Repository navigation
feat(mcp): connected tools, the owner's own MCP servers for chosen bots - #202
Merged
Merged
Conversation
Bots run with --strict-mcp-config, so a server the owner added (LinkedIn, an internal system) never loaded and nothing said why. Section 25 lets only the owner register one in the app and attach it to chosen bots; the generated mcp.json carries it, secrets stay in secrets/mcp and the bot's environment, and every use still goes through permission_prompt.
…through its environment The owner registers a server and attaches it to chosen bots; each bot restarts to read it. Header and variable values live in secrets/mcp and the bot's environment only. Spec 25.6 now names the typed save params this uses.
The three open points of section 19 hold with a real claude -p: expands in env and headers, the owner's tools reach permission_prompt by their mcp__<slug>__<tool> name, and system/init reports each server.
… rules that go with a tool
…one at a time A bot with connected tools asks its process for mcp_status when it starts and the answer goes to the app as bot.mcp; the configuration in the answer, which holds expanded secrets, is never read. Allow always covers one tool of one server, and what was allowed goes when the server is deleted or renamed.
… Claude Code 2.1.287 The fake daemon carries the new states.
…t's details The owner pastes the settings of a tool, sees what it is and what it can do on their computer, and says they trust it before a program is saved. Each bot's details list the tools with how they came up and the reason when one did not. Texts in English, Portuguese and Spanish.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bots run with
--strict-mcp-config, so an MCP server the owner added (a LinkedIn reader, an internal system) never loaded, and nothing said why. This adds connected tools (spec 25): only the owner can register one, in the app, and attach it to chosen bots. The generatedmcp.jsoncarries it;--strict-mcp-configstays.mcp.servers,mcp.save,mcp.delete,bot.mcp.set. Nothing a bot can call registers or attaches a tool. A program (stdio) saves only after an "I understand and trust it"; an address (http) says what leaves the computer.secrets/mcpand in the environment of the attached bots only.mcp.jsonholds${BOTLOFT_MCP_…}; the database, the rules and the log never see a value.--allowedTools: each use asks the owner. "Allow always" covers one tool of one server, for one bot, and goes when the server is deleted or renamed.mcp_statusat start; the answer reaches the app asbot.mcp("Connected" / "Did not connect", the reason under Details). The configuration in that answer carries expanded secrets and is never read..mcp.json, edit name and purpose, remove), a switch per tool in a bot's details, texts in English, Portuguese and Spanish.Spec section 25 is in the same PR, with 9.2, 12, 13, 18 and 19 updated.
Checked against Claude Code 2.1.287
Recorded in spec section 19, with a real
claude -pand test servers:${VAR}expands inenvand inheaders; a tool of the owner's outside--allowedToolsreachespermission_promptasmcp__<slug>__<tool>;system/initand themcp_statuscontrol request report each server (status, anderrorwhen it fails), the latter before any turn.Test
cargo fmt,clippy -D warningsandcargo test --workspacepass (new: store, workspace files,connected_toolsandconnected_tools_stateagainstFakeRuntime).pnpm checkpasses (new: pasting, the settings page and the bot switches againstFakeBotloft).Manual step (needs the real Claude Code): run the dev daemon and app, connect a tool in Settings > Connected tools, turn it on for a bot, send the bot a message that needs the tool, and check that it asks for approval and that the tool runs. Then remove the tool and check that the bot restarts without it.
Not in this PR