clay-server 2.28.0-beta.1 → 2.28.0-beta.3

package/lib/sdk-bridge.js

@@ -10,6 +10,31 @@ var { splitShellSegments, attachSkillDiscovery } = require("./sdk-skill-discover
 var { createMessageQueue } = require("./sdk-message-queue");
 var { attachMessageProcessor } = require("./sdk-message-processor");
 
+// Merge in-process MCP servers with remote (extension-bridged) MCP servers.
+// Returns the merged object, or null if no servers exist.
+function mergeMcpServers(localServers, getRemoteFn) {
+  var merged = {};
+  var hasAny = false;
+  if (localServers) {
+    var lk = Object.keys(localServers);
+    for (var i = 0; i < lk.length; i++) {
+      merged[lk[i]] = localServers[lk[i]];
+      hasAny = true;
+    }
+  }
+  if (typeof getRemoteFn === "function") {
+    var remote = getRemoteFn();
+    if (remote) {
+      var rk = Object.keys(remote);
+      for (var j = 0; j < rk.length; j++) {
+        merged[rk[j]] = remote[rk[j]];
+        hasAny = true;
+      }
+    }
+  }
+  return hasAny ? merged : null;
+}
+
 function createSDKBridge(opts) {
   var cwd = opts.cwd;
   var slug = opts.slug || "";
@@ -22,6 +47,7 @@ function createSDKBridge(opts) {
   var isMate = opts.isMate || (slug.indexOf("mate-") === 0);
   var dangerouslySkipPermissions = opts.dangerouslySkipPermissions || false;
   var mcpServers = opts.mcpServers || null;
+  var getRemoteMcpServers = opts.getRemoteMcpServers || null;
   var onProcessingChanged = opts.onProcessingChanged || function () {};
   var onTurnDone = opts.onTurnDone || null;
 
@@ -553,7 +579,8 @@ function createSDKBridge(opts) {
       agentProgressSummaries: true,
     };
 
-    if (mcpServers) queryOptions.mcpServers = mcpServers;
+    var _mergedMcp = mergeMcpServers(mcpServers, getRemoteMcpServers);
+    if (_mergedMcp) queryOptions.mcpServers = _mergedMcp;
 
     // Per-loop settings override global defaults when present
     var ls2 = session.loopSettings || {};
@@ -930,7 +957,7 @@ function createSDKBridge(opts) {
       return;
     }
 
-    var warmupOptions = { cwd: cwd, settingSources: ["user", "project", "local"] };
+    var warmupOptions = { cwd: cwd, settingSources: ["user", "project", "local"], settings: { disableAllHooks: true } };
     if (dangerouslySkipPermissions) {
       warmupOptions.permissionMode = "bypassPermissions";
       warmupOptions.allowDangerouslySkipPermissions = true;
@@ -970,6 +997,19 @@ function createSDKBridge(opts) {
       return { behavior: "allow", updatedInput: input };
     }
 
+    // Auto-approve remote MCP tools that the user explicitly enabled in project settings.
+    // These are user-owned local MCP servers, so no additional permission prompt needed.
+    if (toolName.indexOf("mcp__") === 0 && getRemoteMcpServers) {
+      var _rmcp = getRemoteMcpServers();
+      if (_rmcp) {
+        var _mcpParts = toolName.split("__");
+        var _mcpServerName = _mcpParts.length >= 2 ? _mcpParts[1] : "";
+        if (_rmcp[_mcpServerName]) {
+          return { behavior: "allow", updatedInput: input };
+        }
+      }
+    }
+
     // Auto-approve safe Bash commands (read-only, non-destructive)
     // Applies to ALL sessions (mates and regular projects alike).
     // These are purely read-only commands that cannot modify files, install
@@ -1440,7 +1480,7 @@ function createSDKBridge(opts) {
       abortController: session.abortController,
       promptSuggestions: true,
       agentProgressSummaries: true,
-      mcpServers: mcpServers || undefined,
+      mcpServers: mergeMcpServers(mcpServers, getRemoteMcpServers) || undefined,
       canUseTool: function(toolName, input, toolOpts) {
         return handleCanUseTool(session, toolName, input, toolOpts);
       },
@@ -1617,7 +1657,7 @@ function createSDKBridge(opts) {
       var mq = createMessageQueue();
       mq.push({ type: "user", message: { role: "user", content: [{ type: "text", text: "hi" }] } });
       mq.end();
-      var warmupOptions = { cwd: cwd, settingSources: ["user", "project", "local"], abortController: ac };
+      var warmupOptions = { cwd: cwd, settingSources: ["user", "project", "local"], abortController: ac, settings: { disableAllHooks: true } };
       if (dangerouslySkipPermissions) {
         warmupOptions.permissionMode = "bypassPermissions";
         warmupOptions.allowDangerouslySkipPermissions = true;
@@ -1789,7 +1829,10 @@ function createSDKBridge(opts) {
           },
         };
       if (opts.model) mentionQueryOptions.model = opts.model;
-      if (opts.includeMcpServers && mcpServers) mentionQueryOptions.mcpServers = mcpServers;
+      if (opts.includeMcpServers) {
+        var _mentionMcp = mergeMcpServers(mcpServers, getRemoteMcpServers);
+        if (_mentionMcp) mentionQueryOptions.mcpServers = _mentionMcp;
+      }
       query = sdk.query({
         prompt: mq,
         options: mentionQueryOptions,

package/lib/server.js

@@ -144,6 +144,8 @@ function createServer(opts) {
   var onSetServerDefaultMode = opts.onSetServerDefaultMode || null;
   var onGetProjectDefaultMode = opts.onGetProjectDefaultMode || null;
   var onSetProjectDefaultMode = opts.onSetProjectDefaultMode || null;
+  var onGetProjectMcpServers = opts.onGetProjectMcpServers || null;
+  var onSetProjectMcpServers = opts.onSetProjectMcpServers || null;
   var onGetDaemonConfig = opts.onGetDaemonConfig || null;
   var onSetPin = opts.onSetPin || null;
   var onSetKeepAwake = opts.onSetKeepAwake || null;
@@ -766,6 +768,8 @@ function createServer(opts) {
         return origEmit.apply(ws, arguments);
       };
       ws._clayUser = wsUser; // attach user context
+      var remoteAddr = req.socket.remoteAddress || "";
+      ws._clayLocal = (remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1");
       // Clear cross-project unread for this project when client connects
       var unreadMap = getCrossProjectUnread(ws);
       if (unreadMap[wsSlug]) {
@@ -984,6 +988,8 @@ function createServer(opts) {
       onSetServerDefaultMode: onSetServerDefaultMode,
       onGetProjectDefaultMode: onGetProjectDefaultMode,
       onSetProjectDefaultMode: onSetProjectDefaultMode,
+      onGetProjectMcpServers: onGetProjectMcpServers,
+      onSetProjectMcpServers: onSetProjectMcpServers,
       onGetDaemonConfig: onGetDaemonConfig,
       onSetPin: onSetPin,
       onSetKeepAwake: onSetKeepAwake,

package/lib/ws-schema.js

@@ -338,6 +338,16 @@ var schema = {
   "clay_ext_result":          { direction: "s2c", handler: "lib/public/modules/app-misc.js", description: "Browser extension command result (broadcast)" },
   "clay_ext_command":         { direction: "c2s", handler: "lib/public/modules/app-misc.js", description: "Send a command to the browser extension" },
 
+  // -----------------------------------------------------------------------
+  // MCP Bridge (remote MCP servers via Chrome Extension)
+  // -----------------------------------------------------------------------
+  "mcp_servers_available":    { direction: "c2s", handler: "lib/project-mcp.js", description: "Report available MCP servers from Chrome Extension" },
+  "mcp_tool_call":            { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Forward MCP tool call to extension or HTTP endpoint" },
+  "mcp_tool_result":          { direction: "c2s", handler: "lib/project-mcp.js", description: "Return MCP tool result from extension" },
+  "mcp_tool_error":           { direction: "c2s", handler: "lib/project-mcp.js", description: "Return MCP tool error from extension" },
+  "mcp_toggle_server":        { direction: "c2s", handler: "lib/project-mcp.js", description: "Toggle MCP server enabled state for this project" },
+  "mcp_servers_state":        { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Broadcast MCP server list and enabled state to clients" },
+
   // -----------------------------------------------------------------------
   // Skills
   // -----------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.28.0-beta.1",
+  "version": "2.28.0-beta.3",
   "description": "Self-hosted Claude Code in your browser. Multi-session, multi-user, push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",