutoMcpServers, buildProviderContext } from "../mcp.js";
+import { buildAutoMcpServers, buildSkillMcpServers, buildProviderContext } from "../mcp.js";
 import { loadAdditionalContext } from "../templates.js";
 import { validateWorkflow as validateWorkflowSchema } from "../schema.js";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
@@ -21,6 +21,7 @@ import { toMermaid, toMermaidBlock } from "../mermaid.js";
 import { DagRenderer } from "./renderer.js";
 import * as readline from "node:readline";
 import { loadDotenv, loadConfigFile } from "./config-file.js";
+import { buildCredentialMap } from "./credentials.js";
 import { runInit } from "./init.js";
 import { runE2eInit, runE2eRun } from "./e2e.js";
 import { registerTriageCommand, registerImplementCommand, parseCliInputs, validateInputs, validateWarnings, } from "./config.js";
@@ -100,45 +101,8 @@ program
 });
 registerSetupCommand(program);
 // ── Credential map builder ──────────────────────────────────────────
-/**
- * Read env vars into the flat credential map expected by buildAutoMcpServers.
- */
-function buildCredentialMap() {
-    const creds = {};
-    const env = process.env;
-    const keys = [
-        "GITHUB_TOKEN",
-        "GITLAB_TOKEN",
-        "GITLAB_URL",
-        "LINEAR_API_KEY",
-        "JIRA_URL",
-        "JIRA_EMAIL",
-        "JIRA_API_TOKEN",
-        "DD_API_KEY",
-        "DD_APP_KEY",
-        "SENTRY_AUTH_TOKEN",
-        "SENTRY_ORG",
-        "SENTRY_URL",
-        "NR_API_KEY",
-        "NR_REGION",
-        "BETTERSTACK_API_TOKEN",
-        "BETTERSTACK_TELEMETRY_TOKEN",
-        "BETTERSTACK_UPTIME_TOKEN",
-        "BETTERSTACK_SOURCE_ID",
-        "BETTERSTACK_TABLE_NAME",
-        "SLACK_BOT_TOKEN",
-        "SLACK_TEAM_ID",
-        "NOTION_TOKEN",
-        "PAGERDUTY_API_TOKEN",
-        "MONDAY_TOKEN",
-        "ASANA_ACCESS_TOKEN",
-    ];
-    for (const k of keys) {
-        if (env[k])
-            creds[k] = env[k];
-    }
-    return creds;
-}
+// buildCredentialMap lives in ./credentials.ts so tests can import it
+// without triggering main.ts's top-level program.parse() side effect.
 /**
  * Build the McpAutoConfig from CLI config for buildAutoMcpServers.
  */
@@ -561,8 +525,40 @@ export async function workflowRunAction(file, options) {
     const isJson = Boolean(options.json);
     const isTTY = !isJson && (process.stderr.isTTY ?? false);
     const skills = createSkillMap(configuredSkills(process.env, process.cwd()));
-    const mcpAutoConfig = buildMcpAutoConfig(config);
-    const mcpServers = buildAutoMcpServers(mcpAutoConfig);
+    // Hard-fail at startup if the workflow references skills that aren't available.
+    // Each node lists alternatives by category (e.g. [sentry, datadog, betterstack]);
+    // we require at least one configured skill per category.
+    const validation = validateWorkflowSkills(workflow, skills);
+    if (validation.errors.length > 0) {
+        console.error(chalk.red(`\n  Workflow cannot run — missing required skills:\n`));
+        for (const err of validation.errors)
+            console.error(chalk.red(`    \u2717 ${err}`));
+        if (validation.missing.length > 0) {
+            console.error(chalk.dim(`\n  Set the missing env vars and try again:`));
+            for (const m of validation.missing) {
+                if (m.missingEnv.length > 0) {
+                    console.error(chalk.dim(`    - ${m.id}: ${m.missingEnv.join(", ")}`));
+                }
+            }
+        }
+        console.error("");
+        process.exit(1);
+        return;
+    }
+    for (const warn of validation.warnings)
+        console.error(chalk.yellow(`  \u26A0 ${warn}`));
+    // Engine-driven MCP wiring: only inject MCPs for skills that the workflow
+    // actually references AND whose env vars are present.
+    const referencedSkillIds = new Set();
+    for (const node of Object.values(workflow.nodes)) {
+        for (const id of node.skills)
+            referencedSkillIds.add(id);
+    }
+    const mcpServers = buildSkillMcpServers({
+        referencedSkills: referencedSkillIds,
+        credentials: buildCredentialMap(),
+        userMcpServers: Object.keys(config.mcpServers).length > 0 ? config.mcpServers : undefined,
+    });
     const claude = new ClaudeClient({
         maxTurns: config.maxInvestigateTurns || 50,
         cwd: process.cwd(),

package/dist/mcp.d.ts

@@ -1,4 +1,27 @@
 import type { McpAutoConfig, McpServerConfig } from "./types.js";
+export interface SkillMcpOptions {
+    /** Skill IDs referenced by the workflow being executed. Only these get MCPs. */
+    referencedSkills: Set<string>;
+    /** Flat credential map (env vars). MCPs are only wired when their creds are set. */
+    credentials: Record<string, string>;
+    /** User-supplied MCP servers — always win on key conflict. */
+    userMcpServers?: Record<string, McpServerConfig>;
+}
+/**
+ * Build MCP server configs for the skills a workflow references.
+ *
+ * For each skill ID in `referencedSkills`, look up its MCP wiring (if any)
+ * and include it only when the required credentials are present in `credentials`.
+ *
+ * Skills with no MCP variant (e.g. `notification`, `supabase`) are silently
+ * skipped — their in-process tools are wired separately by the executor.
+ *
+ * Unknown skill IDs (not built-in, not in this MCP catalog) are silently
+ * skipped here; the engine's hard-fail validation handles them upstream.
+ *
+ * User-supplied servers always win on key conflict.
+ */
+export declare function buildSkillMcpServers(opts: SkillMcpOptions): Record<string, McpServerConfig>;
 /**
  * Auto-configure well-known MCP servers based on which providers
  * and workspace tools the user has enabled.

package/dist/mcp.js

@@ -1,3 +1,163 @@
+/**
+ * Build MCP server configs for the skills a workflow references.
+ *
+ * For each skill ID in `referencedSkills`, look up its MCP wiring (if any)
+ * and include it only when the required credentials are present in `credentials`.
+ *
+ * Skills with no MCP variant (e.g. `notification`, `supabase`) are silently
+ * skipped — their in-process tools are wired separately by the executor.
+ *
+ * Unknown skill IDs (not built-in, not in this MCP catalog) are silently
+ * skipped here; the engine's hard-fail validation handles them upstream.
+ *
+ * User-supplied servers always win on key conflict.
+ */
+export function buildSkillMcpServers(opts) {
+    const auto = {};
+    const refs = opts.referencedSkills;
+    const creds = opts.credentials;
+    // GitHub MCP — wired when workflow uses `github` skill and a token is set.
+    if (refs.has("github") && creds.GITHUB_TOKEN) {
+        auto["github"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-github@latest"],
+            env: { GITHUB_PERSONAL_ACCESS_TOKEN: creds.GITHUB_TOKEN },
+        };
+    }
+    // GitLab MCP.
+    if (refs.has("gitlab") && creds.GITLAB_TOKEN) {
+        const env = { GITLAB_PERSONAL_ACCESS_TOKEN: creds.GITLAB_TOKEN };
+        const baseUrl = creds.GITLAB_URL || "https://gitlab.com";
+        if (baseUrl !== "https://gitlab.com")
+            env.GITLAB_API_URL = `${baseUrl}/api/v4`;
+        auto["gitlab"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-gitlab@latest"],
+            env,
+        };
+    }
+    // Linear MCP — official remote HTTP endpoint.
+    if (refs.has("linear") && creds.LINEAR_API_KEY) {
+        auto["linear"] = {
+            type: "http",
+            url: "https://mcp.linear.app/mcp",
+            headers: { Authorization: `Bearer ${creds.LINEAR_API_KEY}` },
+        };
+    }
+    // Jira / Confluence — needs all 3 creds.
+    if (refs.has("jira") && creds.JIRA_URL && creds.JIRA_EMAIL && creds.JIRA_API_TOKEN) {
+        auto["jira"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@sooperset/mcp-atlassian@latest"],
+            env: {
+                JIRA_URL: creds.JIRA_URL,
+                JIRA_EMAIL: creds.JIRA_EMAIL,
+                JIRA_API_TOKEN: creds.JIRA_API_TOKEN,
+            },
+        };
+    }
+    // Datadog MCP.
+    if (refs.has("datadog") && creds.DD_API_KEY && creds.DD_APP_KEY) {
+        auto["datadog"] = {
+            type: "http",
+            url: "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
+            headers: { DD_API_KEY: creds.DD_API_KEY, DD_APPLICATION_KEY: creds.DD_APP_KEY },
+        };
+    }
+    // Sentry MCP — server reads SENTRY_ACCESS_TOKEN, not SENTRY_AUTH_TOKEN.
+    if (refs.has("sentry") && creds.SENTRY_AUTH_TOKEN) {
+        const env = { SENTRY_ACCESS_TOKEN: creds.SENTRY_AUTH_TOKEN };
+        const sentryUrl = creds.SENTRY_URL;
+        if (sentryUrl && sentryUrl !== "https://sentry.io") {
+            try {
+                env.SENTRY_HOST = new URL(sentryUrl).hostname;
+            }
+            catch {
+                // malformed URL — leave SENTRY_HOST unset
+            }
+        }
+        auto["sentry"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@sentry/mcp-server@latest"],
+            env,
+        };
+    }
+    // New Relic MCP — region-aware HTTP endpoint, header is "Api-Key".
+    if (refs.has("newrelic") && creds.NEW_RELIC_API_KEY) {
+        const region = creds.NEW_RELIC_REGION;
+        const url = region === "eu" ? "https://mcp.eu.newrelic.com/mcp/" : "https://mcp.newrelic.com/mcp/";
+        auto["newrelic"] = {
+            type: "http",
+            url,
+            headers: { "Api-Key": creds.NEW_RELIC_API_KEY },
+        };
+    }
+    // BetterStack MCP — accept any of the legacy/telemetry/uptime tokens.
+    const bsToken = creds.BETTERSTACK_API_TOKEN || creds.BETTERSTACK_TELEMETRY_TOKEN || creds.BETTERSTACK_UPTIME_TOKEN;
+    if (refs.has("betterstack") && bsToken) {
+        auto["betterstack"] = {
+            type: "http",
+            url: "https://mcp.betterstack.com",
+            headers: { Authorization: `Bearer ${bsToken}` },
+        };
+    }
+    // Slack MCP — wired when workflow uses `slack` skill and bot token is set.
+    if (refs.has("slack") && creds.SLACK_BOT_TOKEN) {
+        const env = { SLACK_BOT_TOKEN: creds.SLACK_BOT_TOKEN };
+        if (creds.SLACK_TEAM_ID)
+            env.SLACK_TEAM_ID = creds.SLACK_TEAM_ID;
+        auto["slack"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-slack@latest"],
+            env,
+        };
+    }
+    // Notion MCP — accept either NOTION_TOKEN or NOTION_API_KEY.
+    if (refs.has("notion")) {
+        const token = creds.NOTION_TOKEN || creds.NOTION_API_KEY;
+        if (token) {
+            auto["notion"] = {
+                type: "stdio",
+                command: "npx",
+                args: ["-y", "@notionhq/notion-mcp-server@latest"],
+                env: { NOTION_TOKEN: token },
+            };
+        }
+    }
+    // PagerDuty MCP — auth scheme is `Token token=<key>`.
+    if (refs.has("pagerduty") && creds.PAGERDUTY_API_TOKEN) {
+        auto["pagerduty"] = {
+            type: "http",
+            url: "https://mcp.pagerduty.com/mcp",
+            headers: { Authorization: `Token token=${creds.PAGERDUTY_API_TOKEN}` },
+        };
+    }
+    // Monday.com MCP.
+    if (refs.has("monday") && creds.MONDAY_TOKEN) {
+        auto["monday"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@mondaydotcomorg/monday-api-mcp@latest"],
+            env: { MONDAY_TOKEN: creds.MONDAY_TOKEN },
+        };
+    }
+    // Asana MCP.
+    if (refs.has("asana") && creds.ASANA_ACCESS_TOKEN) {
+        auto["asana"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "asana-mcp@latest"],
+            env: { ASANA_ACCESS_TOKEN: creds.ASANA_ACCESS_TOKEN },
+        };
+    }
+    // User-supplied servers always win on key conflict.
+    return { ...auto, ...(opts.userMcpServers ?? {}) };
+}
 /**
  * Auto-configure well-known MCP servers based on which providers
  * and workspace tools the user has enabled.

package/dist/mcp.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { buildAutoMcpServers } from "./mcp.js";
+import { buildAutoMcpServers, buildSkillMcpServers } from "./mcp.js";
 // ─── Helpers ─────────────────────────────────────────────────────
 function cfg(overrides = {}) {
     return { credentials: {}, ...overrides };
@@ -345,3 +345,324 @@ describe("buildAutoMcpServers", () => {
         expect(result["slack"]).toBeUndefined();
     });
 });
+// ─── buildSkillMcpServers (engine-driven) ────────────────────────────
+describe("buildSkillMcpServers", () => {
+    it("returns empty when no skills referenced and no creds present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(),
+            credentials: {},
+        });
+        expect(result).toEqual({});
+    });
+    it("does not wire MCP for a skill not referenced by the workflow", () => {
+        // Token is set, but the workflow doesn't ask for github → no MCP.
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["linear"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc", LINEAR_API_KEY: "lin_abc" },
+        });
+        expect(result["github"]).toBeUndefined();
+        expect(result["linear"]).toBeDefined();
+    });
+    it("does not wire MCP for a referenced skill whose creds are missing", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github", "linear"]),
+            credentials: { LINEAR_API_KEY: "lin_abc" }, // no GITHUB_TOKEN
+        });
+        expect(result["github"]).toBeUndefined();
+        expect(result["linear"]).toBeDefined();
+    });
+    it("wires github MCP when referenced and GITHUB_TOKEN present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+        });
+        expect(result["github"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-github@latest"],
+            env: { GITHUB_PERSONAL_ACCESS_TOKEN: "ghp_abc" },
+        });
+    });
+    it("wires linear MCP when referenced and LINEAR_API_KEY present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["linear"]),
+            credentials: { LINEAR_API_KEY: "lin_abc" },
+        });
+        expect(result["linear"]).toEqual({
+            type: "http",
+            url: "https://mcp.linear.app/mcp",
+            headers: { Authorization: "Bearer lin_abc" },
+        });
+    });
+    it("wires sentry MCP with SENTRY_HOST for self-hosted SENTRY_URL", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: { SENTRY_AUTH_TOKEN: "sntryu_abc", SENTRY_URL: "https://sentry.mycompany.com" },
+        });
+        expect(result["sentry"]?.env).toMatchObject({
+            SENTRY_ACCESS_TOKEN: "sntryu_abc",
+            SENTRY_HOST: "sentry.mycompany.com",
+        });
+    });
+    it("wires datadog MCP when both keys present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["datadog"]),
+            credentials: { DD_API_KEY: "dd_api", DD_APP_KEY: "dd_app" },
+        });
+        expect(result["datadog"]).toEqual({
+            type: "http",
+            url: "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
+            headers: { DD_API_KEY: "dd_api", DD_APPLICATION_KEY: "dd_app" },
+        });
+    });
+    it("does not wire datadog MCP when DD_APP_KEY is missing", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["datadog"]),
+            credentials: { DD_API_KEY: "dd_api" },
+        });
+        expect(result["datadog"]).toBeUndefined();
+    });
+    it("wires slack MCP without an opt-in flag — workflow reference is the opt-in", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["slack"]),
+            credentials: { SLACK_BOT_TOKEN: "xoxb-abc" },
+        });
+        expect(result["slack"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-slack@latest"],
+            env: { SLACK_BOT_TOKEN: "xoxb-abc" },
+        });
+    });
+    it("wires betterstack MCP only when the workflow references betterstack", () => {
+        // Token alone is not enough — must be referenced.
+        const noRef = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: { BETTERSTACK_API_TOKEN: "bs_abc", SENTRY_AUTH_TOKEN: "sntry_x" },
+        });
+        expect(noRef["betterstack"]).toBeUndefined();
+        const withRef = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: { BETTERSTACK_API_TOKEN: "bs_abc" },
+        });
+        expect(withRef["betterstack"]).toEqual({
+            type: "http",
+            url: "https://mcp.betterstack.com",
+            headers: { Authorization: "Bearer bs_abc" },
+        });
+    });
+    it("user-supplied MCP servers win on key conflict", () => {
+        const custom = { type: "stdio", command: "my-github", args: [] };
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+            userMcpServers: { github: custom },
+        });
+        expect(result["github"]).toEqual(custom);
+    });
+    it("user-supplied servers can add MCPs alongside auto-wired ones", () => {
+        const my = { type: "http", url: "https://my.example.com" };
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+            userMcpServers: { "my-tool": my },
+        });
+        expect(result["github"]).toBeDefined();
+        expect(result["my-tool"]).toEqual(my);
+    });
+    it("silently skips skill IDs with no MCP catalog entry (e.g. notification)", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["notification", "supabase", "github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+        });
+        expect(result["notification"]).toBeUndefined();
+        expect(result["supabase"]).toBeUndefined();
+        expect(result["github"]).toBeDefined();
+    });
+    it("wires multiple skills simultaneously", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github", "linear", "datadog", "slack"]),
+            credentials: {
+                GITHUB_TOKEN: "ghp_abc",
+                LINEAR_API_KEY: "lin_abc",
+                DD_API_KEY: "dd_api",
+                DD_APP_KEY: "dd_app",
+                SLACK_BOT_TOKEN: "xoxb-abc",
+            },
+        });
+        expect(result["github"]).toBeDefined();
+        expect(result["linear"]).toBeDefined();
+        expect(result["datadog"]).toBeDefined();
+        expect(result["slack"]).toBeDefined();
+    });
+    // ── GitLab ─────────────────────────────────────────────────────────
+    it("wires gitlab MCP when referenced and GITLAB_TOKEN present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["gitlab"]),
+            credentials: { GITLAB_TOKEN: "glpat_abc" },
+        });
+        expect(result["gitlab"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-gitlab@latest"],
+            env: { GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_abc" },
+        });
+    });
+    it("wires gitlab MCP with self-hosted GITLAB_API_URL", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["gitlab"]),
+            credentials: { GITLAB_TOKEN: "glpat_abc", GITLAB_URL: "https://gitlab.example.com" },
+        });
+        expect(result["gitlab"]?.env).toEqual({
+            GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_abc",
+            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
+        });
+    });
+    // ── Jira ───────────────────────────────────────────────────────────
+    it("wires jira MCP when all 3 creds present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["jira"]),
+            credentials: {
+                JIRA_URL: "https://acme.atlassian.net",
+                JIRA_EMAIL: "alice@acme.com",
+                JIRA_API_TOKEN: "tok_abc",
+            },
+        });
+        expect(result["jira"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@sooperset/mcp-atlassian@latest"],
+            env: {
+                JIRA_URL: "https://acme.atlassian.net",
+                JIRA_EMAIL: "alice@acme.com",
+                JIRA_API_TOKEN: "tok_abc",
+            },
+        });
+    });
+    it("does NOT wire jira MCP when JIRA_EMAIL is missing", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["jira"]),
+            credentials: { JIRA_URL: "https://acme.atlassian.net", JIRA_API_TOKEN: "tok_abc" },
+        });
+        expect(result["jira"]).toBeUndefined();
+    });
+    // ── New Relic ──────────────────────────────────────────────────────
+    it("wires newrelic MCP with US (default) endpoint", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["newrelic"]),
+            credentials: { NEW_RELIC_API_KEY: "NRAK-abc" },
+        });
+        expect(result["newrelic"]).toEqual({
+            type: "http",
+            url: "https://mcp.newrelic.com/mcp/",
+            headers: { "Api-Key": "NRAK-abc" },
+        });
+    });
+    it("wires newrelic MCP with EU endpoint when NEW_RELIC_REGION=eu", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["newrelic"]),
+            credentials: { NEW_RELIC_API_KEY: "NRAK-abc", NEW_RELIC_REGION: "eu" },
+        });
+        expect(result["newrelic"]?.url).toBe("https://mcp.eu.newrelic.com/mcp/");
+    });
+    it("does NOT wire newrelic MCP without NEW_RELIC_API_KEY", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["newrelic"]),
+            credentials: { NEW_RELIC_REGION: "eu" },
+        });
+        expect(result["newrelic"]).toBeUndefined();
+    });
+    // ── Notion (both env-var spellings) ────────────────────────────────
+    it("wires notion MCP with NOTION_TOKEN", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["notion"]),
+            credentials: { NOTION_TOKEN: "secret_abc" },
+        });
+        expect(result["notion"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@notionhq/notion-mcp-server@latest"],
+            env: { NOTION_TOKEN: "secret_abc" },
+        });
+    });
+    it("wires notion MCP with NOTION_API_KEY fallback", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["notion"]),
+            credentials: { NOTION_API_KEY: "secret_xyz" },
+        });
+        expect(result["notion"]?.env?.NOTION_TOKEN).toBe("secret_xyz");
+    });
+    it("prefers NOTION_TOKEN over NOTION_API_KEY when both set", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["notion"]),
+            credentials: { NOTION_TOKEN: "primary", NOTION_API_KEY: "fallback" },
+        });
+        expect(result["notion"]?.env?.NOTION_TOKEN).toBe("primary");
+    });
+    // ── PagerDuty / Monday / Asana ─────────────────────────────────────
+    it("wires pagerduty MCP with Token-token auth scheme", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["pagerduty"]),
+            credentials: { PAGERDUTY_API_TOKEN: "pd_abc" },
+        });
+        expect(result["pagerduty"]).toEqual({
+            type: "http",
+            url: "https://mcp.pagerduty.com/mcp",
+            headers: { Authorization: "Token token=pd_abc" },
+        });
+    });
+    it("wires monday MCP", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["monday"]),
+            credentials: { MONDAY_TOKEN: "mon_abc" },
+        });
+        expect(result["monday"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@mondaydotcomorg/monday-api-mcp@latest"],
+            env: { MONDAY_TOKEN: "mon_abc" },
+        });
+    });
+    it("wires asana MCP", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["asana"]),
+            credentials: { ASANA_ACCESS_TOKEN: "asana_abc" },
+        });
+        expect(result["asana"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "asana-mcp@latest"],
+            env: { ASANA_ACCESS_TOKEN: "asana_abc" },
+        });
+    });
+    // ── BetterStack token fallback ─────────────────────────────────────
+    it("wires betterstack with BETTERSTACK_TELEMETRY_TOKEN fallback", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: { BETTERSTACK_TELEMETRY_TOKEN: "bs_tel_abc" },
+        });
+        expect(result["betterstack"]).toEqual({
+            type: "http",
+            url: "https://mcp.betterstack.com",
+            headers: { Authorization: "Bearer bs_tel_abc" },
+        });
+    });
+    it("wires betterstack with BETTERSTACK_UPTIME_TOKEN fallback", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: { BETTERSTACK_UPTIME_TOKEN: "bs_up_abc" },
+        });
+        expect(result["betterstack"]?.headers?.Authorization).toBe("Bearer bs_up_abc");
+    });
+    it("prefers BETTERSTACK_API_TOKEN over telemetry/uptime fallbacks", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: {
+                BETTERSTACK_API_TOKEN: "primary",
+                BETTERSTACK_TELEMETRY_TOKEN: "fallback1",
+                BETTERSTACK_UPTIME_TOKEN: "fallback2",
+            },
+        });
+        expect(result["betterstack"]?.headers?.Authorization).toBe("Bearer primary");
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"