nextclaw 0.12.2 → 0.12.3

package/dist/cli/index.js

@@ -6,8 +6,8 @@ import { APP_NAME as APP_NAME5, APP_TAGLINE } from "@nextclaw/core";
 
 // src/cli/runtime.ts
 import {
-  loadConfig as loadConfig8,
-  saveConfig as saveConfig6,
+  loadConfig as loadConfig9,
+  saveConfig as saveConfig7,
   getConfigPath as getConfigPath4,
   getDataDir as getDataDir8,
   ConfigSchema as ConfigSchema2,
@@ -2116,15 +2116,230 @@ var ConfigCommands = class {
   }
 };
 
+// src/cli/commands/mcp.ts
+import { loadConfig as loadConfig4, saveConfig as saveConfig3 } from "@nextclaw/core";
+import { McpDoctorService, McpRegistryService, normalizeMcpServerName } from "@nextclaw/mcp";
+function normalizeOptionalString(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed || void 0;
+}
+function parsePairs(values, label) {
+  const output = {};
+  for (const raw of values ?? []) {
+    const index = raw.indexOf("=");
+    if (index <= 0) {
+      throw new Error(`Invalid ${label} entry: ${raw}. Expected key=value.`);
+    }
+    const key = raw.slice(0, index).trim();
+    const value = raw.slice(index + 1);
+    if (!key) {
+      throw new Error(`Invalid ${label} entry: ${raw}. Expected key=value.`);
+    }
+    output[key] = value;
+  }
+  return output;
+}
+function parseTimeoutMs(value) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`Invalid timeout: ${String(value)}`);
+  }
+  return Math.trunc(parsed);
+}
+function buildMcpServerDefinition(command, opts) {
+  const transport = (normalizeOptionalString(opts.transport) ?? "stdio").toLowerCase();
+  const disabled = Boolean(opts.disabled);
+  const allAgents = Boolean(opts.allAgents);
+  const explicitAgents = Array.from(
+    new Set(
+      (opts.agent ?? []).map((agentId) => normalizeOptionalString(agentId)).filter((agentId) => Boolean(agentId))
+    )
+  );
+  if (transport === "stdio") {
+    if (command.length === 0) {
+      throw new Error("stdio transport requires a command after --");
+    }
+    return {
+      enabled: !disabled,
+      transport: {
+        type: "stdio",
+        command: command[0],
+        args: command.slice(1),
+        cwd: normalizeOptionalString(opts.cwd),
+        env: parsePairs(opts.env, "env"),
+        stderr: normalizeOptionalString(opts.stderr) ?? "pipe"
+      },
+      scope: {
+        allAgents,
+        agents: explicitAgents
+      },
+      policy: {
+        trust: "explicit",
+        start: "eager"
+      }
+    };
+  }
+  const url = normalizeOptionalString(opts.url);
+  if (!url) {
+    throw new Error(`${transport} transport requires --url`);
+  }
+  const timeoutMs = parseTimeoutMs(opts.timeoutMs);
+  const shared = {
+    enabled: !disabled,
+    scope: {
+      allAgents,
+      agents: explicitAgents
+    },
+    policy: {
+      trust: "explicit",
+      start: "eager"
+    }
+  };
+  if (transport === "http") {
+    return {
+      ...shared,
+      transport: {
+        type: "http",
+        url,
+        headers: parsePairs(opts.header, "header"),
+        timeoutMs: timeoutMs ?? 15e3,
+        verifyTls: !opts.insecure
+      }
+    };
+  }
+  if (transport === "sse") {
+    return {
+      ...shared,
+      transport: {
+        type: "sse",
+        url,
+        headers: parsePairs(opts.header, "header"),
+        timeoutMs: timeoutMs ?? 15e3,
+        verifyTls: !opts.insecure,
+        reconnect: {
+          enabled: true,
+          initialDelayMs: 1e3,
+          maxDelayMs: 3e4
+        }
+      }
+    };
+  }
+  throw new Error(`Unsupported MCP transport: ${transport}`);
+}
+var McpCommands = class {
+  mcpList(opts = {}) {
+    const registry = new McpRegistryService({
+      getConfig: () => loadConfig4()
+    });
+    const servers = registry.listServers().map((server) => ({
+      name: server.name,
+      enabled: server.definition.enabled,
+      transport: server.definition.transport.type,
+      scope: server.definition.scope
+    }));
+    if (opts.json) {
+      console.log(JSON.stringify({ servers }, null, 2));
+      return;
+    }
+    if (servers.length === 0) {
+      console.log("No MCP servers configured.");
+      return;
+    }
+    for (const server of servers) {
+      const scope = server.scope.allAgents ? "all-agents" : server.scope.agents.length > 0 ? `agents=${server.scope.agents.join(",")}` : "default-agent";
+      console.log(`${server.enabled ? "ENABLED " : "DISABLED"} ${server.name} (${server.transport}, ${scope})`);
+    }
+  }
+  async mcpAdd(name, command, opts) {
+    const normalizedName = normalizeMcpServerName(name);
+    const config2 = loadConfig4();
+    if (config2.mcp.servers[normalizedName]) {
+      reportUserInputIssue(`MCP server already exists: ${normalizedName}. Use 'mcp list' or remove it first.`);
+      return;
+    }
+    config2.mcp.servers[normalizedName] = buildMcpServerDefinition(command, opts);
+    saveConfig3(config2);
+    console.log(`Added MCP server ${normalizedName}.`);
+  }
+  async mcpRemove(name) {
+    const normalizedName = normalizeMcpServerName(name);
+    const config2 = loadConfig4();
+    if (!config2.mcp.servers[normalizedName]) {
+      reportUserInputIssue(`Unknown MCP server: ${normalizedName}`);
+      return;
+    }
+    delete config2.mcp.servers[normalizedName];
+    saveConfig3(config2);
+    console.log(`Removed MCP server ${normalizedName}.`);
+  }
+  async mcpEnable(name) {
+    await this.toggleEnabled(name, true);
+  }
+  async mcpDisable(name) {
+    await this.toggleEnabled(name, false);
+  }
+  async mcpDoctor(name, opts = {}) {
+    const registry = new McpRegistryService({
+      getConfig: () => loadConfig4()
+    });
+    const doctor = new McpDoctorService({
+      getConfig: () => loadConfig4(),
+      registryService: registry
+    });
+    try {
+      const reports = await doctor.inspect(name);
+      if (opts.json) {
+        console.log(JSON.stringify({ reports }, null, 2));
+        return;
+      }
+      if (reports.length === 0) {
+        console.log("No MCP servers matched.");
+        return;
+      }
+      for (const report of reports) {
+        const status = report.error ? "ERROR" : "OK";
+        const detail = report.error ? ` (${report.error})` : "";
+        console.log(
+          `[${status}] ${report.name} enabled=${report.enabled} transport=${report.transport} tools=${report.toolCount}${detail}`
+        );
+      }
+    } finally {
+      await registry.close();
+    }
+  }
+  async toggleEnabled(name, enabled) {
+    const normalizedName = normalizeMcpServerName(name);
+    const config2 = loadConfig4();
+    const current = config2.mcp.servers[normalizedName];
+    if (!current) {
+      reportUserInputIssue(`Unknown MCP server: ${normalizedName}`);
+      return;
+    }
+    current.enabled = enabled;
+    saveConfig3(config2);
+    console.log(`${enabled ? "Enabled" : "Disabled"} MCP server ${normalizedName}.`);
+  }
+};
+function reportUserInputIssue(message) {
+  console.error(message);
+  process.exitCode = 1;
+}
+
 // src/cli/commands/secrets.ts
 import { readFileSync as readFileSync5 } from "fs";
 import {
   buildReloadPlan as buildReloadPlan2,
   diffConfigPaths as diffConfigPaths2,
   getConfigPath,
-  loadConfig as loadConfig4,
+  loadConfig as loadConfig5,
   resolveConfigSecrets,
-  saveConfig as saveConfig3
+  saveConfig as saveConfig4
 } from "@nextclaw/core";
 var SECRET_SOURCES = ["env", "file", "exec"];
 function normalizeSecretSource(value) {
@@ -2134,14 +2349,14 @@ function normalizeSecretSource(value) {
   const normalized = value.trim().toLowerCase();
   return SECRET_SOURCES.includes(normalized) ? normalized : null;
 }
-function normalizeOptionalString(value) {
+function normalizeOptionalString2(value) {
   if (typeof value !== "string") {
     return void 0;
   }
   const trimmed = value.trim();
   return trimmed || void 0;
 }
-function parseTimeoutMs(value) {
+function parseTimeoutMs2(value) {
   if (value === void 0 || value === null || value === "") {
     return void 0;
   }
@@ -2152,11 +2367,11 @@ function parseTimeoutMs(value) {
   return Math.trunc(parsed);
 }
 function inferProviderAlias(config2, ref) {
-  const explicit = normalizeOptionalString(ref.provider);
+  const explicit = normalizeOptionalString2(ref.provider);
   if (explicit) {
     return explicit;
   }
-  const defaultAlias = normalizeOptionalString(config2.secrets.defaults[ref.source]);
+  const defaultAlias = normalizeOptionalString2(config2.secrets.defaults[ref.source]);
   if (defaultAlias) {
     return defaultAlias;
   }
@@ -2180,8 +2395,8 @@ function parseRefsPatch(raw) {
       throw new Error(`invalid ref for ${path2}`);
     }
     const source = normalizeSecretSource(value.source);
-    const id = normalizeOptionalString(value.id);
-    const provider = normalizeOptionalString(value.provider);
+    const id = normalizeOptionalString2(value.id);
+    const provider = normalizeOptionalString2(value.provider);
     if (!source || !id) {
       throw new Error(`invalid ref for ${path2}: source/id is required`);
     }
@@ -2218,7 +2433,7 @@ var SecretsCommands = class {
     this.deps = deps;
   }
   secretsAudit(opts = {}) {
-    const config2 = loadConfig4();
+    const config2 = loadConfig5();
     const configPath = getConfigPath();
     const refs = config2.secrets.refs;
     const items = [];
@@ -2282,11 +2497,11 @@ var SecretsCommands = class {
     }
   }
   async secretsConfigure(opts) {
-    const alias = normalizeOptionalString(opts.provider);
+    const alias = normalizeOptionalString2(opts.provider);
     if (!alias) {
       throw new Error("provider alias is required");
     }
-    const prevConfig = loadConfig4();
+    const prevConfig = loadConfig5();
     const nextConfig = structuredClone(prevConfig);
     const remove = Boolean(opts.remove);
     if (remove) {
@@ -2304,10 +2519,10 @@ var SecretsCommands = class {
       if (source === "env") {
         nextConfig.secrets.providers[alias] = {
           source,
-          ...normalizeOptionalString(opts.prefix) ? { prefix: normalizeOptionalString(opts.prefix) } : {}
+          ...normalizeOptionalString2(opts.prefix) ? { prefix: normalizeOptionalString2(opts.prefix) } : {}
         };
       } else if (source === "file") {
-        const path2 = normalizeOptionalString(opts.path);
+        const path2 = normalizeOptionalString2(opts.path);
         if (!path2) {
           throw new Error("file source requires --path");
         }
@@ -2317,7 +2532,7 @@ var SecretsCommands = class {
           format: "json"
         };
       } else {
-        const command = normalizeOptionalString(opts.command);
+        const command = normalizeOptionalString2(opts.command);
         if (!command) {
           throw new Error("exec source requires --command");
         }
@@ -2325,8 +2540,8 @@ var SecretsCommands = class {
           source,
           command,
           args: Array.isArray(opts.arg) ? opts.arg : [],
-          ...normalizeOptionalString(opts.cwd) ? { cwd: normalizeOptionalString(opts.cwd) } : {},
-          timeoutMs: parseTimeoutMs(opts.timeoutMs) ?? 5e3
+          ...normalizeOptionalString2(opts.cwd) ? { cwd: normalizeOptionalString2(opts.cwd) } : {},
+          timeoutMs: parseTimeoutMs2(opts.timeoutMs) ?? 5e3
         };
       }
       if (opts.setDefault) {
@@ -2334,7 +2549,7 @@ var SecretsCommands = class {
       }
     }
     resolveConfigSecrets(nextConfig, { configPath: getConfigPath() });
-    saveConfig3(nextConfig);
+    saveConfig4(nextConfig);
     await this.requestRestartForConfigDiff({
       prevConfig,
       nextConfig,
@@ -2348,7 +2563,7 @@ var SecretsCommands = class {
     console.log(`Secrets provider ${remove ? "removed" : "configured"}: ${alias}`);
   }
   async secretsApply(opts) {
-    const prevConfig = loadConfig4();
+    const prevConfig = loadConfig5();
     const nextConfig = structuredClone(prevConfig);
     if (opts.enable && opts.disable) {
       throw new Error("cannot set --enable and --disable at the same time");
@@ -2384,11 +2599,11 @@ var SecretsCommands = class {
         delete nextConfig.secrets.refs[path2];
       } else {
         const source = normalizeSecretSource(opts.source);
-        const id = normalizeOptionalString(opts.id);
+        const id = normalizeOptionalString2(opts.id);
         if (!source || !id) {
           throw new Error("apply single ref requires --source and --id");
         }
-        const provider = normalizeOptionalString(opts.provider);
+        const provider = normalizeOptionalString2(opts.provider);
         nextConfig.secrets.refs[path2] = {
           source,
           id,
@@ -2399,7 +2614,7 @@ var SecretsCommands = class {
       throw new Error("--remove requires --path");
     }
     resolveConfigSecrets(nextConfig, { configPath: getConfigPath() });
-    saveConfig3(nextConfig);
+    saveConfig4(nextConfig);
     await this.requestRestartForConfigDiff({
       prevConfig,
       nextConfig,
@@ -2413,10 +2628,10 @@ var SecretsCommands = class {
     console.log("Secrets applied.");
   }
   async secretsReload(opts = {}) {
-    const config2 = loadConfig4();
+    const config2 = loadConfig5();
     const configPath = getConfigPath();
     resolveConfigSecrets(config2, { configPath });
-    saveConfig3(config2);
+    saveConfig4(config2);
     if (opts.json) {
       console.log(JSON.stringify({ ok: true, message: "secrets reload signal emitted" }, null, 2));
       return;
@@ -2441,7 +2656,7 @@ var SecretsCommands = class {
 
 // src/cli/commands/channels.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { getWorkspacePath as getWorkspacePath3, loadConfig as loadConfig5, saveConfig as saveConfig4 } from "@nextclaw/core";
+import { getWorkspacePath as getWorkspacePath3, loadConfig as loadConfig6, saveConfig as saveConfig5 } from "@nextclaw/core";
 import { BUILTIN_CHANNEL_PLUGIN_IDS, builtinProviderIds as builtinProviderIds2 } from "@nextclaw/runtime";
 import { buildPluginStatusReport as buildPluginStatusReport3, enablePluginInConfig as enablePluginInConfig2, getPluginChannelBindings } from "@nextclaw/openclaw-compat";
 var CHANNEL_LABELS = {
@@ -2462,7 +2677,7 @@ var ChannelCommands = class {
     this.deps = deps;
   }
   channelsStatus() {
-    const config2 = loadConfig5();
+    const config2 = loadConfig6();
     console.log("Channel Status");
     const channelConfig = config2.channels;
     for (const channelId of BUILTIN_CHANNEL_PLUGIN_IDS) {
@@ -2501,7 +2716,7 @@ var ChannelCommands = class {
       console.error("--channel is required");
       process.exit(1);
     }
-    const config2 = loadConfig5();
+    const config2 = loadConfig6();
     const workspaceDir = getWorkspacePath3(config2.agents.defaults.workspace);
     const pluginRegistry = loadPluginRegistry(config2, workspaceDir);
     const bindings = getPluginChannelBindings(pluginRegistry);
@@ -2544,7 +2759,7 @@ var ChannelCommands = class {
     }
     let next = mergePluginConfigView(config2, nextView, bindings);
     next = enablePluginInConfig2(next, binding.pluginId);
-    saveConfig4(next);
+    saveConfig5(next);
     console.log(`Configured channel "${binding.channelId}" via plugin "${binding.pluginId}".`);
     await this.deps.requestRestart({
       reason: `channel configured via plugin: ${binding.pluginId}`,
@@ -2639,7 +2854,7 @@ import {
   getDataDir as getDataDir4,
   getWorkspacePath as getWorkspacePath4,
   hasSecretRef,
-  loadConfig as loadConfig6
+  loadConfig as loadConfig7
 } from "@nextclaw/core";
 import { listBuiltinProviders } from "@nextclaw/runtime";
 var DiagnosticsCommands = class {
@@ -2801,7 +3016,7 @@ var DiagnosticsCommands = class {
   }
   async collectRuntimeStatus(params) {
     const configPath = getConfigPath2();
-    const config2 = loadConfig6();
+    const config2 = loadConfig7();
     const workspacePath = getWorkspacePath4(config2.agents.defaults.workspace);
     const serviceStatePath = resolve8(getDataDir4(), "run", "service.json");
     const fixActions = [];
@@ -3306,6 +3521,9 @@ var ConfigReloader = class {
   setReloadPlugins(callback) {
     this.options.reloadPlugins = callback;
   }
+  setReloadMcp(callback) {
+    this.options.reloadMcp = callback;
+  }
   async applyReloadPlan(nextConfig) {
     const changedPaths = diffConfigPaths3(this.currentConfig, nextConfig);
     if (!changedPaths.length) {
@@ -3322,6 +3540,13 @@ var ConfigReloader = class {
       });
       console.log("Config reload: plugins reloaded.");
     }
+    if (plan.reloadMcp) {
+      await this.reloadMcp({
+        config: nextConfig,
+        changedPaths
+      });
+      console.log("Config reload: MCP servers reloaded.");
+    }
     if (plan.restartChannels || reloadPluginsResult?.restartChannels) {
       await this.reloadChannels(nextConfig);
       console.log("Config reload: channels restarted.");
@@ -3423,6 +3648,12 @@ var ConfigReloader = class {
     }
     return await this.options.reloadPlugins(params);
   }
+  async reloadMcp(params) {
+    if (!this.options.reloadMcp) {
+      return;
+    }
+    await this.options.reloadMcp(params);
+  }
 };
 
 // src/cli/missing-provider.ts
@@ -4052,7 +4283,9 @@ var resolveCliSubcommandEntry = (params) => {
 import {
   DisposableStore
 } from "@nextclaw/core";
+import { McpRegistryService as McpRegistryService2, McpServerLifecycleManager } from "@nextclaw/mcp";
 import { DefaultNcpAgentRuntime } from "@nextclaw/ncp-agent-runtime";
+import { McpNcpToolRegistryAdapter } from "@nextclaw/ncp-mcp";
 import {
   readAssistantReasoningNormalizationMode,
   readAssistantReasoningNormalizationModeFromMetadata,
@@ -4346,6 +4579,7 @@ var NextclawNcpToolRegistry = class {
     this.tools.clear();
     this.registerDefaultTools(context);
     this.registerExtensionTools(context);
+    this.registerAdditionalTools(context);
   }
   listTools() {
     return [...this.tools.values()];
@@ -4361,7 +4595,10 @@ var NextclawNcpToolRegistry = class {
     }));
   }
   async execute(toolCallId, toolName, args) {
-    return this.registry.execute(toolName, toToolParams(args), toolCallId);
+    if (this.registry.has(toolName)) {
+      return this.registry.execute(toolName, toToolParams(args), toolCallId);
+    }
+    return this.tools.get(toolName)?.execute(args);
   }
   registerDefaultTools(context) {
     const allowedDir = context.restrictToWorkspace ? context.workspace : void 0;
@@ -4450,6 +4687,15 @@ var NextclawNcpToolRegistry = class {
       new CoreToolNcpAdapter(tool, async (toolName, args) => this.registry.execute(toolName, toToolParams(args)))
     );
   }
+  registerAdditionalTools(context) {
+    const tools = this.options.getAdditionalTools?.(context) ?? [];
+    for (const tool of tools) {
+      if (this.tools.has(tool.name)) {
+        continue;
+      }
+      this.tools.set(tool.name, tool);
+    }
+  }
 };
 function resolveAgentHandoffDepth(metadata) {
   const rawDepth = Number(metadata.agent_handoff_depth ?? 0);
@@ -4505,7 +4751,7 @@ function resolveRequestedToolNames(metadata) {
     )
   );
 }
-function normalizeOptionalString2(value) {
+function normalizeOptionalString3(value) {
   return normalizeString(value) ?? void 0;
 }
 function readMetadataModel(metadata) {
@@ -4625,7 +4871,7 @@ var NextclawNcpContextBuilder = class {
     if (inboundModel) {
       session.metadata.preferred_model = inboundModel;
     }
-    const effectiveModel = normalizeOptionalString2(session.metadata.preferred_model) ?? profile.model;
+    const effectiveModel = normalizeOptionalString3(session.metadata.preferred_model) ?? profile.model;
     const clearThinking = requestMetadata.clear_thinking === true || requestMetadata.reset_thinking === true;
     if (clearThinking) {
       delete session.metadata.preferred_thinking;
@@ -4642,8 +4888,8 @@ var NextclawNcpContextBuilder = class {
       model: effectiveModel,
       sessionThinkingLevel: parseThinkingLevel(session.metadata.preferred_thinking) ?? null
     });
-    const channel = normalizeOptionalString2(requestMetadata.channel) ?? normalizeOptionalString2(session.metadata.last_channel) ?? "ui";
-    const chatId = normalizeOptionalString2(requestMetadata.chatId) ?? normalizeOptionalString2(requestMetadata.chat_id) ?? normalizeOptionalString2(session.metadata.last_to) ?? "web-ui";
+    const channel = normalizeOptionalString3(requestMetadata.channel) ?? normalizeOptionalString3(session.metadata.last_channel) ?? "ui";
+    const chatId = normalizeOptionalString3(requestMetadata.chatId) ?? normalizeOptionalString3(requestMetadata.chat_id) ?? normalizeOptionalString3(session.metadata.last_to) ?? "web-ui";
     session.metadata.last_channel = channel;
     session.metadata.last_to = chatId;
     const requestedSkillNames = resolveRequestedSkillNames(requestMetadata);
@@ -5222,6 +5468,21 @@ function buildPluginRuntimeSnapshotKey(extensionRegistry) {
 async function createUiNcpAgent(params) {
   const sessionStore = new NextclawAgentSessionStore(params.sessionManager);
   const runtimeRegistry = new UiNcpRuntimeRegistry();
+  let currentMcpConfig = params.getConfig();
+  const mcpLifecycleManager = new McpServerLifecycleManager({
+    getConfig: () => currentMcpConfig
+  });
+  const mcpRegistryService = new McpRegistryService2({
+    getConfig: () => currentMcpConfig,
+    lifecycleManager: mcpLifecycleManager
+  });
+  const mcpPrewarmResults = await mcpRegistryService.prewarmEnabledServers();
+  for (const result of mcpPrewarmResults) {
+    if (!result.ok) {
+      console.warn(`[mcp] Failed to warm ${result.name}: ${result.error}`);
+    }
+  }
+  const mcpToolRegistryAdapter = new McpNcpToolRegistryAdapter(mcpRegistryService);
   runtimeRegistry.register({
     kind: "native",
     label: "Native",
@@ -5245,7 +5506,10 @@ async function createUiNcpAgent(params) {
         cronService: params.cronService,
         gatewayController: params.gatewayController,
         getConfig: params.getConfig,
-        getExtensionRegistry: params.getExtensionRegistry
+        getExtensionRegistry: params.getExtensionRegistry,
+        getAdditionalTools: (context) => mcpToolRegistryAdapter.listToolsForRun({
+          agentId: context.agentId
+        })
       });
       return new DefaultNcpAgentRuntime({
         contextBuilder: new NextclawNcpContextBuilder({
@@ -5314,6 +5578,19 @@ async function createUiNcpAgent(params) {
     applyExtensionRegistry: (extensionRegistry) => {
       activeExtensionRegistry = extensionRegistry;
       syncPluginRuntimeRegistrations(extensionRegistry);
+    },
+    applyMcpConfig: async (config2) => {
+      const previousConfig = currentMcpConfig;
+      currentMcpConfig = config2;
+      const reconcileResult = await mcpRegistryService.reconcileConfig({
+        prevConfig: previousConfig,
+        nextConfig: config2
+      });
+      for (const warmResult of reconcileResult.warmed) {
+        if (!warmResult.ok) {
+          console.warn(`[mcp] Failed to warm ${warmResult.name}: ${warmResult.error}`);
+        }
+      }
     }
   };
 }
@@ -5994,11 +6271,11 @@ var {
   getWorkspacePath: getWorkspacePath8,
   HeartbeatService,
   LiteLLMProvider,
-  loadConfig: loadConfig7,
+  loadConfig: loadConfig8,
   MessageBus,
   ProviderManager,
   resolveConfigSecrets: resolveConfigSecrets2,
-  saveConfig: saveConfig5,
+  saveConfig: saveConfig6,
   SessionManager,
   parseAgentScopedSessionKey: parseAgentScopedSessionKey3
 } = NextclawCore;
@@ -6019,7 +6296,7 @@ var ServiceCommands = class {
     this.applyLiveConfigReload = null;
     this.liveUiNcpAgent = null;
     const runtimeConfigPath = getConfigPath3();
-    const config2 = resolveConfigSecrets2(loadConfig7(), { configPath: runtimeConfigPath });
+    const config2 = resolveConfigSecrets2(loadConfig8(), { configPath: runtimeConfigPath });
     const workspace = getWorkspacePath8(config2.agents.defaults.workspace);
     let pluginRegistry = loadPluginRegistry(config2, workspace);
     let extensionRegistry = toExtensionRegistry(pluginRegistry);
@@ -6064,7 +6341,7 @@ var ServiceCommands = class {
       sessionManager,
       providerManager,
       makeProvider: (nextConfig) => this.makeProvider(nextConfig, { allowMissing: true }) ?? this.makeMissingProvider(nextConfig),
-      loadConfig: () => resolveConfigSecrets2(loadConfig7(), { configPath: runtimeConfigPath }),
+      loadConfig: () => resolveConfigSecrets2(loadConfig8(), { configPath: runtimeConfigPath }),
       getExtensionChannels: () => extensionRegistry.channels,
       onRestartRequired: (paths) => {
         void this.deps.requestRestart({
@@ -6075,14 +6352,14 @@ var ServiceCommands = class {
       }
     });
     this.applyLiveConfigReload = async () => {
-      await reloader.applyReloadPlan(resolveConfigSecrets2(loadConfig7(), { configPath: runtimeConfigPath }));
+      await reloader.applyReloadPlan(resolveConfigSecrets2(loadConfig8(), { configPath: runtimeConfigPath }));
     };
     const gatewayController = new GatewayControllerImpl({
       reloader,
       cron: cron2,
       sessionManager,
       getConfigPath: getConfigPath3,
-      saveConfig: saveConfig5,
+      saveConfig: saveConfig6,
       requestRestart: async (options2) => {
         await this.deps.requestRestart({
           reason: options2?.reason ?? "gateway tool restart",
@@ -6108,7 +6385,7 @@ var ServiceCommands = class {
       resolveMessageToolHints: ({ channel, accountId }) => resolvePluginChannelMessageToolHints({
         registry: pluginRegistry,
         channel,
-        cfg: resolveConfigSecrets2(loadConfig7(), { configPath: runtimeConfigPath }),
+        cfg: resolveConfigSecrets2(loadConfig8(), { configPath: runtimeConfigPath }),
         accountId
       })
     });
@@ -6136,16 +6413,19 @@ var ServiceCommands = class {
       }
       return { restartChannels: result.restartChannels };
     });
+    reloader.setReloadMcp(async ({ config: nextConfig }) => {
+      await this.liveUiNcpAgent?.applyMcpConfig?.(nextConfig);
+    });
     let pluginChannelBindings = getPluginChannelBindings3(pluginRegistry);
     setPluginRuntimeBridge({
-      loadConfig: () => toPluginConfigView(resolveConfigSecrets2(loadConfig7(), { configPath: runtimeConfigPath }), pluginChannelBindings),
+      loadConfig: () => toPluginConfigView(resolveConfigSecrets2(loadConfig8(), { configPath: runtimeConfigPath }), pluginChannelBindings),
       writeConfigFile: async (nextConfigView) => {
         if (!nextConfigView || typeof nextConfigView !== "object" || Array.isArray(nextConfigView)) {
           throw new Error("plugin runtime writeConfigFile expects an object config");
         }
-        const current = loadConfig7();
+        const current = loadConfig8();
         const next = mergePluginConfigView(current, nextConfigView, pluginChannelBindings);
-        saveConfig5(next);
+        saveConfig6(next);
       },
       dispatchReplyWithBufferedBlockDispatcher: async ({ ctx, dispatcherOptions }) => {
         const bodyForAgent = typeof ctx.BodyForAgent === "string" ? ctx.BodyForAgent : "";
@@ -6219,12 +6499,12 @@ var ServiceCommands = class {
       providerManager,
       bus,
       gatewayController,
-      () => resolveConfigSecrets2(loadConfig7(), { configPath: runtimeConfigPath }),
+      () => resolveConfigSecrets2(loadConfig8(), { configPath: runtimeConfigPath }),
       () => extensionRegistry,
       ({ channel, accountId }) => resolvePluginChannelMessageToolHints({
         registry: pluginRegistry,
         channel,
-        cfg: resolveConfigSecrets2(loadConfig7(), { configPath: runtimeConfigPath }),
+        cfg: resolveConfigSecrets2(loadConfig8(), { configPath: runtimeConfigPath }),
         accountId
       })
     );
@@ -6233,27 +6513,7 @@ var ServiceCommands = class {
       console.log(`\u2713 Cron: ${cronStatus.jobs} scheduled jobs`);
     }
     console.log("\u2713 Heartbeat: every 30m");
-    const configPath = resolve10(getConfigPath3());
-    const watcher = chokidar.watch(configPath, {
-      ignoreInitial: true,
-      awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 }
-    });
-    watcher.on("all", (event, changedPath) => {
-      if (resolve10(changedPath) !== configPath) {
-        return;
-      }
-      if (event === "add") {
-        reloader.scheduleReload("config add");
-        return;
-      }
-      if (event === "change") {
-        reloader.scheduleReload("config change");
-        return;
-      }
-      if (event === "unlink") {
-        reloader.scheduleReload("config unlink");
-      }
-    });
+    this.watchConfigFile(reloader);
     await cron2.start();
     await heartbeat.start();
     try {
@@ -6280,6 +6540,29 @@ var ServiceCommands = class {
     const trimmed = value.trim();
     return trimmed || void 0;
   }
+  watchConfigFile(reloader) {
+    const configPath = resolve10(getConfigPath3());
+    const watcher = chokidar.watch(configPath, {
+      ignoreInitial: true,
+      awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 }
+    });
+    watcher.on("all", (event, changedPath) => {
+      if (resolve10(changedPath) !== configPath) {
+        return;
+      }
+      if (event === "add") {
+        reloader.scheduleReload("config add");
+        return;
+      }
+      if (event === "change") {
+        reloader.scheduleReload("config change");
+        return;
+      }
+      if (event === "unlink") {
+        reloader.scheduleReload("config unlink");
+      }
+    });
+  }
   resolveMostRecentRoutableSessionKey(sessionManager) {
     const sessions = sessionManager.listSessions();
     let best = null;
@@ -6379,7 +6662,7 @@ var ServiceCommands = class {
     });
   }
   async runForeground(options) {
-    const config2 = loadConfig7();
+    const config2 = loadConfig8();
     const uiConfig = resolveUiConfig(config2, options.uiOverrides);
     const uiUrl = resolveUiApiBase(uiConfig.host, uiConfig.port);
     if (options.open) {
@@ -6392,7 +6675,7 @@ var ServiceCommands = class {
     });
   }
   async startService(options) {
-    const config2 = loadConfig7();
+    const config2 = loadConfig8();
     const uiConfig = resolveUiConfig(config2, options.uiOverrides);
     const uiUrl = resolveUiApiBase(uiConfig.host, uiConfig.port);
     const apiUrl = `${uiUrl}/api`;
@@ -7038,7 +7321,7 @@ var ServiceCommands = class {
     if (params.kind && params.kind !== "marketplace") {
       throw new Error(`Unsupported marketplace skill kind: ${params.kind}`);
     }
-    const workspace = getWorkspacePath8(loadConfig7().agents.defaults.workspace);
+    const workspace = getWorkspacePath8(loadConfig8().agents.defaults.workspace);
     const args = buildMarketplaceSkillInstallArgs({
       slug: params.slug,
       workspace,
@@ -7074,7 +7357,7 @@ var ServiceCommands = class {
     return { message: result.message };
   }
   async uninstallMarketplaceSkill(slug) {
-    const workspace = getWorkspacePath8(loadConfig7().agents.defaults.workspace);
+    const workspace = getWorkspacePath8(loadConfig8().agents.defaults.workspace);
     const targetDir = join5(workspace, "skills", slug);
     if (!existsSync9(targetDir)) {
       throw new Error(`Skill not installed in workspace: ${slug}`);
@@ -7085,7 +7368,7 @@ var ServiceCommands = class {
     };
   }
   installBuiltinMarketplaceSkill(slug, force) {
-    const workspace = getWorkspacePath8(loadConfig7().agents.defaults.workspace);
+    const workspace = getWorkspacePath8(loadConfig8().agents.defaults.workspace);
     const destination = join5(workspace, "skills", slug);
     const destinationSkillFile = join5(destination, "SKILL.md");
     if (existsSync9(destinationSkillFile) && !force) {
@@ -7359,6 +7642,7 @@ var CliRuntime = class {
   workspaceManager;
   serviceCommands;
   configCommands;
+  mcpCommands;
   secretsCommands;
   pluginCommands;
   channelCommands;
@@ -7373,6 +7657,7 @@ var CliRuntime = class {
     this.configCommands = new ConfigCommands({
       requestRestart: (params) => this.requestRestart(params)
     });
+    this.mcpCommands = new McpCommands();
     this.secretsCommands = new SecretsCommands({
       requestRestart: (params) => this.requestRestart(params)
     });
@@ -7580,10 +7865,10 @@ var CliRuntime = class {
     let createdConfig = false;
     if (!existsSync11(configPath)) {
       const config3 = ConfigSchema2.parse({});
-      saveConfig6(config3);
+      saveConfig7(config3);
       createdConfig = true;
     }
-    const config2 = loadConfig8();
+    const config2 = loadConfig9();
     const workspaceSetting = config2.agents.defaults.workspace;
     const workspacePath = !workspaceSetting || workspaceSetting === DEFAULT_WORKSPACE_PATH ? join7(getDataDir8(), DEFAULT_WORKSPACE_DIR) : expandHome2(workspaceSetting);
     const workspaceExisted = existsSync11(workspacePath);
@@ -7619,7 +7904,7 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
   async login(opts = {}) {
     await this.init({ source: "login", auto: true });
     const configPath = getConfigPath4();
-    const config2 = loadConfig8(configPath);
+    const config2 = loadConfig9(configPath);
     const providers = config2.providers;
     const nextclawProvider = providers.nextclaw ?? {
       displayName: "",
@@ -7681,7 +7966,7 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
     nextclawProvider.apiBase = v1Base;
     nextclawProvider.apiKey = token;
     providers.nextclaw = nextclawProvider;
-    saveConfig6(config2, configPath);
+    saveConfig7(config2, configPath);
     console.log(`\u2713 Logged in to NextClaw platform (${platformBase})`);
     console.log(`\u2713 Account: ${email} (${role})`);
     console.log(`\u2713 Token saved into providers.nextclaw.apiKey`);
@@ -7776,7 +8061,7 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
   }
   async agent(opts) {
     const configPath = getConfigPath4();
-    const config2 = resolveConfigSecrets3(loadConfig8(), { configPath });
+    const config2 = resolveConfigSecrets3(loadConfig9(), { configPath });
     const workspace = getWorkspacePath9(config2.agents.defaults.workspace);
     const pluginRegistry = loadPluginRegistry(config2, workspace);
     const extensionRegistry = toExtensionRegistry(pluginRegistry);
@@ -7784,7 +8069,7 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
     const pluginChannelBindings = getPluginChannelBindings4(pluginRegistry);
     setPluginRuntimeBridge2({
       loadConfig: () => toPluginConfigView(
-        resolveConfigSecrets3(loadConfig8(), { configPath }),
+        resolveConfigSecrets3(loadConfig9(), { configPath }),
         pluginChannelBindings
       ),
       writeConfigFile: async (nextConfigView) => {
@@ -7793,13 +8078,13 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
             "plugin runtime writeConfigFile expects an object config"
           );
         }
-        const current = loadConfig8();
+        const current = loadConfig9();
         const next = mergePluginConfigView(
           current,
           nextConfigView,
           pluginChannelBindings
         );
-        saveConfig6(next);
+        saveConfig7(next);
       }
     });
     try {
@@ -7825,7 +8110,7 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
         resolveMessageToolHints: ({ channel, accountId }) => resolvePluginChannelMessageToolHints2({
           registry: pluginRegistry,
           channel,
-          cfg: resolveConfigSecrets3(loadConfig8(), { configPath }),
+          cfg: resolveConfigSecrets3(loadConfig9(), { configPath }),
           accountId
         })
       });
@@ -7959,6 +8244,24 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
   async configUnset(pathExpr) {
     await this.configCommands.configUnset(pathExpr);
   }
+  mcpList(opts = {}) {
+    this.mcpCommands.mcpList(opts);
+  }
+  async mcpAdd(name, command, opts = {}) {
+    await this.mcpCommands.mcpAdd(name, command, opts);
+  }
+  async mcpRemove(name) {
+    await this.mcpCommands.mcpRemove(name);
+  }
+  async mcpEnable(name) {
+    await this.mcpCommands.mcpEnable(name);
+  }
+  async mcpDisable(name) {
+    await this.mcpCommands.mcpDisable(name);
+  }
+  async mcpDoctor(name, opts = {}) {
+    await this.mcpCommands.mcpDoctor(name, opts);
+  }
   secretsAudit(opts = {}) {
     this.secretsCommands.secretsAudit(opts);
   }
@@ -8002,7 +8305,7 @@ ${this.logo} ${APP_NAME4} is ready! (${source})`);
     await this.diagnosticsCommands.doctor(opts);
   }
   async skillsInstall(options) {
-    const config2 = loadConfig8();
+    const config2 = loadConfig9();
     const workdir = resolveSkillsInstallWorkdir({
       explicitWorkdir: options.workdir,
       configuredWorkspace: config2.agents.defaults.workspace
@@ -8095,6 +8398,13 @@ var config = program.command("config").description("Manage config values");
 config.command("get <path>").description("Get a config value by dot path").option("--json", "Output JSON", false).action((path2, opts) => runtime.configGet(path2, opts));
 config.command("set <path> <value>").description("Set a config value by dot path").option("--json", "Parse value as JSON", false).action((path2, value, opts) => runtime.configSet(path2, value, opts));
 config.command("unset <path>").description("Remove a config value by dot path").action((path2) => runtime.configUnset(path2));
+var mcp = program.command("mcp").description("Manage MCP servers");
+mcp.command("list").description("List configured MCP servers").option("--json", "Output JSON", false).action((opts) => runtime.mcpList(opts));
+mcp.command("add <name> [command...]").description("Add an MCP server (stdio by default, or use --transport http|sse)").allowUnknownOption(true).option("--transport <type>", "Transport type: stdio|http|sse", "stdio").option("--url <url>", "HTTP/SSE endpoint URL").option("--header <key=value>", "Transport header (repeatable)", withRepeatableTag, []).option("--env <key=value>", "stdio env var (repeatable)", withRepeatableTag, []).option("--cwd <dir>", "stdio working directory").option("--timeout-ms <ms>", "HTTP/SSE timeout in milliseconds").option("--stderr <mode>", "stdio stderr handling: inherit|pipe|ignore", "pipe").option("--disabled", "Create the server in disabled state", false).option("--all-agents", "Expose this server to all agents", false).option("--agent <id>", "Expose to an agent id (repeatable)", withRepeatableTag, []).option("--insecure", "Disable TLS verification for HTTP/SSE", false).action(async (name, command, opts) => runtime.mcpAdd(name, command ?? [], opts));
+mcp.command("remove <name>").description("Remove an MCP server").action(async (name) => runtime.mcpRemove(name));
+mcp.command("enable <name>").description("Enable an MCP server").action(async (name) => runtime.mcpEnable(name));
+mcp.command("disable <name>").description("Disable an MCP server").action(async (name) => runtime.mcpDisable(name));
+mcp.command("doctor [name]").description("Check MCP server connectivity and tool discovery").option("--json", "Output JSON", false).action(async (name, opts) => runtime.mcpDoctor(name, opts));
 var secrets = program.command("secrets").description("Manage secrets refs/providers");
 secrets.command("audit").description("Audit secret refs resolution status").option("--json", "Output JSON", false).option("--strict", "Exit non-zero when unresolved refs exist", false).action((opts) => runtime.secretsAudit(opts));
 secrets.command("configure").description("Configure a secret provider alias").requiredOption("--provider <alias>", "Provider alias").option("--source <source>", "Provider source (env|file|exec)").option("--prefix <prefix>", "Env key prefix (env source)").option("--path <path>", "Secret JSON file path (file source)").option("--command <command>", "Command for exec source").option(