coding-tool-x 3.8.3 → 3.8.5

package/src/server/services/mcp-service.js

@@ -6,31 +6,18 @@
 
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
-const toml = require('@iarna/toml');
 const { spawn } = require('child_process');
 const { McpClient, buildMissingCommandMessage, createMissingCommandHint } = require('./mcp-client');
-const { NATIVE_PATHS, PATHS } = require('../../config/paths');
-const { resolvePreferredHomeDir } = require('../../utils/home-dir');
-
-const HOME_DIR = resolvePreferredHomeDir(process.platform, process.env, os.homedir());
-
-// MCP 配置文件路径
+const mcpFormat = require('../../shared/mcp-format');
+const { convertToOmpMcpFormat, convertFromOmpMcpFormat } = mcpFormat;
+const { PATHS } = require('../../config/paths');
+const { ControlManifestStore } = require('./control-manifest-store');
+const { EffectiveControlService, deriveMcpPolicy } = require('./effective-control-service');
+const { validateMcpId, mergeMcpPatch, redactSecrets } = require('../../shared/project-config');
+
+// MCP central storage path. Native paths and serialization belong to Drivers.
 const MCP_SERVERS_FILE = PATHS.mcpServers;
 
-// 各平台配置文件路径
-const CLAUDE_CONFIG_PATH = NATIVE_PATHS.claude.mcp || path.join(HOME_DIR, '.claude.json');
-const CODEX_CONFIG_PATH = NATIVE_PATHS.codex.config;
-const GEMINI_CONFIG_PATH = path.join(path.dirname(NATIVE_PATHS.gemini.env), 'settings.json');
-const OPENCODE_CONFIG_DIR = NATIVE_PATHS.opencode.config;
-const OPENCODE_CONFIG_PATHS = {
-  jsonc: path.join(OPENCODE_CONFIG_DIR, 'opencode.jsonc'),
-  json: path.join(OPENCODE_CONFIG_DIR, 'opencode.json'),
-  legacy: path.join(OPENCODE_CONFIG_DIR, 'config.json')
-};
-const OMP_MCP_CONFIG_PATH = NATIVE_PATHS.omp?.mcp
-  || path.join(NATIVE_PATHS.omp?.dir || path.join(HOME_DIR, '.omp', 'agent'), 'mcp.json');
-
 // MCP 客户端连接池
 // serverId -> { client, timestamp }
 const mcpClientPool = new Map();
@@ -39,6 +26,15 @@ const STREAMABLE_HTTP_TYPE = 'streamable_http';
 const MCP_SERVER_TYPES = ['stdio', STREAMABLE_HTTP_TYPE, 'sse'];
 const REMOTE_MCP_SERVER_TYPES = [STREAMABLE_HTTP_TYPE, 'sse'];
 const MCP_PLATFORM_KEYS = ['claude', 'codex', 'gemini', 'opencode', 'omp'];
+
+const MCP_CONTROL_SERVICE = PATHS.effectiveControlManifest
+  ? new EffectiveControlService({
+    store: new ControlManifestStore({
+      userPath: PATHS.effectiveControlManifest,
+      projectPathResolver: ({ projectPath }) => path.join(projectPath, '.ctx-control.json')
+    })
+  })
+  : null;
 const OMP_MCP_SCHEMA_URL = 'https://raw.githubusercontent.com/can1357/oh-my-omp/main/packages/coding-agent/src/config/mcp-schema.json';
 const OMP_SERVER_NAME_PATTERN = /^[a-zA-Z0-9_.-]{1,100}$/;
 
@@ -51,6 +47,64 @@ function normalizeServerSpec(spec = {}) {
   return normalized;
 }
 
+function normalizePlatformKey(platform) {
+  return String(platform || '').trim().toLowerCase();
+}
+
+function getPlatformServices() {
+  const { registry, runtime } = require('../platform-context').getPlatformContext();
+  return {
+    registry,
+    runtime
+  };
+}
+
+function getMcpPlatformKeys() {
+  const { registry } = getPlatformServices();
+  const keys = [];
+  const seen = new Set();
+
+  for (const platform of registry.list()) {
+    const key = normalizePlatformKey(platform.key);
+    if (!key || seen.has(key)) continue;
+    const driverId = registry.getCapability(key, 'mcp');
+    if (!driverId || driverId === 'unsupported') continue;
+    seen.add(key);
+    keys.push(key);
+  }
+
+  return keys;
+}
+
+function createPlatformCapabilityError(platform, capability, code) {
+  const key = normalizePlatformKey(platform);
+  const error = new Error(code === 'not_found'
+    ? `无效的平台: ${key}`
+    : `平台 ${key} 未声明 ${capability} capability`);
+  error.status = 404;
+  error.code = code;
+  error.platform = key;
+  error.capability = capability;
+  return error;
+}
+
+function requireMcpCapability(platform) {
+  const key = normalizePlatformKey(platform);
+  const { registry, runtime } = getPlatformServices();
+  if (!registry.resolve(key)) {
+    throw createPlatformCapabilityError(key, 'mcp', 'not_found');
+  }
+  const driverId = registry.getCapability(key, 'mcp');
+  if (!driverId || driverId === 'unsupported') {
+    throw createPlatformCapabilityError(key, 'mcp', 'unsupported');
+  }
+  const driver = runtime.getDriver(key, 'mcp');
+  if (!driver) {
+    throw createPlatformCapabilityError(key, 'mcp', 'unsupported');
+  }
+  return { platform: key, driver };
+}
+
 // MCP 预设模板
 const MCP_PRESETS = [
   {
@@ -285,14 +339,10 @@ function readJsonFile(filePath, defaultValue = {}) {
       return JSON.parse(content);
     }
   } catch (err) {
-    console.error(`[MCP] Failed to read ${filePath}:`, err.message);
+    console.error(`[MCP] Failed to read ${filePath}:`, sanitizeMcpErrorText(err.message || err));
   }
   return defaultValue;
 }
-
-/**
- * 安全写入 JSON 文件（原子写入）
- */
 function writeJsonFile(filePath, data) {
   ensureDir(path.dirname(filePath));
   const tempPath = filePath + '.tmp';
@@ -300,138 +350,6 @@ function writeJsonFile(filePath, data) {
   fs.renameSync(tempPath, filePath);
 }
 
-/**
- * 安全读取 TOML 文件
- */
-function readTomlFile(filePath, defaultValue = {}) {
-  if (!fs.existsSync(filePath)) {
-    return defaultValue;
-  }
-
-  try {
-    const content = fs.readFileSync(filePath, 'utf-8');
-    return toml.parse(content);
-  } catch (err) {
-    throw new Error(`Failed to parse ${filePath}: ${err.message}`);
-  }
-}
-
-/**
- * 安全写入 TOML 文件（原子写入）
- */
-function writeTomlFile(filePath, data) {
-  ensureDir(path.dirname(filePath));
-  const tempPath = filePath + '.tmp';
-  fs.writeFileSync(tempPath, toml.stringify(data), 'utf-8');
-  fs.renameSync(tempPath, filePath);
-}
-
-/**
- * 去除 JSONC 注释
- */
-function stripJsonComments(input) {
-  let result = '';
-  let inString = false;
-  let quote = '';
-  let index = 0;
-
-  while (index < input.length) {
-    const ch = input[index];
-    const next = input[index + 1];
-
-    if (inString) {
-      result += ch;
-      if (ch === '\\') {
-        if (next) {
-          result += next;
-          index += 2;
-          continue;
-        }
-      } else if (ch === quote) {
-        inString = false;
-      }
-      index += 1;
-      continue;
-    }
-
-    if (ch === '"' || ch === '\'') {
-      inString = true;
-      quote = ch;
-      result += ch;
-      index += 1;
-      continue;
-    }
-
-    if (ch === '/' && next === '/') {
-      index += 2;
-      while (index < input.length && input[index] !== '\n') {
-        index += 1;
-      }
-      continue;
-    }
-
-    if (ch === '/' && next === '*') {
-      index += 2;
-      while (index < input.length - 1 && !(input[index] === '*' && input[index + 1] === '/')) {
-        index += 1;
-      }
-      index += 2;
-      continue;
-    }
-
-    result += ch;
-    index += 1;
-  }
-
-  return result;
-}
-
-/**
- * 选择 OpenCode 配置文件路径
- */
-function selectOpenCodeConfigPath() {
-  if (fs.existsSync(OPENCODE_CONFIG_PATHS.jsonc)) return OPENCODE_CONFIG_PATHS.jsonc;
-  if (fs.existsSync(OPENCODE_CONFIG_PATHS.json)) return OPENCODE_CONFIG_PATHS.json;
-  if (fs.existsSync(OPENCODE_CONFIG_PATHS.legacy)) return OPENCODE_CONFIG_PATHS.legacy;
-  return OPENCODE_CONFIG_PATHS.json;
-}
-
-/**
- * 读取 OpenCode 配置
- */
-function readOpenCodeConfig() {
-  const filePath = selectOpenCodeConfigPath();
-
-  if (!fs.existsSync(filePath)) {
-    return { path: filePath, config: {} };
-  }
-
-  try {
-    const raw = fs.readFileSync(filePath, 'utf-8');
-    if (!raw.trim()) {
-      return { path: filePath, config: {} };
-    }
-
-    const content = filePath.endsWith('.jsonc') ? stripJsonComments(raw) : raw;
-    return {
-      path: filePath,
-      config: JSON.parse(content)
-    };
-  } catch (err) {
-    console.error(`[MCP] Failed to read OpenCode config:`, err.message);
-    return { path: filePath, config: {} };
-  }
-}
-
-/**
- * 写入 OpenCode 配置（保持 JSON 格式）
- */
-function writeOpenCodeConfig(filePath, data) {
-  ensureDir(path.dirname(filePath));
-  const tempPath = filePath + '.tmp';
-  fs.writeFileSync(tempPath, JSON.stringify(data, null, 2), 'utf-8');
-  fs.renameSync(tempPath, filePath);
-}
 
 function getPathEnvKey(envObj = {}) {
   return Object.keys(envObj).find(key => key.toLowerCase() === 'path') || 'PATH';
@@ -520,10 +438,79 @@ function extractMcpHint(error) {
   return error?.data?.hint || error?.hint || null;
 }
 
+function sanitizeMcpErrorText(value) {
+  return String(value || '')
+    .replace(/(https?:\/\/[^\s?]+)\?[^\s]+/gi, '$1?[REDACTED]')
+    .replace(/(Bearer\s+)[^\s]+/gi, '$1[REDACTED]')
+    .replace(/([?&](?:token|secret|password|key)=)[^&\s]+/gi, '$1[REDACTED]')
+    .replace(/((?:token|secret|password|api[-_]?key|authorization)\s*[:=]\s*)[^,\s}]+/gi, '$1[REDACTED]');
+}
+
+const SENSITIVE_MCP_HINT_KEYS = /(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|headers?|env(?:ironment)?|envvars|experimentalenvironment|auth|oauth|credential|private[_-]?key)/i;
+
+function sanitizeMcpHint(value) {
+  if (Array.isArray(value)) {
+    const sanitized = value.map(sanitizeMcpHint);
+    return sanitized.every((item, index) => item === value[index]) ? value : sanitized;
+  }
+  if (!value || typeof value !== 'object') {
+    return typeof value === 'string' ? sanitizeCommandLineValue(value) : value;
+  }
+  let changed = false;
+  const sanitized = Object.fromEntries(Object.entries(value).map(([key, child]) => {
+    const safe = SENSITIVE_MCP_HINT_KEYS.test(key)
+      ? '[REDACTED]'
+      : sanitizeMcpHint(child);
+    if (safe !== child) changed = true;
+    return [key, safe];
+  }));
+  return changed ? sanitized : value;
+}
+
+const SENSITIVE_MCP_RESULT_KEYS = /(?:token|secret|password|authorization|api[-_]?key|access[_-]?token|credential|private[_-]?key|env(?:ironment)?|envvars|experimentalenvironment|headers?|auth|oauth)/i;
+
+const SENSITIVE_COMMAND_FLAG = /^(?:--?|\/)(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key|auth|credential|client[-_]?secret|bearer)$/i;
+
+function sanitizeCommandLineValue(value) {
+  if (Array.isArray(value)) {
+    let redactNext = false;
+    return value.map(item => {
+      if (redactNext) {
+        redactNext = false;
+        return '[REDACTED]';
+      }
+      if (typeof item !== 'string') return '[REDACTED]';
+      if (SENSITIVE_COMMAND_FLAG.test(item)) {
+        redactNext = true;
+        return item;
+      }
+      const inline = item.match(/^((?:--?|\/)(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key|auth|credential|client[-_]?secret|bearer)=).*/i);
+      if (inline) return `${inline[1]}[REDACTED]`;
+      return sanitizeMcpErrorText(item);
+    });
+  }
+  if (typeof value !== 'string') return value;
+  return sanitizeMcpErrorText(value)
+    .replace(/((?:^|\s)(?:--?|\/)(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key|auth|credential|client[-_]?secret|bearer)(?:=|\s+))\S+/gi, '$1[REDACTED]');
+}
+
+
+function sanitizeMcpToolValue(value, key = '') {
+  if (SENSITIVE_MCP_RESULT_KEYS.test(String(key))) return '[REDACTED]';
+  if (/^(?:command|args)$/i.test(key)) return sanitizeCommandLineValue(value);
+  if (typeof value === 'string') return sanitizeMcpErrorText(value);
+  if (Array.isArray(value)) return value.map(item => sanitizeMcpToolValue(item));
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [
+    childKey,
+    sanitizeMcpToolValue(childValue, childKey)
+  ]));
+}
+
 function buildMcpFailureResult(error, fallbackMessage, duration) {
-  const hint = extractMcpHint(error);
+  const hint = sanitizeMcpHint(extractMcpHint(error));
   return {
-    message: hint?.title || fallbackMessage || error?.message || '操作失败',
+    message: sanitizeMcpErrorText(hint?.title || fallbackMessage || error?.message || '操作失败'),
     hint,
     duration
   };
@@ -533,38 +520,223 @@ function buildMcpFailureResult(error, fallbackMessage, duration) {
 // MCP 数据管理
 // ============================================================================
 
-const DEFAULT_SERVER_APPS = {
-  claude: true,
-  codex: false,
-  gemini: false,
-  opencode: false,
-  omp: false
-};
+function normalizeServerApps(apps = {}, fallbackApps = { claude: true }) {
+  const source = apps && typeof apps === 'object' && !Array.isArray(apps) ? apps : {};
+  const fallback = fallbackApps && typeof fallbackApps === 'object' && !Array.isArray(fallbackApps)
+    ? fallbackApps
+    : {};
+  const platformKeys = new Set(getMcpPlatformKeys());
+  const normalized = {};
 
-function normalizeServerApps(apps = {}, fallbackApps = DEFAULT_SERVER_APPS) {
-  return {
-    claude: apps.claude !== undefined ? !!apps.claude : !!fallbackApps.claude,
-    codex: apps.codex !== undefined ? !!apps.codex : !!fallbackApps.codex,
-    gemini: apps.gemini !== undefined ? !!apps.gemini : !!fallbackApps.gemini,
-    opencode: apps.opencode !== undefined ? !!apps.opencode : !!fallbackApps.opencode,
-    omp: apps.omp !== undefined ? !!apps.omp: !!fallbackApps.omp
-  };
+  for (const platform of platformKeys) {
+    normalized[platform] = source[platform] !== undefined
+      ? !!source[platform]
+      : !!fallback[platform];
+  }
+
+  // Preserve historical flags for platforms that are temporarily absent from the
+  // current registry so disabling/re-enabling a Manifest does not erase data.
+  for (const [platform, enabled] of Object.entries(source)) {
+    if (!platformKeys.has(platform)) normalized[platform] = !!enabled;
+  }
+
+  for (const [platform, enabled] of Object.entries(fallback)) {
+    if (!platformKeys.has(platform) && source[platform] === undefined) {
+      normalized[platform] = !!enabled;
+    }
+  }
+
+  return normalized;
+}
+
+function getControlMcpPlatformKeys() {
+  const dynamic = getMcpPlatformKeys();
+  return dynamic.length > 0 ? dynamic : MCP_PLATFORM_KEYS;
+}
+function mcpControlKey(platform, serverId, scope = 'user') {
+  return `mcp:${platform}:${scope}:${serverId}`;
+}
+
+function secretRefsForServer(server = {}) {
+  const refs = [];
+  for (const key of Object.keys(server.server?.env || {})) refs.push(`env:${key}`);
+  for (const key of Object.keys(server.server?.headers || {})) refs.push(`header:${key}`);
+  if (server.server?.url) refs.push('url:configured');
+  return refs;
+}
+
+function ensureMcpControlEntry(server, platform) {
+  if (!MCP_CONTROL_SERVICE || !server?.id) return null;
+  const controlKey = mcpControlKey(platform, server.id);
+  const existing = MCP_CONTROL_SERVICE.getMcp(controlKey, { scope: 'user' });
+  const policy = deriveMcpPolicy({ transport: server.server?.type, scope: 'user' });
+  if (existing) {
+    const secretRefs = secretRefsForServer(server);
+    if (
+      existing.transport !== policy.transport
+      || existing.riskTier !== policy.riskTier
+      || existing.egressProfile !== policy.egressProfile
+      || !existing.source
+      || JSON.stringify(existing.secretRefs || []) !== JSON.stringify(secretRefs)
+    ) {
+      return MCP_CONTROL_SERVICE.registerMcp({
+        ...existing,
+        ...policy,
+        source: existing.source || 'catalog',
+        secretRefs
+      });
+    }
+    return existing;
+  }
+  return MCP_CONTROL_SERVICE.registerMcp({
+    kind: 'mcp',
+    controlKey,
+    platform,
+    scope: 'user',
+    name: server.id,
+    source: 'catalog',
+    enabled: server.apps?.[platform] === true,
+    trust: 'approved',
+    ...policy,
+    secretRefs: secretRefsForServer(server),
+    managed: true
+  });
+}
+
+function promoteMcpControlEntry(server, platform, enabled) {
+  if (!MCP_CONTROL_SERVICE || !server?.id) return null;
+  const controlKey = mcpControlKey(platform, server.id);
+  const existing = MCP_CONTROL_SERVICE.getMcp(controlKey, { scope: 'user' });
+  if (!existing) {
+    return ensureMcpControlEntry(server, platform);
+  }
+  if (existing.managed !== true) {
+    return MCP_CONTROL_SERVICE.registerMcp({
+      ...existing,
+      ...deriveMcpPolicy({ transport: server.server?.type, scope: 'user' }),
+      source: 'catalog',
+      enabled: enabled === true,
+      trust: 'approved',
+      secretRefs: secretRefsForServer(server),
+      managed: true
+    });
+  }
+  ensureMcpControlEntry(server, platform);
+  return MCP_CONTROL_SERVICE.setMcpPolicy({
+    platform,
+    controlKey,
+    scope: 'user',
+    enabled: enabled === true
+  });
+}
+
+function getMcpControlEnabled(server, platform) {
+  const entry = ensureMcpControlEntry(server, platform);
+  return entry
+    ? entry.managed === true && entry.trust === 'approved' && entry.enabled === true
+    : server.apps?.[platform] === true;
+}
+
+function applyMcpControlApps(server) {
+  if (!MCP_CONTROL_SERVICE || !server?.id) return;
+  for (const platform of getControlMcpPlatformKeys()) {
+    const controlKey = mcpControlKey(platform, server.id);
+    const existing = MCP_CONTROL_SERVICE.getMcp(controlKey, { scope: 'user' });
+    if (!existing) {
+      ensureMcpControlEntry(server, platform);
+      continue;
+    }
+    if (existing.managed !== true) {
+      promoteMcpControlEntry(server, platform, server.apps?.[platform] === true);
+      continue;
+    }
+    MCP_CONTROL_SERVICE.setMcpPolicy({
+      platform,
+      controlKey,
+      scope: 'user',
+      enabled: server.apps?.[platform] === true
+    });
+  }
+}
+
+function readNativeMcpEntries() {
+  const entries = [];
+  for (const platform of getMcpPlatformKeys()) {
+    try {
+      const { driver } = requireMcpCapability(platform);
+      const result = driver.entries ? driver.entries() : driver.read?.();
+      if (result && typeof result.then === 'function') continue;
+      const config = result?.status === 'ok' ? result.data : result;
+      const nativeEntries = driver.entries
+        ? config
+        : getGenericMcpServerMap(config || {});
+      for (const [rawId, spec] of Object.entries(nativeEntries || {})) {
+        let id;
+        try {
+          id = validateMcpId(rawId);
+        } catch {
+          console.warn(`[MCP] Ignoring invalid native server id for ${platform}`);
+          continue;
+        }
+        const normalized = driver.normalize ? driver.normalize(spec) : normalizeServerSpec(spec);
+        const internalSpec = normalized?.status === 'ok' ? normalized.data : normalized;
+        entries.push({ platform, id, spec: internalSpec });
+      }
+    } catch {
+      // A missing or malformed native config must not block central inventory.
+    }
+  }
+  return entries;
+}
+
+function ensureExternalNativeMcpControl(platform, id, spec) {
+  if (!MCP_CONTROL_SERVICE) return null;
+  const controlKey = mcpControlKey(platform, id);
+  const existing = MCP_CONTROL_SERVICE.getMcp(controlKey, { scope: 'user' });
+  if (existing) return existing;
+  return MCP_CONTROL_SERVICE.registerMcp({
+    kind: 'mcp',
+    controlKey,
+    platform,
+    scope: 'user',
+    name: id,
+    source: 'native',
+    enabled: false,
+    trust: 'approved',
+    ...deriveMcpPolicy({ transport: spec?.type, scope: 'user' }),
+    secretRefs: secretRefsForServer({ server: spec }),
+    managed: false
+  });
 }
 
 /**
  * 获取所有 MCP 服务器
  */
 function getAllServers() {
-  const servers = readJsonFile(MCP_SERVERS_FILE, {});
+  const persisted = readJsonFile(MCP_SERVERS_FILE, {});
+  const servers = {};
 
-  for (const server of Object.values(servers)) {
-    if (!server || typeof server !== 'object') {
+  for (const [rawId, server] of Object.entries(persisted)) {
+    const normalizedId = validateMcpId(server?.id || rawId);
+    if (!server || typeof server !== 'object' || Array.isArray(server)) {
       continue;
     }
-    server.apps = normalizeServerApps(server.apps);
+    server.id = normalizedId;
+    server.apps = server.apps == null
+      ? normalizeServerApps(server.apps)
+      : normalizeServerApps(server.apps, {});
     server.server = normalizeServerSpec(server.server);
+    for (const platform of getControlMcpPlatformKeys()) {
+      server.apps[platform] = getMcpControlEnabled(server, platform);
+    }
+    servers[normalizedId] = server;
   }
 
+  for (const entry of readNativeMcpEntries()) {
+    if (!servers[entry.id]) {
+      ensureExternalNativeMcpControl(entry.platform, entry.id, entry.spec);
+    }
+  }
   return servers;
 }
 
@@ -572,8 +744,9 @@ function getAllServers() {
  * 获取单个 MCP 服务器
  */
 function getServer(id) {
+  const normalizedId = validateMcpId(id);
   const servers = getAllServers();
-  return servers[id] || null;
+  return servers[normalizedId] || null;
 }
 
 /**
@@ -581,18 +754,19 @@ function getServer(id) {
  */
 async function saveServer(server, options = {}) {
   const { syncPlatforms = true } = options;
-
-  if (!server.id || !server.id.trim()) {
-    throw new Error('MCP 服务器 ID 不能为空');
+  if (!server || typeof server !== 'object') {
+    throw new Error('MCP server must be an object');
   }
-
-  server.server = normalizeServerSpec(server.server);
+  server.id = validateMcpId(server.id);
+  const incomingSpec = normalizeServerSpec(server.server);
+  const servers = getAllServers();
+  const existingServer = servers[server.id];
+  server.server = existingServer
+    ? mergeMcpPatch(existingServer.server, incomingSpec)
+    : incomingSpec;
 
   // 验证服务器配置
   validateServerSpec(server.server);
-
-  const servers = getAllServers();
-  const existingServer = servers[server.id];
   const previousApps = existingServer ? normalizeServerApps(existingServer.apps) : null;
 
   // 如果是新服务器，设置默认值
@@ -603,23 +777,33 @@ async function saveServer(server, options = {}) {
   }
   server.updatedAt = Date.now();
 
-  // 确保 apps 字段存在
+  // Ensure apps is present while preserving existing flags.
   if (!server.apps) {
-    // Updating a server without explicit app flags should preserve existing platform toggles.
     server.apps = previousApps
       ? normalizeServerApps(previousApps)
-      : normalizeServerApps(DEFAULT_SERVER_APPS);
+      : normalizeServerApps({ claude: true });
   } else {
-    server.apps = normalizeServerApps(server.apps, previousApps || DEFAULT_SERVER_APPS);
+    server.apps = normalizeServerApps(server.apps, previousApps || {});
   }
 
-  // 同步到各平台配置
+  if (MCP_CONTROL_SERVICE) {
+    const requestedApps = normalizeServerApps(server.apps);
+    const effectiveApps = { ...requestedApps };
+    for (const platform of getControlMcpPlatformKeys()) {
+      const control = promoteMcpControlEntry({ ...server, apps: requestedApps }, platform, requestedApps[platform]);
+      effectiveApps[platform] = control
+        ? control.managed === true && control.trust === 'approved' && control.enabled === true
+        : requestedApps[platform];
+    }
+    server.apps = effectiveApps;
+  }
   if (syncPlatforms) {
     await syncServerToAllPlatforms(server, previousApps);
   }
 
   servers[server.id] = server;
   writeJsonFile(MCP_SERVERS_FILE, servers);
+  applyMcpControlApps(server);
 
   return server;
 }
@@ -628,18 +812,23 @@ async function saveServer(server, options = {}) {
  * 删除 MCP 服务器
  */
 async function deleteServer(id) {
+  const normalizedId = validateMcpId(id);
   const servers = getAllServers();
-  const server = servers[id];
+  const server = servers[normalizedId];
 
   if (!server) {
     return false;
   }
 
-  // 从所有平台配置中移除
-  await removeServerFromAllPlatforms(id);
-
-  delete servers[id];
+  await removeServerFromAllPlatforms(normalizedId);
+  delete servers[normalizedId];
   writeJsonFile(MCP_SERVERS_FILE, servers);
+  for (const platform of getControlMcpPlatformKeys()) {
+    MCP_CONTROL_SERVICE?.removeMcp?.({
+      controlKey: mcpControlKey(platform, normalizedId),
+      scope: 'user'
+    });
+  }
 
   return true;
 }
@@ -648,25 +837,37 @@ async function deleteServer(id) {
  * 切换 MCP 服务器在某平台的启用状态
  */
 async function toggleServerApp(serverId, app, enabled) {
+  const normalizedId = validateMcpId(serverId);
   const servers = getAllServers();
-  const server = servers[serverId];
+  const server = servers[normalizedId];
 
   if (!server) {
     throw new Error(`MCP 服务器 "${serverId}" 不存在`);
   }
 
-  if (!MCP_PLATFORM_KEYS.includes(app)) {
-    throw new Error(`无效的平台: ${app}`);
+  const { platform: normalizedPlatform } = requireMcpCapability(app);
+
+  const policy = MCP_CONTROL_SERVICE
+    ? MCP_CONTROL_SERVICE.setMcpPolicy({
+      platform: normalizedPlatform,
+      controlKey: mcpControlKey(normalizedPlatform, normalizedId),
+      scope: 'user',
+      enabled: enabled === true
+    })
+    : { enabled: enabled === true };
+  if (policy.status === 'needs_approval' || policy.status === 'blocked') {
+    return { ...server, apps: { ...server.apps, [normalizedPlatform]: policy.enabled === true }, status: policy.status };
   }
 
-  server.apps[app] = enabled;
+  server.apps = normalizeServerApps(server.apps);
+  server.apps[normalizedPlatform] = policy.enabled === true;
   server.updatedAt = Date.now();
 
-  // 同步到对应平台
-  if (enabled) {
-    await syncServerToPlatform(server, app);
+  // Sync to the selected platform.
+  if (server.apps[normalizedPlatform]) {
+    await syncServerToPlatform(server, normalizedPlatform);
   } else {
-    await removeServerFromPlatform(serverId, app);
+    await removeServerFromPlatform(normalizedId, normalizedPlatform);
   }
 
   writeJsonFile(MCP_SERVERS_FILE, servers);
@@ -698,14 +899,17 @@ function validateServerSpec(spec) {
   if (!MCP_SERVER_TYPES.includes(type)) {
     throw new Error(`无效的服务器类型: ${spec.type || type}，必须是 stdio、streamable_http 或 sse`);
   }
+  if (spec.args !== undefined && (!Array.isArray(spec.args) || spec.args.some(arg => typeof arg !== 'string'))) {
+    throw new Error('MCP server args must be an array of strings');
+  }
 
   if (type === 'stdio') {
-    if (!spec.command || !spec.command.trim()) {
-      throw new Error('stdio 类型必须指定 command');
+    if (typeof spec.command !== 'string' || !spec.command.trim()) {
+      throw new Error('stdio 类型必须指定 string command');
     }
   } else if (REMOTE_MCP_SERVER_TYPES.includes(type)) {
-    if (!spec.url || !spec.url.trim()) {
-      throw new Error(`${type} 类型必须指定 url`);
+    if (typeof spec.url !== 'string' || !spec.url.trim()) {
+      throw new Error(`${type} 类型必须指定 string url`);
     }
   }
 }
@@ -727,7 +931,7 @@ async function syncServerToAllPlatforms(server, previousApps = null) {
     return previous[platform] && !apps[platform];
   };
 
-  for (const platform of MCP_PLATFORM_KEYS) {
+  for (const platform of getMcpPlatformKeys()) {
     if (apps[platform]) {
       await syncServerToPlatform(server, platform);
     } else if (shouldRemoveFromPlatform(platform)) {
@@ -740,7 +944,12 @@ async function syncServerToAllPlatforms(server, previousApps = null) {
  * 从所有平台移除服务器
  */
 async function removeServerFromAllPlatforms(serverId) {
-  for (const platform of MCP_PLATFORM_KEYS) {
+  for (const platform of getMcpPlatformKeys()) {
+    const control = MCP_CONTROL_SERVICE?.getMcp?.(
+      mcpControlKey(platform, serverId),
+      { scope: 'user' }
+    );
+    if (control && control.managed !== true) continue;
     await removeServerFromPlatform(serverId, platform);
   }
 }
@@ -750,462 +959,143 @@ async function removeServerFromAllPlatforms(serverId) {
  */
 async function syncServerToPlatform(server, platform) {
   try {
-    switch (platform) {
-      case 'claude':
-        syncToClaudeConfig(server);
-        break;
-      case 'codex':
-        syncToCodexConfig(server);
-        break;
-      case 'gemini':
-        syncToGeminiConfig(server);
-        break;
-      case 'opencode':
-        syncToOpenCodeConfig(server);
-        break;
-      case 'omp':
-        syncToOmpMcpConfig(server);
-        break;
+    const { platform: normalizedPlatform, driver } = requireMcpCapability(platform);
+    let result;
+    if (typeof driver.sync === 'function') {
+      result = await driver.sync(server);
+    } else {
+      result = await syncGenericMcpServer(driver, normalizedPlatform, server);
     }
-    console.log(`[MCP] Synced "${server.id}" to ${platform}`);
+    const failure = getDriverFailure(result, normalizedPlatform, 'sync');
+    if (failure) throw failure;
+    console.log(`[MCP] Synced "${server.id}" to ${normalizedPlatform}`);
+    return result;
   } catch (err) {
-    console.error(`[MCP] Failed to sync "${server.id}" to ${platform}:`, err.message);
+    console.error(`[MCP] Failed to sync "${server.id}" to ${platform}:`, sanitizeMcpErrorText(err.message || err));
     throw err;
   }
 }
 
-/**
- * 从指定平台移除服务器
- */
 async function removeServerFromPlatform(serverId, platform) {
   try {
-    switch (platform) {
-      case 'claude':
-        removeFromClaudeConfig(serverId);
-        break;
-      case 'codex':
-        removeFromCodexConfig(serverId);
-        break;
-      case 'gemini':
-        removeFromGeminiConfig(serverId);
-        break;
-      case 'opencode':
-        removeFromOpenCodeConfig(serverId);
-        break;
-      case 'omp':
-        removeFromOmpMcpConfig(serverId);
-        break;
+    const { platform: normalizedPlatform, driver } = requireMcpCapability(platform);
+    let result;
+    if (typeof driver.remove === 'function') {
+      result = await driver.remove(serverId);
+    } else {
+      result = await removeGenericMcpServer(driver, normalizedPlatform, serverId);
     }
-    console.log(`[MCP] Removed "${serverId}" from ${platform}`);
+    const failure = getDriverFailure(result, normalizedPlatform, 'remove');
+    if (failure) throw failure;
+    console.log(`[MCP] Removed "${serverId}" from ${normalizedPlatform}`);
+    return result;
   } catch (err) {
-    console.error(`[MCP] Failed to remove "${serverId}" from ${platform}:`, err.message);
+    console.error(`[MCP] Failed to remove "${serverId}" from ${platform}:`, sanitizeMcpErrorText(err.message || err));
     throw err;
   }
 }
 
-// ============================================================================
-// Claude 配置同步
-// ============================================================================
-
-/**
- * 同步到 Claude 配置
- */
-function syncToClaudeConfig(server) {
-  const config = readJsonFile(CLAUDE_CONFIG_PATH, {});
-
-  if (!config.mcpServers) {
-    config.mcpServers = {};
-  }
-
-  // 只写入 server spec，不写入元数据
-  config.mcpServers[server.id] = extractServerSpec(server.server);
-
-  writeJsonFile(CLAUDE_CONFIG_PATH, config);
+function getDriverFailure(result, platform, operation) {
+  if (!result || result.status !== 'failed' || result.capability !== 'mcp') return null;
+  if (result.cause instanceof Error) return result.cause;
+  return new Error(result.error || `MCP ${operation} failed for ${platform}`);
 }
 
-/**
- * 从 Claude 配置移除
- */
-function removeFromClaudeConfig(serverId) {
-  const config = readJsonFile(CLAUDE_CONFIG_PATH, {});
-
-  if (config.mcpServers && config.mcpServers[serverId]) {
-    delete config.mcpServers[serverId];
-    writeJsonFile(CLAUDE_CONFIG_PATH, config);
+async function readGenericMcpConfig(driver, platform, allowMissing = false) {
+  const result = await driver.read();
+  const failure = getDriverFailure(result, platform, 'read');
+  if (failure) {
+    if (allowMissing && failure.code === 'ENOENT') return {};
+    throw failure;
   }
-}
-
-// ============================================================================
-// Codex 配置同步 (TOML 格式)
-// ============================================================================
-
-/**
- * 同步到 Codex 配置
- */
-function syncToCodexConfig(server) {
-  if (!fs.existsSync(CODEX_CONFIG_PATH)) {
-    throw new Error('Codex config.toml not found. Please run Codex CLI at least once before syncing MCP servers.');
-  }
-
-  const config = readTomlFile(CODEX_CONFIG_PATH, {});
-  const nextSpec = convertToCodexFormat(server.server);
-
-  if (!config.mcp_servers) {
-    config.mcp_servers = {};
-  }
-
-  if (JSON.stringify(config.mcp_servers[server.id] || null) === JSON.stringify(nextSpec)) {
-    return;
-  }
-
-  config.mcp_servers[server.id] = nextSpec;
-
-  writeTomlFile(CODEX_CONFIG_PATH, config);
-}
-
-/**
- * 从 Codex 配置移除
- */
-function removeFromCodexConfig(serverId) {
-  if (!fs.existsSync(CODEX_CONFIG_PATH)) {
-    return;
-  }
-
-  const config = readTomlFile(CODEX_CONFIG_PATH, {});
-
-  if (config.mcp_servers && config.mcp_servers[serverId]) {
-    delete config.mcp_servers[serverId];
-    if (Object.keys(config.mcp_servers).length === 0) {
-      delete config.mcp_servers;
-    }
-    writeTomlFile(CODEX_CONFIG_PATH, config);
-  }
-}
-
-/**
- * 转换为 Codex TOML 格式
- */
-function convertToCodexFormat(spec) {
-  const result = {
-    type: spec.type || 'stdio'
-  };
-
-  if (result.type === 'stdio') {
-    result.command = spec.command || '';
-    if (spec.args && spec.args.length > 0) {
-      result.args = spec.args;
-    }
-    if (spec.env && Object.keys(spec.env).length > 0) {
-      result.env = spec.env;
-    }
-    if (spec.cwd) {
-      result.cwd = spec.cwd;
-    }
-  } else if (REMOTE_MCP_SERVER_TYPES.includes(result.type)) {
-    result.url = spec.url || '';
-    if (spec.headers && Object.keys(spec.headers).length > 0) {
-      result.http_headers = spec.headers;
-    }
-  }
-
-  return result;
-}
-
-// ============================================================================
-// Gemini 配置同步
-// ============================================================================
-
-/**
- * 同步到 Gemini 配置
- */
-function syncToGeminiConfig(server) {
-  const config = readJsonFile(GEMINI_CONFIG_PATH, {});
-
-  if (!config.mcpServers) {
-    config.mcpServers = {};
-  }
-
-  // 只写入 server spec，不写入元数据
-  config.mcpServers[server.id] = extractServerSpec(server.server);
-
-  writeJsonFile(GEMINI_CONFIG_PATH, config);
-}
-
-/**
- * 从 Gemini 配置移除
- */
-function removeFromGeminiConfig(serverId) {
-  const config = readJsonFile(GEMINI_CONFIG_PATH, {});
-
-  if (config.mcpServers && config.mcpServers[serverId]) {
-    delete config.mcpServers[serverId];
-    writeJsonFile(GEMINI_CONFIG_PATH, config);
-  }
-}
-
-// ============================================================================
-// OMP 配置同步
-// ============================================================================
-
-function validateOmpServerName(serverId) {
-  if (!OMP_SERVER_NAME_PATTERN.test(serverId)) {
-    throw new Error(`OMP MCP 服务器 ID "${serverId}" 无效。OMP 仅支持 1-100 个字母、数字、下划线、点或连字符。`);
-  }
-}
-
-function readOmpMcpConfig() {
-  const config = readJsonFile(OMP_MCP_CONFIG_PATH, { mcpServers: {} });
+  const config = result?.status === 'ok' ? result.data : result;
   if (!config || typeof config !== 'object' || Array.isArray(config)) {
-    return { mcpServers: {} };
-  }
-  if (!config.mcpServers || typeof config.mcpServers !== 'object' || Array.isArray(config.mcpServers)) {
-    config.mcpServers = {};
+    throw new Error(`MCP 配置必须是 JSON 对象: ${platform}`);
   }
   return config;
 }
 
-function copyCommonMcpFields(source, target) {
-  for (const key of ['timeout', 'auth', 'oauth']) {
-    if (source[key] !== undefined) {
-      target[key] = source[key];
-    }
-  }
-  return target;
+async function writeGenericMcpConfig(driver, platform, config) {
+  const result = await driver.write(config);
+  const failure = getDriverFailure(result, platform, 'write');
+  if (failure) throw failure;
+  return result?.status === 'ok' ? result.data : result;
 }
 
-function convertToOmpMcpFormat(spec = {}) {
-  const sourceType = spec.type || 'stdio';
-  let result;
-
-  if (sourceType === 'stdio') {
-    result = {
-      type: 'stdio',
-      command: spec.command || ''
-    };
-    if (Array.isArray(spec.args) && spec.args.length > 0) {
-      result.args = spec.args;
-    }
-    if (spec.env && Object.keys(spec.env).length > 0) {
-      result.env = spec.env;
-    }
-    if (spec.cwd) {
-      result.cwd = spec.cwd;
-    }
-  } else if (sourceType === STREAMABLE_HTTP_TYPE) {
-    result = {
-      type: 'http',
-      url: spec.url || ''
-    };
-    if (spec.headers && Object.keys(spec.headers).length > 0) {
-      result.headers = spec.headers;
-    }
-  } else if (sourceType === 'sse') {
-    result = {
-      type: 'sse',
-      url: spec.url || ''
-    };
-    if (spec.headers && Object.keys(spec.headers).length > 0) {
-      result.headers = spec.headers;
-    }
-  } else {
-    result = extractServerSpec(spec);
+function invokeMcpDriver(platform, operation, args = []) {
+  const { driver } = requireMcpCapability(platform);
+  if (typeof driver[operation] !== 'function') {
+    const error = createPlatformCapabilityError(platform, 'mcp', 'unsupported');
+    error.operation = operation;
+    throw error;
   }
-
-  return copyCommonMcpFields(spec, result);
+  const normalize = result => {
+    const failure = getDriverFailure(result, platform, operation);
+    if (failure) throw failure;
+    return result?.status === 'ok' ? result.data : result;
+  };
+  const result = driver[operation](...args);
+  return result && typeof result.then === 'function' ? result.then(normalize) : normalize(result);
 }
 
-function convertFromOmpMcpFormat(spec = {}) {
-  const sourceType = spec.type || 'stdio';
-  let result;
 
-  if (sourceType === 'stdio') {
-    result = {
-      type: 'stdio',
-      command: spec.command || ''
-    };
-    if (spec.args) {
-      result.args = spec.args;
-    }
-    if (spec.env) {
-      result.env = spec.env;
+function getGenericMcpServerMap(config) {
+  for (const key of ['mcpServers', 'mcp_servers', 'mcp']) {
+    if (!Object.prototype.hasOwnProperty.call(config, key)) continue;
+    if (!config[key] || typeof config[key] !== 'object' || Array.isArray(config[key])) {
+      throw new Error(`MCP 配置 ${key} 必须是对象`);
     }
-    if (spec.cwd) {
-      result.cwd = spec.cwd;
-    }
-  } else if (sourceType === 'http') {
-    result = {
-      type: STREAMABLE_HTTP_TYPE,
-      url: spec.url || ''
-    };
-    if (spec.headers) {
-      result.headers = spec.headers;
-    }
-  } else if (sourceType === 'sse') {
-    result = {
-      type: 'sse',
-      url: spec.url || ''
-    };
-    if (spec.headers) {
-      result.headers = spec.headers;
-    }
-  } else {
-    result = convertFromCodexFormat(spec);
+    return config[key];
   }
-
-  return copyCommonMcpFields(spec, result);
+  return config;
 }
 
-function syncToOmpMcpConfig(server) {
-  validateOmpServerName(server.id);
-  const config = readOmpMcpConfig();
-  config.mcpServers[server.id] = convertToOmpMcpFormat(server.server);
-  writeJsonFile(OMP_MCP_CONFIG_PATH, config);
+async function syncGenericMcpServer(driver, platform, server) {
+  const config = await readGenericMcpConfig(driver, platform, true);
+  const mcpServers = getGenericMcpServerMap(config);
+  mcpServers[server.id] = extractServerSpec(server.server);
+  return writeGenericMcpConfig(driver, platform, config);
 }
 
-function removeFromOmpMcpConfig(serverId) {
-  const config = readOmpMcpConfig();
-  if (config.mcpServers && config.mcpServers[serverId]) {
-    delete config.mcpServers[serverId];
-    writeJsonFile(OMP_MCP_CONFIG_PATH, config);
-  }
+async function removeGenericMcpServer(driver, platform, serverId) {
+  const config = await readGenericMcpConfig(driver, platform, true);
+  const mcpServers = getGenericMcpServerMap(config);
+  if (!Object.prototype.hasOwnProperty.call(mcpServers, serverId)) return config;
+  delete mcpServers[serverId];
+  return writeGenericMcpConfig(driver, platform, config);
 }
 
-// ============================================================================
-// OpenCode 配置同步
-// ============================================================================
-
-/**
- * 转换为 OpenCode 配置格式
- */
-function convertToOpenCodeFormat(spec) {
-  const sourceType = spec.type || 'stdio';
-
-  if (sourceType === 'local' || sourceType === 'remote') {
-    const result = { ...spec };
-    result.enabled = spec.enabled !== false;
-    if (sourceType === 'local' && typeof result.command === 'string') {
-      result.command = result.command ? [result.command] : [];
-    }
-    return result;
-  }
-
-  if (sourceType === 'stdio') {
-    const command = [];
-    if (spec.command) {
-      command.push(spec.command);
-    }
-    if (Array.isArray(spec.args) && spec.args.length > 0) {
-      command.push(...spec.args);
-    }
-
-    const result = {
-      type: 'local',
-      command,
-      enabled: true
-    };
-
-    if (spec.env && Object.keys(spec.env).length > 0) {
-      result.environment = spec.env;
-    }
-    if (spec.cwd) {
-      result.cwd = spec.cwd;
-    }
-
-    return result;
-  }
-
-  const result = {
-    type: 'remote',
-    url: spec.url || '',
-    enabled: true
-  };
-
-  if (spec.headers && Object.keys(spec.headers).length > 0) {
-    result.headers = spec.headers;
-  }
-
-  return result;
-}
+async function importGenericMcpServers(driver, platform, servers) {
+  const config = await readGenericMcpConfig(driver, platform, true);
+  const mcpServers = getGenericMcpServerMap(config);
+  let count = 0;
 
-/**
- * 从 OpenCode 格式转换到通用格式
- */
-function convertFromOpenCodeFormat(spec) {
-  const sourceType = spec.type || (Array.isArray(spec.command) ? 'local' : 'remote');
-
-  if (sourceType === 'local') {
-    const result = { type: 'stdio' };
-    if (Array.isArray(spec.command) && spec.command.length > 0) {
-      result.command = spec.command[0];
-      if (spec.command.length > 1) {
-        result.args = spec.command.slice(1);
+  for (const [id, spec] of Object.entries(mcpServers)) {
+    if (!spec || typeof spec !== 'object' || Array.isArray(spec)) continue;
+    if (servers[id]) {
+      servers[id].apps = normalizeServerApps(servers[id].apps, {});
+      if (!servers[id].apps[platform]) {
+        servers[id].apps[platform] = true;
+        count++;
       }
-    } else if (typeof spec.command === 'string') {
-      result.command = spec.command;
-    } else {
-      result.command = '';
+      continue;
     }
 
-    if (spec.environment && typeof spec.environment === 'object') {
-      result.env = spec.environment;
-    } else if (spec.env && typeof spec.env === 'object') {
-      result.env = spec.env;
-    }
-    if (spec.cwd) {
-      result.cwd = spec.cwd;
-    }
-    return result;
-  }
-
-  if (sourceType === 'remote') {
-    const result = {
-      type: STREAMABLE_HTTP_TYPE,
-      url: spec.url || ''
+    const now = Date.now();
+    servers[id] = {
+      id,
+      name: id,
+      server: normalizeServerSpec(spec),
+      apps: { [platform]: true },
+      createdAt: now,
+      updatedAt: now
     };
-    if (spec.headers && typeof spec.headers === 'object') {
-      result.headers = spec.headers;
-    }
-    return result;
-  }
-
-  // 已经是通用格式时直接兼容处理
-  if (sourceType === 'stdio' || REMOTE_MCP_SERVER_TYPES.includes(sourceType)) {
-    return convertFromCodexFormat(spec);
-  }
-
-  return {
-    type: 'stdio',
-    command: ''
-  };
-}
-
-/**
- * 同步到 OpenCode 配置
- */
-function syncToOpenCodeConfig(server) {
-  const { path: configPath, config } = readOpenCodeConfig();
-  const nextConfig = config && typeof config === 'object' ? config : {};
-
-  if (!nextConfig.mcp || typeof nextConfig.mcp !== 'object') {
-    nextConfig.mcp = {};
+    count++;
   }
 
-  nextConfig.mcp[server.id] = convertToOpenCodeFormat(server.server);
-  writeOpenCodeConfig(configPath, nextConfig);
+  return count;
 }
 
-/**
- * 从 OpenCode 配置移除
- */
-function removeFromOpenCodeConfig(serverId) {
-  const { path: configPath, config } = readOpenCodeConfig();
-  const nextConfig = config && typeof config === 'object' ? config : {};
-
-  if (nextConfig.mcp && nextConfig.mcp[serverId]) {
-    delete nextConfig.mcp[serverId];
-    writeOpenCodeConfig(configPath, nextConfig);
-  }
-}
 
 // ============================================================================
 // 导入功能
@@ -1215,247 +1105,76 @@ function removeFromOpenCodeConfig(serverId) {
  * 从指定平台导入 MCP 配置
  */
 async function importFromPlatform(platform) {
-  let importedCount = 0;
+  const { platform: normalizedPlatform, driver } = requireMcpCapability(platform);
   const servers = getAllServers();
-
-  switch (platform) {
-    case 'claude':
-      importedCount = importFromClaude(servers);
-      break;
-    case 'codex':
-      importedCount = importFromCodex(servers);
-      break;
-    case 'gemini':
-      importedCount = importFromGemini(servers);
-      break;
-    case 'opencode':
-      importedCount = importFromOpenCode(servers);
-      break;
-    case 'omp':
-      importedCount = importFromOmp(servers);
-      break;
-    default:
-      throw new Error(`无效的平台: ${platform}`);
-  }
+  const result = typeof driver.import === 'function'
+    ? await driver.import(servers)
+    : await importGenericMcpServers(driver, normalizedPlatform, servers);
+  const failure = getDriverFailure(result, normalizedPlatform, 'import');
+  if (failure) throw failure;
+  const importedCount = result?.status === 'ok' ? result.data : result;
 
   if (importedCount > 0) {
     writeJsonFile(MCP_SERVERS_FILE, servers);
+    for (const server of Object.values(servers)) {
+      applyMcpControlApps(server);
+    }
   }
-
   return importedCount;
 }
 
-/**
- * 从 Claude 导入
- */
-function importFromClaude(servers) {
-  const config = readJsonFile(CLAUDE_CONFIG_PATH, {});
-  const mcpServers = config.mcpServers || {};
-  let count = 0;
-
-  for (const [id, spec] of Object.entries(mcpServers)) {
-    if (servers[id]) {
-      // 已存在，只启用 Claude
-      if (!servers[id].apps.claude) {
-        servers[id].apps.claude = true;
-        count++;
-      }
-    } else {
-      // 新服务器
-      servers[id] = {
-        id,
-        name: id,
-        server: spec,
-        apps: { claude: true, codex: false, gemini: false, opencode: false },
-        createdAt: Date.now(),
-        updatedAt: Date.now()
-      };
-      count++;
-    }
-  }
 
-  return count;
-}
 
 /**
- * 从 Codex 导入
+ * 提取纯净的服务器规范（移除元数据）
  */
-function importFromCodex(servers) {
-  const config = readTomlFile(CODEX_CONFIG_PATH, {});
-  const mcpServers = config.mcp_servers || {};
-  let count = 0;
-
-  for (const [id, spec] of Object.entries(mcpServers)) {
-    // 转换 Codex 格式到通用格式
-    const convertedSpec = convertFromCodexFormat(spec);
-
-    if (servers[id]) {
-      // 已存在，只启用 Codex
-      if (!servers[id].apps.codex) {
-        servers[id].apps.codex = true;
-        count++;
-      }
-    } else {
-      // 新服务器
-      servers[id] = {
-        id,
-        name: id,
-        server: convertedSpec,
-        apps: { claude: false, codex: true, gemini: false, opencode: false },
-        createdAt: Date.now(),
-        updatedAt: Date.now()
-      };
-      count++;
-    }
-  }
-
-  return count;
+function extractServerSpec(spec) {
+  return mcpFormat.extractServerSpec(spec);
 }
 
-/**
- * 从 Gemini 导入
- */
-function importFromGemini(servers) {
-  const config = readJsonFile(GEMINI_CONFIG_PATH, {});
-  const mcpServers = config.mcpServers || {};
-  let count = 0;
+const EXPORT_SECRET_KEY_PATTERN = /(?:token|secret|password|authorization|api[-_]?key|access[_-]?token|credential|private[_-]?key|secretrefs?|auth|oauth|envvars|experimentalenvironment)/i;
 
-  for (const [id, spec] of Object.entries(mcpServers)) {
-    if (servers[id]) {
-      // 已存在，只启用 Gemini
-      if (!servers[id].apps.gemini) {
-        servers[id].apps.gemini = true;
-        count++;
-      }
-    } else {
-      // 新服务器
-      servers[id] = {
-        id,
-        name: id,
-        server: spec,
-        apps: { claude: false, codex: false, gemini: true, opencode: false },
-        createdAt: Date.now(),
-        updatedAt: Date.now()
-      };
-      count++;
-    }
+function sanitizeExportValue(value, key = '') {
+  if (/^url$/i.test(key)) return typeof value === 'string' ? redactSecrets({ url: value }).url : value;
+  if (/^(?:auth|oauth|bearer_token_env_var|secretRefs?)$/i.test(key) || EXPORT_SECRET_KEY_PATTERN.test(key)) {
+    return '[REDACTED]';
   }
-
-  return count;
-}
-
-/**
- * 从 OpenCode 导入
- */
-function importFromOpenCode(servers) {
-  const { config } = readOpenCodeConfig();
-  const mcpServers = config.mcp || {};
-  let count = 0;
-
-  for (const [id, spec] of Object.entries(mcpServers)) {
-    const convertedSpec = convertFromOpenCodeFormat(spec || {});
-
-    if (servers[id]) {
-      if (!servers[id].apps.opencode) {
-        servers[id].apps.opencode = true;
-        count++;
-      }
-    } else {
-      servers[id] = {
-        id,
-        name: id,
-        server: convertedSpec,
-        apps: { claude: false, codex: false, gemini: false, opencode: true },
-        createdAt: Date.now(),
-        updatedAt: Date.now()
-      };
-      count++;
+  if (/^(?:command|args)$/i.test(key)) return sanitizeCommandLineValue(value);
+  if (typeof value === 'string') return sanitizeMcpErrorText(value);
+  if (/^(?:env|environment|env_vars|experimental_environment)$/i.test(key)) {
+    if (Array.isArray(value)) {
+      return value.map(item => (
+        typeof item === 'string' && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(item)
+          ? item
+          : '[REDACTED]'
+      ));
     }
-  }
-
-  return count;
-}
-
-/**
- * 从 OMP 导入
- */
-function importFromOmp(servers) {
-  const config = readOmpMcpConfig();
-  const mcpServers = config.mcpServers || {};
-  let count = 0;
-
-  for (const [id, spec] of Object.entries(mcpServers)) {
-    const convertedSpec = convertFromOmpMcpFormat(spec || {});
-
-    if (servers[id]) {
-      servers[id].apps = normalizeServerApps(servers[id].apps);
-      if (!servers[id].apps.omp) {
-        servers[id].apps.omp = true;
-        count++;
-      }
-    } else {
-      servers[id] = {
-        id,
-        name: id,
-        server: convertedSpec,
-        apps: { claude: false, codex: false, gemini: false, opencode: false, omp: true },
-        createdAt: Date.now(),
-        updatedAt: Date.now()
-      };
-      count++;
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [
+        childKey,
+        typeof childValue === 'string' && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(childValue)
+          ? childValue
+          : '[REDACTED]'
+      ]));
     }
+    return '[REDACTED]';
   }
-
-  return count;
-}
-
-/**
- * 从 Codex 格式转换
- */
-function convertFromCodexFormat(spec) {
-  const result = {
-    type: spec.type || 'stdio'
-  };
-
-  if (result.type === 'stdio') {
-    result.command = spec.command || '';
-    if (spec.args) {
-      result.args = spec.args;
-    }
-    if (spec.env) {
-      result.env = spec.env;
-    }
-    if (spec.cwd) {
-      result.cwd = spec.cwd;
-    }
-  } else if (REMOTE_MCP_SERVER_TYPES.includes(result.type)) {
-    result.url = spec.url || '';
-    if (spec.http_headers) {
-      result.headers = spec.http_headers;
-    } else if (spec.headers) {
-      result.headers = spec.headers;
-    }
+  if (/^(?:headers|http_headers)$/i.test(key) && value && typeof value === 'object' && !Array.isArray(value)) {
+    return Object.fromEntries(Object.entries(value).map(([header, headerValue]) => [
+      header,
+      /^(?:accept|content-type|user-agent)$/i.test(header) ? headerValue : '[REDACTED]'
+    ]));
   }
-
-  return result;
+  if (Array.isArray(value)) return value.map(item => sanitizeExportValue(item));
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [
+    childKey,
+    sanitizeExportValue(childValue, childKey)
+  ]));
 }
 
-/**
- * 提取纯净的服务器规范（移除元数据）
- */
-function extractServerSpec(spec) {
-  const result = { ...spec };
-  // 移除可能存在的非规范字段
-  delete result.id;
-  delete result.name;
-  delete result.description;
-  delete result.tags;
-  delete result.homepage;
-  delete result.docs;
-  delete result.apps;
-  delete result.createdAt;
-  delete result.updatedAt;
-  return result;
+function sanitizeExportSpec(spec = {}) {
+  return sanitizeExportValue(extractServerSpec(spec));
 }
 
 /**
@@ -1464,15 +1183,13 @@ function extractServerSpec(spec) {
 function getStats() {
   const servers = getAllServers();
   const serverList = Object.values(servers);
+  const stats = { total: serverList.length };
 
-  return {
-    total: serverList.length,
-    claude: serverList.filter(s => s.apps?.claude).length,
-    codex: serverList.filter(s => s.apps?.codex).length,
-    gemini: serverList.filter(s => s.apps?.gemini).length,
-    opencode: serverList.filter(s => s.apps?.opencode).length,
-    omp: serverList.filter(s => s.apps?.omp).length
-  };
+  for (const platform of getMcpPlatformKeys()) {
+    stats[platform] = serverList.filter(server => server.apps?.[platform]).length;
+  }
+
+  return stats;
 }
 
 // ============================================================================
@@ -1489,6 +1206,7 @@ async function testServer(serverId) {
   if (!server) {
     throw new Error(`MCP 服务器 "${serverId}" 不存在`);
   }
+  assertMcpServerActivated(server);
 
   const spec = server.server;
   const type = spec.type || 'stdio';
@@ -1585,7 +1303,7 @@ async function testStdioServer(spec) {
         } else {
           done({
             success: false,
-            message: `启动失败: ${err.message}`,
+            message: sanitizeMcpErrorText(`启动失败: ${err.message}`),
             duration: Date.now() - startTime
           });
         }
@@ -1601,7 +1319,7 @@ async function testStdioServer(spec) {
         } else {
           done({
             success: false,
-            message: stderr || `进程退出码: ${code}`,
+            message: sanitizeMcpErrorText(stderr || `进程退出码: ${code}`),
             duration: Date.now() - startTime
           });
         }
@@ -1676,6 +1394,13 @@ async function testHttpServer(spec) {
   }
 }
 
+function assertMcpServerActivated(server) {
+  if (getControlMcpPlatformKeys().some(platform => server.apps?.[platform] === true)) return;
+  const error = new Error('MCP server is disabled by the effective control policy');
+  error.code = 'MCP_DISABLED';
+  throw error;
+}
+
 /**
  * Get tools list from MCP server
  * @param {string} serverId - Server ID from config
@@ -1686,6 +1411,7 @@ async function getServerTools(serverId) {
   if (!server) {
     throw new Error(`MCP 服务器 "${serverId}" 不存在`);
   }
+  assertMcpServerActivated(server);
 
   const startTime = Date.now();
   const spec = server.server;
@@ -1709,7 +1435,7 @@ async function getServerTools(serverId) {
         try {
           await cached.client.disconnect();
         } catch (err) {
-          console.error(`[MCP] Error disconnecting expired client: ${err.message}`);
+          console.error(`[MCP] Error disconnecting expired client: ${sanitizeMcpErrorText(err.message || err)}`);
         }
         mcpClientPool.delete(serverId);
       }
@@ -1733,7 +1459,7 @@ async function getServerTools(serverId) {
     }
 
     // Get tools list
-    const tools = await client.listTools();
+    const tools = sanitizeMcpToolValue(await client.listTools());
 
     return {
       tools,
@@ -1777,6 +1503,7 @@ async function callServerTool(serverId, toolName, arguments = {}) {
   if (!server) {
     throw new Error(`MCP 服务器 "${serverId}" 不存在`);
   }
+  assertMcpServerActivated(server);
 
   const startTime = Date.now();
   const spec = server.server;
@@ -1802,7 +1529,7 @@ async function callServerTool(serverId, toolName, arguments = {}) {
         try {
           await cached.client.disconnect();
         } catch (err) {
-          console.error(`[MCP] Error disconnecting expired client: ${err.message}`);
+          console.error(`[MCP] Error disconnecting expired client: ${sanitizeMcpErrorText(err.message || err)}`);
         }
         mcpClientPool.delete(serverId);
       }
@@ -1827,27 +1554,30 @@ async function callServerTool(serverId, toolName, arguments = {}) {
 
     // Call the tool
     const result = await client.callTool(toolName, arguments);
-
+    const safeResult = sanitizeMcpToolValue(result);
+    const resultObject = safeResult && typeof safeResult === 'object' && !Array.isArray(safeResult)
+      ? safeResult
+      : { value: safeResult };
     const duration = Date.now() - startTime;
 
     // Check result size, truncate if > 10KB
-    const resultStr = JSON.stringify(result);
+    const resultStr = JSON.stringify(resultObject);
     if (resultStr.length > 10 * 1024) {
       return {
         result: {
-          ...result,
+          ...resultObject,
           truncated: true
         },
         truncatedSize: resultStr.length,
         duration,
-        isError: result.isError || false
+        isError: resultObject.isError || false
       };
     }
 
     return {
-      result,
+      result: resultObject,
       duration,
-      isError: result.isError || false
+      isError: resultObject.isError || false
     };
 
   } catch (err) {
@@ -1866,8 +1596,7 @@ async function callServerTool(serverId, toolName, arguments = {}) {
     return {
       result: {
         error: failure.message,
-        code: err.code,
-        data: err.data
+        ...(err.code ? { code: sanitizeMcpErrorText(err.code) } : {})
       },
       duration: failure.duration,
       isError: true,
@@ -1908,8 +1637,9 @@ function updateServerOrder(serverIds) {
 
   // 更新每个服务器的排序索引
   serverIds.forEach((id, index) => {
-    if (servers[id]) {
-      servers[id].order = index;
+    const normalizedId = validateMcpId(id);
+    if (Object.prototype.hasOwnProperty.call(servers, normalizedId)) {
+      servers[normalizedId].order = index;
     }
   });
 
@@ -1923,26 +1653,19 @@ function updateServerOrder(serverIds) {
 
 /**
  * 导出所有 MCP 配置
- * @param {string} format - 导出格式: 'json' | 'claude' | 'codex' | 'opencode' | 'gemini' | 'omp'
+ * @param {string} format - 导出格式: json 或声明了导出操作的 MCP 平台 key
  */
 function exportServers(format = 'json') {
   const servers = getAllServers();
+  if (format === 'json') return exportAsJson(servers);
 
-  switch (format) {
-    case 'claude':
-      return exportForClaude(servers);
-    case 'codex':
-      return exportForCodex(servers);
-    case 'opencode':
-      return exportForOpenCode(servers);
-    case 'gemini':
-      return exportForGemini(servers);
-    case 'omp':
-      return exportForOmp(servers);
-    case 'json':
-    default:
-      return exportAsJson(servers);
+  const { platform, driver } = requireMcpCapability(format);
+  if (typeof driver.export !== 'function') {
+    const error = createPlatformCapabilityError(platform, 'mcp', 'unsupported');
+    error.operation = 'export';
+    throw error;
   }
+  return driver.export(servers);
 }
 
 /**
@@ -1952,111 +1675,17 @@ function exportAsJson(servers) {
   const mcpServers = {};
 
   for (const [id, server] of Object.entries(servers)) {
-    mcpServers[id] = extractServerSpec(server.server);
+    mcpServers[id] = sanitizeExportSpec(server.server);
   }
 
   return {
     format: 'json',
     content: JSON.stringify({ mcpServers }, null, 2),
-    filename: 'mcp-servers.json'
-  };
-}
-
-/**
- * 导出为 Claude 格式
- */
-function exportForClaude(servers) {
-  const mcpServers = {};
-
-  for (const [id, server] of Object.entries(servers)) {
-    if (server.apps?.claude) {
-      mcpServers[id] = extractServerSpec(server.server);
-    }
-  }
-
-  return {
-    format: 'claude',
-    content: JSON.stringify({ mcpServers }, null, 2),
-    filename: 'claude-mcp-config.json'
-  };
-}
-
-/**
- * 导出为 Codex 格式
- */
-function exportForCodex(servers) {
-  const mcp_servers = {};
-
-  for (const [id, server] of Object.entries(servers)) {
-    if (server.apps?.codex) {
-      mcp_servers[id] = convertToCodexFormat(server.server);
-    }
-  }
-
-  return {
-    format: 'codex',
-    content: toml.stringify({ mcp_servers }),
-    filename: 'codex-mcp-config.toml'
-  };
-}
-
-/**
- * 导出为 OpenCode 格式
- */
-function exportForOpenCode(servers) {
-  const mcp = {};
-
-  for (const [id, server] of Object.entries(servers)) {
-    if (server.apps?.opencode) {
-      mcp[id] = convertToOpenCodeFormat(server.server);
-    }
-  }
-
-  return {
-    format: 'opencode',
-    content: JSON.stringify({ mcp }, null, 2),
-    filename: 'opencode-mcp-config.json'
-  };
-}
-
-/**
- * 导出为 Gemini 格式
- */
-function exportForGemini(servers) {
-  const mcpServers = {};
-
-  for (const [id, server] of Object.entries(servers)) {
-    if (server.apps?.gemini) {
-      mcpServers[id] = extractServerSpec(server.server);
-    }
-  }
-
-  return {
-    format: 'gemini',
-    content: JSON.stringify({ mcpServers }, null, 2),
-    filename: 'gemini-mcp-config.json'
+    filename: 'mcp-servers.json',
+    contentType: 'application/json'
   };
 }
 
-/**
- * 导出为 OMP 格式
- */
-function exportForOmp(servers) {
-  const mcpServers = {};
-
-  for (const [id, server] of Object.entries(servers)) {
-    if (server.apps?.omp) {
-      validateOmpServerName(id);
-      mcpServers[id] = convertToOmpMcpFormat(server.server);
-    }
-  }
-
-  return {
-    format: 'omp',
-    content: JSON.stringify({ $schema: OMP_MCP_SCHEMA_URL, mcpServers }, null, 2),
-    filename: 'omp-mcp-config.json'
-  };
-}
 
 module.exports = {
   getAllServers,
@@ -2068,6 +1697,7 @@ module.exports = {
   importFromPlatform,
   getStats,
   validateServerSpec,
+  getMcpPlatformKeys,
   // 新增功能
   testServer,
   getServerTools,