tsugite-mcp 0.27.0__tar.gz

tsugite_mcp-0.27.0/.gitignore

@@ -0,0 +1,201 @@
+# ---> Python
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+/lib/
+/lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#pdm.lock
+#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
+#   in version control.
+#   https://pdm.fming.dev/latest/usage/project/#working-with-version-control
+.pdm.toml
+.pdm-python
+.pdm-build/
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+.env
+.env
+benchmark_results/
+test_output/
+.claude/settings.local.json
+std*.txt
+secrets/*
+
+
+# TODO: temp - I need to clean up the docs
+docs-old/
+docs/design/
+examples/*
+!examples/tsugite-example-plugin/
+/agents/
+.claude/
+.tsugite/
+benchmarks/
+docker-compose.test.yml
+#### TODO ^^^
+
+# Vite dep-optimizer cache. Normally under node_modules/.vite, but lands at the
+# cwd's `.vite/` when vite/vitest is run from the repo root, so ignore it anywhere.
+.vite/
+# Built web UI - generated by `mise run web-build`; the wheel bundles it via
+# hatch `artifacts`, git never carries it.
+plugins/tsugite-daemon/tsugite_daemon/web/
+# Re-include frontend source that generic lib/ rules (incl. contributors' global
+# gitignores with Python-style `lib/`) would otherwise silently exclude.
+!plugins/tsugite-daemon/frontend/src/lib/
+!plugins/tsugite-daemon/frontend/src/lib/**
+# Per-job git worktrees provisioned by the daemon.
+.tsugite-jobs/
+/packaging/runtime/.cache/
+# Corporate CA certs dropped in for docker build.
+/docker/ca-certificates/*
+!/docker/ca-certificates/.gitkeep

tsugite_mcp-0.27.0/PKG-INFO

@@ -0,0 +1,9 @@
+Metadata-Version: 2.5
+Name: tsugite-mcp
+Version: 0.27.0
+Summary: Tsugite plugin: remote MCP servers over Streamable HTTP with OAuth sign-in
+Author: Justyn Shull
+Requires-Python: >=3.11
+Requires-Dist: mcp<2,>=1.30
+Requires-Dist: tsugite-cli==0.27.0
+Requires-Dist: tsugite-daemon==0.27.0

tsugite_mcp-0.27.0/pyproject.toml

@@ -0,0 +1,34 @@
+[project]
+name = "tsugite-mcp"
+version = "0.27.0"
+description = "Tsugite plugin: remote MCP servers over Streamable HTTP with OAuth sign-in"
+authors = [{ name = "Justyn Shull" }]
+requires-python = ">=3.11"
+dependencies = [
+  "tsugite-cli==0.27.0",
+  "tsugite-daemon==0.27.0",
+  "mcp>=1.30,<2",
+]
+
+[project.entry-points."tsugite.plugins"]
+mcp = "tsugite_mcp.tools"
+
+[project.entry-points."tsugite.adapters"]
+mcp = "tsugite_mcp.adapter:create_adapter"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["tsugite_mcp"]
+
+[tool.hatch.build.targets.sdist]
+include = [
+  "/tsugite_mcp",
+  "/pyproject.toml",
+]
+
+[tool.uv.sources]
+tsugite-cli = { workspace = true }
+tsugite-daemon = { workspace = true }

tsugite_mcp-0.27.0/tsugite_mcp/__init__.py

@@ -0,0 +1 @@
+"""Tsugite plugin: remote MCP servers over Streamable HTTP with OAuth sign-in."""

tsugite_mcp-0.27.0/tsugite_mcp/adapter.py

@@ -0,0 +1,473 @@
+"""The MCP plugin's daemon adapter: the server list, OAuth sign-in, tool calls and HTTP routes."""
+
+import asyncio
+import contextlib
+import json
+import logging
+import re
+from dataclasses import dataclass, field
+from ipaddress import ip_address
+from pathlib import Path
+from urllib.parse import parse_qs, urlparse
+
+import httpx
+from mcp import ClientSession
+from mcp.client.auth import OAuthClientProvider, OAuthFlowError
+from mcp.client.auth.utils import (
+    build_oauth_authorization_server_metadata_discovery_urls,
+    build_protected_resource_metadata_discovery_urls,
+    handle_auth_metadata_response,
+    handle_protected_resource_response,
+)
+from mcp.client.streamable_http import streamable_http_client
+from mcp.shared._httpx_utils import create_mcp_http_client
+from mcp.shared.auth import OAuthClientMetadata
+from starlette.datastructures import QueryParams
+from starlette.requests import Request
+from starlette.responses import HTMLResponse, JSONResponse
+from starlette.routing import Route
+from tsugite_daemon.adapters.base import BaseAdapter
+
+from tsugite.config import get_xdg_data_path
+from tsugite.secrets.registry import get_registry
+from tsugite_mcp import tools
+from tsugite_mcp.storage import NO_REDIRECT, SecretStorage
+
+logger = logging.getLogger(__name__)
+
+NAME_PATTERN = re.compile(r"[a-z][a-z0-9]{0,23}")
+CALLBACK_PATH = "/api/plugins/mcp/callback"
+# Registered with servers that reject the daemon's own redirect. Nothing listens on it.
+LOOPBACK_REDIRECT = "http://127.0.0.1" + CALLBACK_PATH
+LIST_TIMEOUT = 30
+SIGNIN_TIMEOUT = 300
+NEEDS_CLIENT = (
+    "This server does not offer dynamic client registration. Register Tsugite in the provider's developer "
+    "console with the redirect URL shown above, then edit this server and enter the client ID and secret."
+)
+HTML = "<!doctype html><meta charset=utf-8><title>Tsugite</title><p>{}</p>"
+
+
+@dataclass
+class Server:
+    name: str
+    url: str
+    status: str = "connecting"
+    error: str | None = None
+    tools: list = field(default_factory=list)
+
+
+def _leaves(exc: BaseException):
+    """The exceptions inside nested exception groups, which the SDK's task groups wrap errors in."""
+    if isinstance(exc, BaseExceptionGroup):
+        for inner in exc.exceptions:
+            yield from _leaves(inner)
+    else:
+        yield exc
+
+
+def _needs_signin(exc: BaseException) -> bool:
+    return any(
+        type(leaf) is OAuthFlowError or (isinstance(leaf, httpx.HTTPStatusError) and leaf.response.status_code == 401)
+        for leaf in _leaves(exc)
+    )
+
+
+def _describe(exc: BaseException) -> str:
+    text = "; ".join(f"{type(leaf).__name__}: {leaf}" for leaf in _leaves(exc))
+    return get_registry().mask(text)
+
+
+def pick_auth_method(supported: list[str] | None, has_secret: bool) -> str:
+    """The token endpoint auth method for a user-entered client, from the server's metadata."""
+    supported = supported or ["client_secret_basic"]
+    for method in ("client_secret_basic", "client_secret_post") if has_secret else ("none",):
+        if method in supported:
+            return method
+    kind = "with" if has_secret else "without"
+    raise RuntimeError(
+        f"the server's token endpoint accepts {', '.join(supported)}, which does not fit a client {kind} a secret"
+    )
+
+
+class _Provider(OAuthClientProvider):
+    async def _exchange_token_authorization_code(self, *args, **kwargs):
+        storage = self.context.storage
+        if storage.using_preset and self.context.oauth_metadata:
+            info = self.context.client_info
+            method = pick_auth_method(
+                self.context.oauth_metadata.token_endpoint_auth_methods_supported, bool(info.client_secret)
+            )
+            info.token_endpoint_auth_method = method
+            await storage.set_preset({**(await storage.get_preset()), "auth_method": method})
+        return await super()._exchange_token_authorization_code(*args, **kwargs)
+
+
+def validate_server(name: str, url: str) -> None:
+    if not NAME_PATTERN.fullmatch(name):
+        raise ValueError("name must be 1-24 lowercase letters and digits, starting with a letter")
+    parsed = urlparse(url)
+    loopback = parsed.hostname == "localhost"
+    if parsed.hostname and not loopback:
+        with contextlib.suppress(ValueError):
+            loopback = ip_address(parsed.hostname).is_loopback
+    if parsed.scheme != "https" and not (parsed.scheme == "http" and loopback):
+        raise ValueError("url must be https (http is allowed for localhost)")
+    if not parsed.hostname:
+        raise ValueError("url needs a host")
+
+
+class McpAdapter(BaseAdapter):
+    def __init__(self, path: Path, client_factory=create_mcp_http_client):
+        # Not agent-scoped, so BaseAdapter.__init__ is skipped.
+        self.event_bus = None
+        self.loop: asyncio.AbstractEventLoop | None = None
+        self.path = path
+        self.client_factory = client_factory
+        self.servers = {name: Server(name, url) for name, url in self._read().items()}
+        self._signins: dict[str, asyncio.Task] = {}
+        # state -> the future the OAuth callback route resolves with (code, state)
+        self._flows: dict[str, asyncio.Future] = {}
+        self._startup: asyncio.Future | None = None
+
+    def _read(self) -> dict[str, str]:
+        return json.loads(self.path.read_text()) if self.path.exists() else {}
+
+    def _write(self) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps({s.name: s.url for s in self.servers.values()}, indent=2))
+
+    async def start(self) -> None:
+        self.loop = asyncio.get_running_loop()
+        tools.set_adapter(self)
+        self._startup = asyncio.gather(*(self.refresh(name) for name in self.servers))
+
+    async def stop(self) -> None:
+        tools.set_adapter(None)
+        for task in [self._startup, *self._signins.values()]:
+            if task is not None:
+                task.cancel()
+        for name in self.servers:
+            tools.clear_tools(name)
+
+    @contextlib.asynccontextmanager
+    async def _session(self, server: Server, signin=None):
+        """An initialized session. `signin` is (redirect_uri, redirect_handler, callback_handler).
+
+        Without it, auth is attached only when tokens exist, and a server that needs a new
+        sign-in fails with an error `_needs_signin` recognizes.
+        """
+        storage = SecretStorage(server.name)
+        auth = None
+        if signin or await storage.get_tokens():
+            redirect_uri, redirect_handler, callback_handler = signin or (NO_REDIRECT, None, None)
+            auth = _Provider(
+                server.url,
+                OAuthClientMetadata(
+                    client_name="Tsugite",
+                    redirect_uris=[redirect_uri],
+                    grant_types=["authorization_code", "refresh_token"],
+                    response_types=["code"],
+                    token_endpoint_auth_method="none",
+                ),
+                storage,
+                redirect_handler,
+                callback_handler,
+            )
+            auth.context.token_expiry_time = await storage.expires_at()
+        async with self.client_factory(auth=auth) as http_client:
+            async with streamable_http_client(server.url, http_client=http_client) as streams:
+                async with ClientSession(streams[0], streams[1]) as session:
+                    await session.initialize()
+                    yield session
+
+    def _cancel_signin(self, name: str) -> None:
+        if task := self._signins.pop(name, None):
+            task.cancel()
+
+    async def refresh(self, name: str, signin=None) -> None:
+        """Connect to the server and replace its status and tools."""
+        if not signin:
+            self._cancel_signin(name)
+        server = self.servers[name]
+        server.status = "connecting"
+        try:
+            async with asyncio.timeout(SIGNIN_TIMEOUT if signin else LIST_TIMEOUT):
+                async with self._session(server, signin) as session:
+                    listed = (await session.list_tools()).tools
+            if self.servers.get(name) is not server:
+                return
+            registered = tools.set_tools(name, listed)
+        except Exception as exc:
+            server.status, server.error, server.tools = "error", _describe(exc), []
+            if _needs_signin(exc):
+                server.status, server.error = "needs_signin", None
+                await self._check_client(server)
+            tools.clear_tools(name)
+            return
+        server.status, server.error, server.tools = "connected", None, registered
+
+    async def _check_client(self, server: Server) -> None:
+        """Flag a server that needs a client the user has not entered, because it cannot register one itself."""
+        storage = SecretStorage(server.name)
+        if await storage.get_preset() or await storage.get_registration():
+            return
+        try:
+            dynamic = await self._registers_dynamically(server)
+        except Exception as exc:
+            server.status, server.error = "error", _describe(exc)
+            return
+        if not dynamic:
+            server.status, server.error = "needs_client", NEEDS_CLIENT
+
+    async def _registers_dynamically(self, server: Server) -> bool:
+        """Whether the authorization server advertises a registration endpoint. True when no metadata is found."""
+        async with self.client_factory() as http:
+            auth_server = None
+            for url in build_protected_resource_metadata_discovery_urls(None, server.url):
+                if resource := await handle_protected_resource_response(await http.get(url)):
+                    auth_server = str(resource.authorization_servers[0])
+                    break
+            for url in build_oauth_authorization_server_metadata_discovery_urls(auth_server, server.url):
+                ok, metadata = await handle_auth_metadata_response(await http.get(url))
+                if metadata:
+                    return metadata.registration_endpoint is not None
+                if not ok:
+                    break
+        return True
+
+    async def call_tool(self, name: str, tool: str, arguments: dict) -> str:
+        server = self.servers[name]
+        try:
+            async with self._session(server) as session:
+                result = await session.call_tool(tool, arguments)
+        except Exception as exc:
+            if _needs_signin(exc):
+                server.status, server.error = "needs_signin", None
+                raise RuntimeError(f"{name} needs sign-in, open Connectors") from None
+            raise RuntimeError(_describe(exc)) from None
+        text = "\n".join(c.text if c.type == "text" else f"[{c.type} content omitted]" for c in result.content)
+        text = get_registry().mask(text)
+        if result.isError:
+            raise RuntimeError(text)
+        return text
+
+    async def add(self, name: str, url: str, client_id: str = "", client_secret: str = "") -> Server:
+        validate_server(name, url)
+        if name in self.servers:
+            raise ValueError(f"{name} is already connected")
+        if client_secret and not client_id:
+            raise ValueError("a client secret needs a client ID")
+        self.servers[name] = Server(name, url)
+        self._write()
+        if client_id:
+            await self._save_client(name, client_id, client_secret, False)
+        await self.refresh(name)
+        return self.servers[name]
+
+    async def _save_client(self, name: str, client_id: str, client_secret: str, clear_secret: bool) -> None:
+        """Store the user's client, or remove it when `client_id` is empty. An empty secret keeps the saved one for the same ID."""
+        storage = SecretStorage(name)
+        old = await storage.get_preset() or {}
+        record = {"client_id": client_id} if client_id else None
+        kept = "" if clear_secret or client_id != old.get("client_id") else old.get("client_secret", "")
+        secret = client_secret or kept
+        if record and secret:
+            record["client_secret"] = secret
+        if (record or {}) == {k: v for k, v in old.items() if k != "auth_method"}:
+            return
+        await storage.delete_registration()
+        await storage.set_preset(record)
+
+    async def update(self, name: str, client_id: str, client_secret: str = "", clear_secret: bool = False) -> None:
+        if client_secret and not client_id:
+            raise ValueError("a client secret needs a client ID")
+        await self._save_client(name, client_id, client_secret, clear_secret)
+        await self.refresh(name)
+
+    async def remove(self, name: str) -> None:
+        self._cancel_signin(name)
+        del self.servers[name]
+        self._write()
+        tools.clear_tools(name)
+        await SecretStorage(name).delete_all()
+
+    async def signin(self, name: str, redirect_base: str) -> tuple[str, bool]:
+        """Start the OAuth flow and return the URL the user opens and whether the user must paste the redirect back.
+
+        It finishes after the callback. A server that rejects the daemon's own redirect at registration gets the loopback one.
+        """
+        self._cancel_signin(name)
+        if self.servers[name].status == "needs_client":
+            raise RuntimeError(NEEDS_CLIENT)
+        storage = SecretStorage(name)
+        registered = await storage.get_registration()
+        uris = [str(uri) for uri in registered.redirect_uris] if registered else []
+        redirect_uri = LOOPBACK_REDIRECT if uris == [LOOPBACK_REDIRECT] else redirect_base.rstrip("/") + CALLBACK_PATH
+        if registered and uris != [redirect_uri]:
+            await storage.delete_registration()
+        try:
+            return await self._begin(name, redirect_uri), redirect_uri == LOOPBACK_REDIRECT
+        except RuntimeError as exc:
+            if redirect_uri == LOOPBACK_REDIRECT or "invalid_redirect_uri" not in str(exc):
+                raise
+        return await self._begin(name, LOOPBACK_REDIRECT), True
+
+    async def _begin(self, name: str, redirect_uri: str) -> str:
+        url_ready: asyncio.Future = self.loop.create_future()
+        state = None
+
+        async def redirect_handler(url: str) -> None:
+            nonlocal state
+            state = parse_qs(urlparse(url).query)["state"][0]
+            self._flows[state] = self.loop.create_future()
+            url_ready.set_result(url)
+
+        async def callback_handler() -> tuple[str, str]:
+            return await self._flows[state]
+
+        task = asyncio.create_task(self.refresh(name, (redirect_uri, redirect_handler, callback_handler)))
+        task.add_done_callback(lambda _: self._flows.pop(state, None))
+        self._signins[name] = task
+        await asyncio.wait({url_ready, task}, return_when=asyncio.FIRST_COMPLETED)
+        if not url_ready.done():
+            raise RuntimeError(self.servers[name].error or "the server did not ask for sign-in")
+        return url_ready.result()
+
+    def get_http_routes(self) -> list:
+        return [
+            Route("/servers", self._list, methods=["GET"]),
+            Route("/servers", self._add, methods=["POST"]),
+            Route("/servers/{name}", self._update, methods=["PUT"]),
+            Route("/servers/{name}", self._remove, methods=["DELETE"]),
+            Route("/servers/{name}/refresh", self._refresh, methods=["POST"]),
+            Route("/servers/{name}/signin", self._signin, methods=["POST"]),
+            Route("/paste", self._paste, methods=["POST"]),
+        ]
+
+    def get_public_http_routes(self) -> list:
+        # The browser's redirect cannot send the daemon token. A request is accepted only
+        # when its `state` matches a sign-in this process started.
+        return [Route("/callback", self._callback, methods=["GET"])]
+
+    async def _status(self) -> dict:
+        """The server list for the page. The client secret is reported only as `has_secret`."""
+        servers = []
+        for s in self.servers.values():
+            preset = await SecretStorage(s.name).get_preset() or {}
+            servers.append(
+                {
+                    "name": s.name,
+                    "url": s.url,
+                    "status": s.status,
+                    "error": s.error,
+                    "client_id": preset.get("client_id", ""),
+                    "has_secret": bool(preset.get("client_secret")),
+                    "tools": s.tools,
+                }
+            )
+        return {"servers": servers}
+
+    async def _list(self, request: Request) -> JSONResponse:
+        return JSONResponse(await self._status())
+
+    async def _add(self, request: Request) -> JSONResponse:
+        try:
+            body = await _body(request)
+            await self.add(
+                str(body.get("name", "")),
+                str(body.get("url", "")),
+                str(body.get("client_id", "")).strip(),
+                str(body.get("client_secret", "")).strip(),
+            )
+        except ValueError as exc:
+            return JSONResponse({"error": str(exc)}, status_code=400)
+        return JSONResponse(await self._status())
+
+    async def _update(self, request: Request) -> JSONResponse:
+        if (name := self._known(request)) is None:
+            return JSONResponse({"error": "no such server"}, status_code=404)
+        try:
+            body = await _body(request)
+            await self.update(
+                name,
+                str(body.get("client_id", "")).strip(),
+                str(body.get("client_secret", "")).strip(),
+                bool(body.get("clear_secret")),
+            )
+        except ValueError as exc:
+            return JSONResponse({"error": str(exc)}, status_code=400)
+        return JSONResponse(await self._status())
+
+    def _known(self, request: Request) -> str | None:
+        name = request.path_params["name"]
+        return name if name in self.servers else None
+
+    async def _remove(self, request: Request) -> JSONResponse:
+        if (name := self._known(request)) is None:
+            return JSONResponse({"error": "no such server"}, status_code=404)
+        await self.remove(name)
+        return JSONResponse(await self._status())
+
+    async def _refresh(self, request: Request) -> JSONResponse:
+        if (name := self._known(request)) is None:
+            return JSONResponse({"error": "no such server"}, status_code=404)
+        await self.refresh(name)
+        return JSONResponse(await self._status())
+
+    async def _signin(self, request: Request) -> JSONResponse:
+        if (name := self._known(request)) is None:
+            return JSONResponse({"error": "no such server"}, status_code=404)
+        try:
+            body = await _body(request)
+        except ValueError as exc:
+            return JSONResponse({"error": str(exc)}, status_code=400)
+        try:
+            url, paste_back = await self.signin(name, str(body.get("redirect_base", "")))
+        except Exception as exc:
+            return JSONResponse({"error": _describe(exc)}, status_code=502)
+        return JSONResponse({"authorization_url": url, "paste_back": paste_back})
+
+    def _finish(self, params) -> str | None:
+        """Give the callback's `code` to the sign-in waiting on its `state`. Returns an error message, or None."""
+        flow = self._flows.get(params.get("state", ""))
+        if flow is None or flow.done():
+            return "This sign-in link is unknown or expired."
+        if "code" in params:
+            flow.set_result((params["code"], params["state"]))
+            return None
+        flow.set_exception(RuntimeError(f"authorization denied: {params.get('error', 'no code returned')}"))
+        return "Sign-in was not completed."
+
+    async def _callback(self, request: Request) -> HTMLResponse:
+        if error := self._finish(request.query_params):
+            return HTMLResponse(HTML.format(f"{error} You can close this tab."), status_code=400)
+        return HTMLResponse(HTML.format("Signed in. You can close this tab."))
+
+    async def _paste(self, request: Request) -> JSONResponse:
+        try:
+            body = await _body(request)
+        except ValueError as exc:
+            return JSONResponse({"error": str(exc)}, status_code=400)
+        url = str(body.get("url", ""))
+        if error := self._finish(QueryParams(urlparse(url).query)):
+            return JSONResponse({"error": error}, status_code=400)
+        return JSONResponse(await self._status())
+
+
+async def _body(request: Request) -> dict:
+    try:
+        body = await request.json()
+    except json.JSONDecodeError:
+        body = None
+    if not isinstance(body, dict):
+        raise ValueError("expected a JSON object")
+    return body
+
+
+def create_adapter(*, config, runtime, session_store, identity_map):
+    """Adapter-plugin factory (the tsugite.adapters entry point). Returns None unless plugins.mcp.enabled is true."""
+    if not (config or {}).get("enabled"):
+        logger.info("mcp plugin installed but disabled (set plugins.mcp.enabled: true to activate)")
+        return None
+    return McpAdapter(get_xdg_data_path("mcp") / "servers.json")

tsugite_mcp-0.27.0/tsugite_mcp/storage.py

@@ -0,0 +1,110 @@
+"""OAuth tokens, client registrations and user-entered clients for one server, kept in tsugite's secret store."""
+
+import asyncio
+import json
+import time
+
+from mcp.shared.auth import OAuthClientInformationFull, OAuthToken
+
+from tsugite.secrets import get_backend
+from tsugite.secrets.registry import get_registry
+
+NO_REDIRECT = "http://localhost/"
+
+
+class SecretStorage:
+    """The SDK's `TokenStorage` for server `name`.
+
+    Tokens are saved with the time they expire, because the SDK keeps expiry only in memory.
+    Every token handed out is registered with the masking registry first.
+    """
+
+    def __init__(self, name: str):
+        self.name = name
+        self.tokens_key = f"mcp-{name}-tokens"
+        self.client_key = f"mcp-{name}-client"
+        # A client the user registered in the provider's console: client_id, client_secret, auth_method.
+        self.preset_key = f"mcp-{name}-client-preset"
+        self.using_preset = False
+
+    async def _get(self, key: str) -> dict | None:
+        raw = await asyncio.to_thread(get_backend().get, key)
+        return json.loads(raw) if raw else None
+
+    async def _set(self, key: str, record: dict) -> None:
+        await asyncio.to_thread(get_backend().set, key, json.dumps(record))
+
+    async def delete_all(self) -> None:
+        for key in (self.tokens_key, self.client_key, self.preset_key):
+            await asyncio.to_thread(get_backend().delete, key)
+
+    async def delete_registration(self) -> None:
+        for key in (self.tokens_key, self.client_key):
+            await asyncio.to_thread(get_backend().delete, key)
+
+    async def get_preset(self) -> dict | None:
+        record = await self._get(self.preset_key)
+        if record and record.get("client_secret"):
+            get_registry().register(f"{self.preset_key}-secret", record["client_secret"], agent="mcp")
+        return record
+
+    async def set_preset(self, record: dict | None) -> None:
+        if record is None:
+            await asyncio.to_thread(get_backend().delete, self.preset_key)
+        else:
+            if record.get("client_secret"):
+                get_registry().register(f"{self.preset_key}-secret", record["client_secret"], agent="mcp")
+            await self._set(self.preset_key, record)
+
+    async def expires_at(self) -> float | None:
+        record = await self._get(self.tokens_key)
+        return record and record.get("expires_at")
+
+    async def get_tokens(self) -> OAuthToken | None:
+        record = await self._get(self.tokens_key)
+        if record is None:
+            return None
+        self._mask(record)
+        return OAuthToken.model_validate(record)
+
+    async def set_tokens(self, tokens: OAuthToken) -> None:
+        previous = await self._get(self.tokens_key)
+        record = tokens.model_dump(mode="json", exclude_none=True)
+        # A refresh response may leave out the refresh token, which then stays valid.
+        if previous and "refresh_token" not in record and "refresh_token" in previous:
+            record["refresh_token"] = previous["refresh_token"]
+        if tokens.expires_in is not None:
+            record["expires_at"] = time.time() + tokens.expires_in
+        self._mask(record)
+        await self._set(self.tokens_key, record)
+
+    async def get_client_info(self) -> OAuthClientInformationFull | None:
+        """The user's own client when one is set, else the dynamic registration."""
+        preset = await self.get_preset()
+        self.using_preset = preset is not None
+        if preset:
+            return OAuthClientInformationFull(
+                client_id=preset["client_id"],
+                client_secret=preset.get("client_secret"),
+                redirect_uris=[NO_REDIRECT],
+                token_endpoint_auth_method=preset.get("auth_method")
+                or ("client_secret_basic" if preset.get("client_secret") else "none"),
+            )
+        return await self.get_registration()
+
+    async def get_registration(self) -> OAuthClientInformationFull | None:
+        record = await self._get(self.client_key)
+        if record is None:
+            return None
+        info = OAuthClientInformationFull.model_validate(record)
+        if info.client_secret:
+            get_registry().register(f"{self.client_key}-secret", info.client_secret, agent="mcp")
+        return info
+
+    async def set_client_info(self, client_info: OAuthClientInformationFull) -> None:
+        await self._set(self.client_key, client_info.model_dump(mode="json", exclude_none=True))
+
+    def _mask(self, record: dict) -> None:
+        for field in ("access_token", "refresh_token"):
+            if field in record:
+                get_registry().register(f"{self.tokens_key}-{field}", record[field], agent="mcp")

tsugite_mcp-0.27.0/tsugite_mcp/tools.py

@@ -0,0 +1,92 @@
+"""Agent-facing tools for connected MCP servers (the `tsugite.plugins` entry point).
+
+Each tool of a connected server is registered as `mcp_<server>_<tool>` in the category
+`mcp_<server>`, so an agent enables one server with `@mcp_<server>` or all with `mcp_*`.
+"""
+
+import inspect
+import keyword
+import logging
+import re
+from pathlib import Path
+
+from tsugite.exceptions import ToolUnavailableError
+from tsugite.tools import _tools, call_on_loop, tool
+from tsugite.ui_surfaces import register_ui_surface
+
+CALL_TIMEOUT = 120
+JSON_TYPES = {"string": str, "integer": int, "number": float, "boolean": bool, "array": list, "object": dict}
+
+logger = logging.getLogger(__name__)
+
+register_ui_surface(
+    kind="connectors",
+    label="Connectors",
+    icon="plug",
+    entry="ui/connectors.html",
+    assets=Path(__file__).parent / "ui",
+    nav=True,
+)
+
+_adapter = None
+_registered: dict[str, list[str]] = {}
+
+
+def set_adapter(adapter) -> None:
+    global _adapter
+    _adapter = adapter
+
+
+def clear_tools(server: str) -> None:
+    for name in _registered.pop(server, []):
+        _tools.pop(name, None)
+
+
+def _caller(server: str, name: str):
+    def call(**kwargs):
+        if _adapter is None:
+            raise ToolUnavailableError("MCP tools need the tsugite daemon with the mcp plugin")
+        arguments = {key: value for key, value in kwargs.items() if value is not None}
+        return call_on_loop(_adapter.loop, _adapter.call_tool, server, name, arguments, timeout=CALL_TIMEOUT)
+
+    return call
+
+
+def set_tools(server: str, listed) -> list[dict]:
+    """Replace `server`'s registered tools with the MCP tools in `listed`. Returns what registered."""
+    clear_tools(server)
+    registered = []
+    for spec in listed:
+        schema = spec.inputSchema or {}
+        properties = schema.get("properties", {})
+        bad = [
+            key
+            for key, prop in properties.items()
+            if not (isinstance(prop, dict) and key.isidentifier() and not keyword.iskeyword(key))
+        ]
+        if bad:
+            logger.warning("mcp %s: skipping tool %s, argument %r is not usable", server, spec.name, bad[0])
+            continue
+        safe = re.sub(r"\W", "_", spec.name)
+        name = f"mcp_{server}_{safe}"
+        if name in _registered.get(server, []):
+            logger.warning("mcp %s: skipping tool %s, its name collides with another tool", server, spec.name)
+            continue
+        required = set(schema.get("required", []))
+        parameters = [
+            inspect.Parameter(
+                key,
+                inspect.Parameter.KEYWORD_ONLY,
+                default=inspect.Parameter.empty if key in required else None,
+                annotation=JSON_TYPES.get(str(prop.get("type")), inspect.Parameter.empty),
+            )
+            for key, prop in sorted(properties.items(), key=lambda item: item[0] not in required)
+        ]
+        call = _caller(server, spec.name)
+        call.__name__ = name
+        call.__doc__ = spec.description or f"{spec.name} on MCP server {server}"
+        call.__signature__ = inspect.Signature(parameters)
+        tool(category=f"mcp_{server}")(call)
+        _registered.setdefault(server, []).append(call.__name__)
+        registered.append({"name": call.__name__, "description": call.__doc__.split("\n")[0].strip()})
+    return registered

tsugite_mcp-0.27.0/tsugite_mcp/ui/connectors.html

@@ -0,0 +1,205 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Connectors</title>
+    <style>
+      body { margin: 0; padding: var(--sp-3, 12px); background: var(--bg1); color: var(--tx0); font: var(--fs-md, 13px) var(--font-ui, sans-serif); }
+      h1 { font-size: 1.2em; margin: 0 0 var(--sp-3, 12px); }
+      form { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: var(--sp-3, 12px); }
+      input, button { background: var(--bg2); color: var(--tx0); border: 1px solid var(--bd1); border-radius: var(--r-sm, 4px); padding: 6px 10px; font: inherit; }
+      input[name="url"] { flex: 1; min-width: 16em; }
+      button { cursor: pointer; }
+      section { border: 1px solid var(--bd0); border-radius: var(--r-sm, 4px); padding: 10px; margin-bottom: 10px; }
+      header { display: flex; align-items: center; gap: 8px; }
+      header strong { flex: 1; }
+      .meta, .error { color: var(--tx2); font-size: 0.9em; }
+      .error { color: var(--st-err); }
+      ul { margin: 6px 0 0; padding-left: 1.2em; }
+      code { user-select: all; }
+      details { margin-top: 6px; }
+      details form { margin: 6px 0 0; align-items: center; }
+    </style>
+  </head>
+  <body>
+    <h1>Connectors</h1>
+    <form id="add">
+      <input name="name" placeholder="name" pattern="[a-z][a-z0-9]{0,23}" required aria-label="Name" />
+      <input name="url" type="url" placeholder="https://mcp.example.com/mcp" required aria-label="Server URL" />
+      <input name="client_id" placeholder="Client ID (optional)" autocomplete="off" aria-label="Client ID" />
+      <input name="client_secret" type="password" placeholder="Client secret (optional)" autocomplete="off" aria-label="Client secret" />
+      <button type="submit">Add</button>
+    </form>
+    <p class="meta">
+      With no client set, the plugin registers one itself when the server allows it. Otherwise create a client in the
+      provider's developer console with this redirect URL:
+      <code id="redirect"></code> <button type="button" id="copy">Copy</button>
+    </p>
+    <p class="error" id="error"></p>
+    <main id="list"></main>
+    <script>
+      const BASE = '/api/plugins/mcp';
+      let token = '';
+      let timer = null;
+      const pasting = new Set();
+      const REDIRECT = location.origin + BASE + '/callback';
+
+      async function api(path, method = 'GET', body) {
+        const headers = { Authorization: 'Bearer ' + token };
+        if (body !== undefined) headers['Content-Type'] = 'application/json';
+        const resp = await fetch(BASE + path, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
+        const data = await resp.json();
+        if (!resp.ok) throw new Error(data.error || `${path} returned ${resp.status}`);
+        return data;
+      }
+
+      function el(tag, text, className) {
+        const node = document.createElement(tag);
+        if (text !== undefined) node.textContent = text;
+        if (className) node.className = className;
+        return node;
+      }
+
+      function button(label, onclick) {
+        const b = el('button', label);
+        b.type = 'button';
+        b.onclick = () => run(onclick);
+        return b;
+      }
+
+      async function run(action) {
+        document.getElementById('error').textContent = '';
+        try {
+          render(await action());
+        } catch (err) {
+          document.getElementById('error').textContent = err.message;
+        }
+      }
+
+      async function signin(name) {
+        // Opened before the await, while the click still counts as a user gesture for popup blockers.
+        const w = window.open('', '_blank');
+        w.opener = null;
+        try {
+          const { authorization_url, paste_back } = await api(`/servers/${name}/signin`, 'POST', { redirect_base: location.origin });
+          if (paste_back) pasting.add(name);
+          w.location = authorization_url;
+        } catch (err) {
+          w.close();
+          throw err;
+        }
+        return api('/servers');
+      }
+
+      function input(name, type, placeholder, value = '') {
+        const i = el('input');
+        Object.assign(i, { name, type, placeholder, value, autocomplete: 'off' });
+        i.setAttribute('aria-label', placeholder);
+        return i;
+      }
+
+      function clientForm(s) {
+        const form = el('form');
+        const id = input('client_id', 'text', 'Client ID', s.client_id);
+        const secret = input('client_secret', 'password', s.has_secret ? 'Secret is set - type to replace' : 'Client secret (optional)');
+        const clear = el('input');
+        clear.type = 'checkbox';
+        const label = el('label', ' Clear secret');
+        label.prepend(clear);
+        label.hidden = !s.has_secret;
+        const save = el('button', 'Save client');
+        form.append(id, secret, label, save);
+        form.onsubmit = (event) => {
+          event.preventDefault();
+          run(() => api(`/servers/${s.name}`, 'PUT', { client_id: id.value, client_secret: secret.value, clear_secret: clear.checked }));
+        };
+        const details = el('details');
+        details.append(el('summary', s.client_id ? 'OAuth client' : 'OAuth client (registered automatically)'), form);
+        return details;
+      }
+
+      function pasteForm(name) {
+        const form = el('form', undefined, 'paste');
+        const url = input('url', 'text', 'Paste the address the browser ended on after you approved');
+        url.size = 40;
+        form.append(url, el('button', 'Finish sign-in'));
+        form.onsubmit = (event) => {
+          event.preventDefault();
+          run(async () => {
+            const data = await api('/paste', 'POST', { url: url.value });
+            pasting.delete(name);
+            return data;
+          });
+        };
+        return form;
+      }
+
+      function poll() {
+        if (document.querySelector('#list details[open], #list .paste:focus-within')) timer = setTimeout(poll, 2000);
+        else run(() => api('/servers'));
+      }
+
+      function render({ servers }) {
+        clearTimeout(timer);
+        if (servers.some((s) => s.status === 'connecting')) timer = setTimeout(poll, 2000);
+        const list = document.getElementById('list');
+        list.replaceChildren(...servers.map((s) => {
+          const box = el('section');
+          const head = el('header');
+          head.append(el('strong', s.name), el('span', s.status.replace('_', ' '), 'meta'));
+          if (s.status === 'needs_signin') head.append(button('Sign in', () => signin(s.name)));
+          head.append(button('Refresh', () => api(`/servers/${s.name}/refresh`, 'POST')));
+          head.append(button('Disconnect', () => api(`/servers/${s.name}`, 'DELETE')));
+          box.append(head, el('div', s.url, 'meta'));
+          if (s.error) box.append(el('div', s.error, 'error'));
+          if (s.status !== 'connecting') pasting.delete(s.name);
+          if (pasting.has(s.name)) box.append(pasteForm(s.name));
+          box.append(clientForm(s));
+          if (s.tools.length) {
+            const tools = el('ul');
+            tools.append(...s.tools.map((t) => el('li', t.description ? `${t.name} - ${t.description}` : t.name)));
+            box.append(tools);
+          }
+          return box;
+        }));
+      }
+
+      document.getElementById('add').onsubmit = (event) => {
+        event.preventDefault();
+        const form = new FormData(event.target);
+        run(async () => {
+          const data = await api('/servers', 'POST', {
+            name: form.get('name'),
+            url: form.get('url'),
+            client_id: form.get('client_id'),
+            client_secret: form.get('client_secret'),
+          });
+          event.target.reset();
+          return data;
+        });
+      };
+
+      document.getElementById('redirect').textContent = REDIRECT;
+      document.getElementById('copy').onclick = () =>
+        navigator.clipboard.writeText(REDIRECT).then(
+          () => (document.getElementById('copy').textContent = 'Copied'),
+          (err) => (document.getElementById('error').textContent = err.message),
+        );
+
+      addEventListener('message', (event) => {
+        if (event.source !== parent) return;
+        const msg = event.data;
+        if (!msg || typeof msg !== 'object') return;
+        if (msg.type === 'tsugite:init' || msg.type === 'tsugite:theme') {
+          for (const [name, value] of Object.entries(msg.theme.tokens)) document.documentElement.style.setProperty(name, value);
+        }
+        if (msg.type === 'tsugite:init') {
+          token = msg.token;
+          parent.postMessage({ type: 'tsugite:ready' }, location.origin);
+          run(() => api('/servers'));
+        }
+      });
+    </script>
+  </body>
+</html>