Merge pull request 'feat(mcp): 完善独立 MCP 服务器配置中心与连接生命周期管理' (#13) from feat/mcp-server-registry into main

Reviewed-on: #13

.gitignore

@@ -14,6 +14,10 @@ backend/.env
 # 运行期生成的 SQLite 索引（vault 下的 Markdown 测试数据需提交）
 backend/data/*.db*
 backend/data/credentials/
+# 本机 MCP 配置、授权状态及服务器工作目录不得提交。
+backend/data/mcp/
+server.json
+servers.json
 
 # Editors and operating systems
 .idea/

README.md

@@ -2,7 +2,7 @@
 
 > 本文件用于团队开发期间快速配置环境和启动项目，不是正式的项目 README。
 
-> 当前基线：2026-09-02。第一阶段 Web 联调前后端已经完成；第二阶段已完成 Workspace 去 Mock、Agent Trace 持久化与 SSE 恢复、stdio MCP Bridge、隔离 Plugin Host，以及 Plugin Command/Settings 后端 Contract 和前端 Service。真实音频、Provider 协议增强、Benchmark、导出、主题包、Trace 可视化、Mermaid 与函数图像仍在后续开发；Tauri Host、Stronghold、原生多 Vault 文件系统和 Sync Server 尚未接入。
+> 当前基线：2026-09-03。第一阶段 Web 联调前后端已经完成；第二阶段已完成 Workspace 去 Mock、Agent Trace 持久化与 SSE 恢复、stdio MCP Bridge、隔离 Plugin Host、Plugin Command/Settings，以及独立 MCP Server 配置中心 C.1（stdio、Streamable HTTP 与旧 SSE 兼容）。真实音频、Provider 协议增强、Benchmark、导出、主题包、Trace 可视化、Mermaid 与函数图像仍在后续开发；Tauri Host、Stronghold、原生多 Vault 文件系统和 Sync Server 尚未接入。
 
 ## 当前目录
 

backend/app/container.py

@@ -5,6 +5,7 @@ from app.agent.builtin_tools import register_builtin_tools
 from app.contracts import ModelCapability, ProviderConfig, ProviderType
 from app.config import BACKEND_DIR, get_settings
 from app.extensions import PluginRuntime, SkillRuntime
+from app.extensions.mcp_registry import McpServerRegistry
 from app.providers import MockProvider, ProviderFactory, ProviderRegistry
 from app.providers.credentials import (
     ChainedCredentialResolver,
@@ -22,6 +23,7 @@ class ApplicationContainer:
     permissions: PermissionManager
     skills: SkillRuntime
     plugins: PluginRuntime
+    mcp_servers: McpServerRegistry
     agent: AgentRuntime
 
 
@@ -61,6 +63,14 @@ def build_container() -> ApplicationContainer:
     plugins.install(BACKEND_DIR / "extensions" / "plugins" / "text-tools")
     plugins.enable("text-tools")
 
+    mcp_servers = McpServerRegistry(
+        tools,
+        credentials,
+        settings.data_dir,
+        allow_process_launch=settings.environment == "development",
+    )
+    mcp_servers.restore_enabled()
+
     skills = SkillRuntime(tools)
     skills.install(BACKEND_DIR / "extensions" / "skills" / "knowledge-assistant")
     skills.enable("knowledge-assistant")
@@ -81,6 +91,7 @@ def build_container() -> ApplicationContainer:
         permissions=permissions,
         skills=skills,
         plugins=plugins,
+        mcp_servers=mcp_servers,
         agent=agent,
     )
 

backend/app/contracts.py

@@ -199,7 +199,7 @@ class ToolDefinition(Contract):
     description: str
     parameters: dict[str, Any] = Field(default_factory=dict)
     permission: str | None = None
-    source: Literal["builtin", "plugin"] = "builtin"
+    source: Literal["builtin", "plugin", "mcp_server"] = "builtin"
 
 
 class ToolCall(Contract):
@@ -486,6 +486,97 @@ class PluginHostStatus(Contract):
     error: str | None = None
 
 
+# Independent user-managed MCP Server Registry. This is deliberately separate
+# from Plugin manifests: a server can contribute tools without being a Plugin.
+class McpServerTransport(str, Enum):
+    stdio = "stdio"
+    streamable_http = "streamable_http"
+    sse = "sse"
+
+
+class McpServerConfig(Contract):
+    name: str = Field(min_length=1, max_length=80)
+    transport: McpServerTransport = McpServerTransport.stdio
+    command: str | None = Field(default=None, max_length=1024)
+    args: list[str] = Field(default_factory=list, max_length=64)
+    url: str | None = Field(default=None, max_length=4096)
+    headers: dict[str, str] = Field(default_factory=dict)
+    environment: dict[str, str] = Field(default_factory=dict)
+    secret_environment_keys: list[str] = Field(default_factory=list)
+    secret_header_keys: list[str] = Field(default_factory=list)
+    permissions: list[str] = Field(default_factory=list)
+    startup_timeout_seconds: float = Field(default=15, ge=1, le=120)
+    tool_timeout_seconds: float = Field(default=30, ge=1, le=300)
+
+
+class McpServerCreateRequest(McpServerConfig):
+    pass
+
+
+class McpServerUpdateRequest(McpServerConfig):
+    version: int = Field(ge=1)
+
+
+class McpServerSecretWriteRequest(Contract):
+    secret: SecretStr = Field(min_length=1, max_length=32768)
+
+
+class McpServerSecretStatus(Contract):
+    key: str
+    configured: bool
+
+
+class McpServerTrustRequest(Contract):
+    command_digest: str = Field(min_length=64, max_length=64)
+
+
+class McpServerStatus(Contract):
+    enabled: bool = False
+    status: PluginHostState = PluginHostState.stopped
+    tools_count: int = 0
+    protocol_version: str | None = None
+    remote_server_name: str | None = None
+    remote_server_version: str | None = None
+    error: str | None = None
+    last_tested_at: datetime | None = None
+    last_test_succeeded: bool | None = None
+
+
+class McpServer(McpServerStatus):
+    server_id: str
+    version: int
+    name: str
+    transport: McpServerTransport
+    command: str | None = None
+    args: list[str] = Field(default_factory=list)
+    url: str | None = None
+    headers: dict[str, str] = Field(default_factory=dict)
+    environment: dict[str, str] = Field(default_factory=dict)
+    permissions: list[str] = Field(default_factory=list)
+    startup_timeout_seconds: float
+    tool_timeout_seconds: float
+    secret_environment: dict[str, bool] = Field(default_factory=dict)
+    secret_headers: dict[str, bool] = Field(default_factory=dict)
+    trusted: bool = False
+    command_digest: str
+    command_summary: str
+
+
+class McpServerListResponse(Contract):
+    items: list[McpServer] = Field(default_factory=list)
+
+
+class McpToolSummary(Contract):
+    name: str
+    remote_name: str
+    description: str
+    permission: str | None = None
+
+
+class McpToolSummaryListResponse(Contract):
+    items: list[McpToolSummary] = Field(default_factory=list)
+
+
 class PluginCommandLocation(str, Enum):
     command_palette = "command_palette"
     context_menu = "context_menu"

backend/app/main.py

@@ -19,6 +19,7 @@ async def lifespan(_: FastAPI):
     yield
     # 第三方 MCP Server 必须跟随 AI Core 退出，不能遗留孤儿进程。
     container.plugins.shutdown()
+    container.mcp_servers.shutdown()
 
 
 app = FastAPI(

backend/app/providers/credentials.py

@@ -5,15 +5,15 @@ import os
 import re
 import threading
 from pathlib import Path
-from typing import Protocol
+from typing import ClassVar, Protocol
 
 from cryptography.fernet import Fernet, InvalidToken
 
 from app.config import get_settings
 
-
 _CREDENTIAL_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
 _PLUGIN_CREDENTIAL_PREFIX = "plugin."
+_MCP_CREDENTIAL_PREFIX = "mcp."
 
 
 class CredentialStoreError(RuntimeError):
@@ -27,16 +27,18 @@ class CredentialResolver(Protocol):
 def validate_provider_credential_id(credential_id: str | None) -> None:
     """阻止 Provider 和通用凭据 API 跨入 Plugin 私有命名空间。"""
 
-    if credential_id and credential_id.casefold().startswith(
+    if credential_id and credential_id.casefold().startswith(_PLUGIN_CREDENTIAL_PREFIX):
-        _PLUGIN_CREDENTIAL_PREFIX
+        raise CredentialStoreError(
-    ):
+            "Credential namespace is reserved for Plugin settings."
-        raise CredentialStoreError("Credential namespace is reserved for Plugin settings.")
+        )
+    if credential_id and credential_id.casefold().startswith(_MCP_CREDENTIAL_PREFIX):
+        raise CredentialStoreError("Credential namespace is reserved for MCP settings.")
 
 
 class EnvironmentCredentialResolver:
     """解析由桌面 Host 注入 Sidecar 进程的临时凭证上下文。"""
 
-    _development_aliases = {
+    _development_aliases: ClassVar[dict[str, str]] = {
         "openai": "OPENAI_API_KEY",
         "deepseek": "DEEPSEEK_API_KEY",
     }
@@ -84,7 +86,9 @@ class EncryptedCredentialStore:
             try:
                 return Fernet(environment_key.encode("ascii"))
             except (ValueError, UnicodeEncodeError) as exc:
-                raise CredentialStoreError("APP_CREDENTIAL_MASTER_KEY is invalid.") from exc
+                raise CredentialStoreError(
+                    "APP_CREDENTIAL_MASTER_KEY is invalid."
+                ) from exc
 
         key_path.parent.mkdir(parents=True, exist_ok=True)
         self._restrict(key_path.parent, 0o700)
@@ -101,7 +105,9 @@ class EncryptedCredentialStore:
         try:
             return Fernet(key_path.read_bytes().strip())
         except (OSError, ValueError) as exc:
-            raise CredentialStoreError("Credential master key cannot be loaded.") from exc
+            raise CredentialStoreError(
+                "Credential master key cannot be loaded."
+            ) from exc
 
     def _read_tokens(self) -> dict[str, str]:
         _, store_path = self._paths()
@@ -110,11 +116,16 @@ class EncryptedCredentialStore:
         try:
             data = json.loads(store_path.read_text(encoding="utf-8"))
         except (OSError, json.JSONDecodeError) as exc:
-            raise CredentialStoreError("Encrypted credential store cannot be loaded.") from exc
+            raise CredentialStoreError(
+                "Encrypted credential store cannot be loaded."
+            ) from exc
         if not isinstance(data, dict) or not all(
-            isinstance(key, str) and isinstance(value, str) for key, value in data.items()
+            isinstance(key, str) and isinstance(value, str)
+            for key, value in data.items()
         ):
-            raise CredentialStoreError("Encrypted credential store has an invalid format.")
+            raise CredentialStoreError(
+                "Encrypted credential store has an invalid format."
+            )
         return data
 
     def _write_tokens(self, tokens: dict[str, str]) -> None:
@@ -195,6 +206,22 @@ class EncryptedCredentialStore:
                 self._write_tokens(tokens)
             return removed
 
+    def move_many(self, replacements: dict[str, str]) -> None:
+        """原子迁移凭据 ID，直接移动密文且不覆盖已经写入的新凭据。"""
+
+        for old_id, new_id in replacements.items():
+            self._validate_id(old_id)
+            self._validate_id(new_id)
+        with self._lock:
+            tokens = self._read_tokens()
+            changed = False
+            for old_id, new_id in replacements.items():
+                if old_id != new_id and old_id in tokens:
+                    tokens.setdefault(new_id, tokens.pop(old_id))
+                    changed = True
+            if changed:
+                self._write_tokens(tokens)
+
 
 class ChainedCredentialResolver:
     def __init__(self, *resolvers: CredentialResolver) -> None:

backend/app/routes.py

@@ -6,6 +6,8 @@ from uuid import uuid4
 from fastapi import APIRouter, Header, Query
 from fastapi.responses import StreamingResponse
 
+from app.agent import AgentCapacityError, AgentRunNotFoundError
+from app.container import container
 from app.contracts import (
     AgentRun,
     AgentRunCreateRequest,
@@ -21,6 +23,14 @@ from app.contracts import (
     IndexJob,
     IndexRebuildRequest,
     IndexStatus,
+    McpServer,
+    McpServerCreateRequest,
+    McpServerListResponse,
+    McpServerSecretStatus,
+    McpServerSecretWriteRequest,
+    McpServerTrustRequest,
+    McpServerUpdateRequest,
+    McpToolSummaryListResponse,
     ModelEvent,
     ModelEventType,
     Note,
@@ -68,17 +78,16 @@ from app.contracts import (
     WorkspaceOpenRequest,
     WorkspaceSnapshot,
 )
-from app.agent import AgentCapacityError, AgentRunNotFoundError
-from app.container import container
 from app.errors import ApiError
 from app.extensions import ExtensionError
-from app.providers.registry import ProviderNotFoundError
+from app.extensions.mcp_registry import McpRegistryError
-from app.providers.factory import UnsupportedProviderError
 from app.providers.base import ProviderError
 from app.providers.credentials import (
     CredentialStoreError,
     validate_provider_credential_id,
 )
+from app.providers.factory import UnsupportedProviderError
+from app.providers.registry import ProviderNotFoundError
 from app.retrieval.engine import engine
 from app.services import (
     index_service,
@@ -91,6 +100,14 @@ from app.services import (
 router = APIRouter(prefix="/api")
 
 
+async def mcp_call_async(operation):
+    """Even registry reads can wait on lifecycle locks; keep all MCP work off the event loop."""
+    try:
+        return await asyncio.to_thread(operation)
+    except McpRegistryError as exc:
+        raise ApiError(exc.status_code, exc.code, exc.message) from exc
+
+
 def utc_now() -> datetime:
     return datetime.now(timezone.utc)
 
@@ -202,14 +219,21 @@ async def list_notes(
     folder: str | None = None,
     tag: str | None = None,
 ) -> NoteListResponse:
-    items, total = note_service.list_notes(limit=limit, offset=offset, folder=folder, tag=tag)
+    items, total = note_service.list_notes(
-    return NoteListResponse(items=items, page=PageMeta(total=total, limit=limit, offset=offset))
+        limit=limit, offset=offset, folder=folder, tag=tag
+    )
+    return NoteListResponse(
+        items=items, page=PageMeta(total=total, limit=limit, offset=offset)
+    )
 
 
 @router.post("/notes", response_model=Note, tags=["Notes"])
 async def create_note(request: NoteCreateRequest) -> Note:
     return await note_service.create_note(
-        title=request.title, markdown=request.markdown, folder=request.folder, tags=request.tags
+        title=request.title,
+        markdown=request.markdown,
+        folder=request.folder,
+        tags=request.tags,
     )
 
 
@@ -217,7 +241,9 @@ async def create_note(request: NoteCreateRequest) -> Note:
 async def get_note(note_id: str) -> Note:
     note = await note_service.get_note(note_id)
     if note is None:
-        raise ApiError(404, "RESOURCE_NOT_FOUND", "note not found", {"note_id": note_id})
+        raise ApiError(
+            404, "RESOURCE_NOT_FOUND", "note not found", {"note_id": note_id}
+        )
     return note
 
 
@@ -231,7 +257,9 @@ async def update_note(note_id: str, request: NoteUpdateRequest) -> Note:
 @router.delete("/notes/{note_id}", response_model=OperationResponse, tags=["Notes"])
 async def delete_note(note_id: str) -> OperationResponse:
     if not await note_service.delete_note(note_id):
-        raise ApiError(404, "RESOURCE_NOT_FOUND", "note not found", {"note_id": note_id})
+        raise ApiError(
+            404, "RESOURCE_NOT_FOUND", "note not found", {"note_id": note_id}
+        )
     return OperationResponse(status="completed", resource_id=note_id, message="deleted")
 
 
@@ -275,7 +303,9 @@ async def chat(request: ChatRequest) -> StreamingResponse:
                 data={"code": "PROVIDER_ERROR", "message": str(exc)},
                 timestamp=utc_now(),
             )
-            done = ModelEvent(event=ModelEventType.done, sequence=1, timestamp=utc_now())
+            done = ModelEvent(
+                event=ModelEventType.done, sequence=1, timestamp=utc_now()
+            )
             yield as_sse(error.event.value, error.model_dump_json())
             yield as_sse(done.event.value, done.model_dump_json())
 
@@ -436,9 +466,7 @@ async def list_skills() -> SkillListResponse:
     return SkillListResponse(items=container.skills.list())
 
 
-@router.get(
+@router.get("/skills/{skill_id}", response_model=Skill, tags=["Skills"])
-    "/skills/{skill_id}", response_model=Skill, tags=["Skills"]
-)
 async def get_skill(skill_id: str) -> Skill:
     return extension_call(lambda: container.skills.get(skill_id))
 
@@ -478,7 +506,120 @@ async def disable_skill(skill_id: str) -> Skill:
 )
 async def uninstall_skill(skill_id: str) -> OperationResponse:
     extension_call(lambda: container.skills.uninstall(skill_id))
-    return OperationResponse(status="completed", resource_id=skill_id, message="uninstalled")
+    return OperationResponse(
+        status="completed", resource_id=skill_id, message="uninstalled"
+    )
+
+
+# Independent MCP Server Registry
+@router.get("/mcp/servers", response_model=McpServerListResponse, tags=["MCP Servers"])
+async def list_mcp_servers() -> McpServerListResponse:
+    return McpServerListResponse(items=await mcp_call_async(container.mcp_servers.list))
+
+
+@router.post(
+    "/mcp/servers", response_model=McpServer, status_code=201, tags=["MCP Servers"]
+)
+async def create_mcp_server(request: McpServerCreateRequest) -> McpServer:
+    return await mcp_call_async(lambda: container.mcp_servers.create(request))
+
+
+@router.get("/mcp/servers/{server_id}", response_model=McpServer, tags=["MCP Servers"])
+async def get_mcp_server(server_id: str) -> McpServer:
+    return await mcp_call_async(lambda: container.mcp_servers.get(server_id))
+
+
+@router.get(
+    "/mcp/servers/{server_id}/tools",
+    response_model=McpToolSummaryListResponse,
+    tags=["MCP Servers"],
+)
+async def list_mcp_server_tools(server_id: str) -> McpToolSummaryListResponse:
+    return McpToolSummaryListResponse(
+        items=await mcp_call_async(lambda: container.mcp_servers.list_tools(server_id))
+    )
+
+
+@router.put("/mcp/servers/{server_id}", response_model=McpServer, tags=["MCP Servers"])
+async def update_mcp_server(
+    server_id: str, request: McpServerUpdateRequest
+) -> McpServer:
+    return await mcp_call_async(
+        lambda: container.mcp_servers.update(server_id, request)
+    )
+
+
+@router.delete(
+    "/mcp/servers/{server_id}", response_model=OperationResponse, tags=["MCP Servers"]
+)
+async def delete_mcp_server(server_id: str) -> OperationResponse:
+    await mcp_call_async(lambda: container.mcp_servers.delete(server_id))
+    return OperationResponse(
+        status="completed", resource_id=server_id, message="deleted"
+    )
+
+
+@router.post(
+    "/mcp/servers/{server_id}/trust", response_model=McpServer, tags=["MCP Servers"]
+)
+async def trust_mcp_server(server_id: str, request: McpServerTrustRequest) -> McpServer:
+    return await mcp_call_async(
+        lambda: container.mcp_servers.trust(server_id, request.command_digest)
+    )
+
+
+@router.post(
+    "/mcp/servers/{server_id}/test", response_model=McpServer, tags=["MCP Servers"]
+)
+async def test_mcp_server(server_id: str) -> McpServer:
+    return await mcp_call_async(lambda: container.mcp_servers.test(server_id))
+
+
+@router.post(
+    "/mcp/servers/{server_id}/enable", response_model=McpServer, tags=["MCP Servers"]
+)
+async def enable_mcp_server(server_id: str) -> McpServer:
+    return await mcp_call_async(lambda: container.mcp_servers.enable(server_id))
+
+
+@router.post(
+    "/mcp/servers/{server_id}/disable", response_model=McpServer, tags=["MCP Servers"]
+)
+async def disable_mcp_server(server_id: str) -> McpServer:
+    return await mcp_call_async(lambda: container.mcp_servers.disable(server_id))
+
+
+@router.put(
+    "/mcp/servers/{server_id}/secrets/{key}",
+    response_model=McpServerSecretStatus,
+    tags=["MCP Servers"],
+)
+async def put_mcp_server_secret(
+    server_id: str,
+    key: str,
+    request: McpServerSecretWriteRequest,
+    kind: str = Query(default="environment", pattern="^(environment|header)$"),
+) -> McpServerSecretStatus:
+    return await mcp_call_async(
+        lambda: container.mcp_servers.put_secret(
+            server_id, key, request.secret.get_secret_value(), kind=kind
+        )
+    )
+
+
+@router.delete(
+    "/mcp/servers/{server_id}/secrets/{key}",
+    response_model=McpServerSecretStatus,
+    tags=["MCP Servers"],
+)
+async def delete_mcp_server_secret(
+    server_id: str,
+    key: str,
+    kind: str = Query(default="environment", pattern="^(environment|header)$"),
+) -> McpServerSecretStatus:
+    return await mcp_call_async(
+        lambda: container.mcp_servers.delete_secret(server_id, key, kind=kind)
+    )
 
 
 # Plugins
@@ -570,11 +711,15 @@ async def restart_plugin_host(plugin_id: str) -> OperationResponse:
 )
 async def uninstall_plugin(plugin_id: str) -> OperationResponse:
     plugin = extension_call(lambda: container.plugins.get(plugin_id))
-    dependent_skills = container.skills.depending_on_tools(plugin.manifest.contributes.tools)
+    dependent_skills = container.skills.depending_on_tools(
+        plugin.manifest.contributes.tools
+    )
     await extension_call_async(
         lambda: container.plugins.uninstall(plugin_id, dependent_skills)
     )
-    return OperationResponse(status="completed", resource_id=plugin_id, message="uninstalled")
+    return OperationResponse(
+        status="completed", resource_id=plugin_id, message="uninstalled"
+    )
 
 
 # Plugin Command / Settings Contributions
@@ -649,9 +794,7 @@ async def put_plugin_setting_secret(
     response_model=PluginSecretStatus,
     tags=["Plugins"],
 )
-async def delete_plugin_setting_secret(
+async def delete_plugin_setting_secret(plugin_id: str, key: str) -> PluginSecretStatus:
-    plugin_id: str, key: str
-) -> PluginSecretStatus:
     return extension_call(
         lambda: container.plugins.delete_setting_secret(plugin_id, key)
     )
@@ -764,7 +907,9 @@ async def update_provider(
 ) -> ProviderConfig:
     current = configurable_provider_or_404(provider_id).config
     if provider_id == "mock":
-        raise ApiError(409, "BUILTIN_PROVIDER_IMMUTABLE", "Mock provider cannot be modified.")
+        raise ApiError(
+            409, "BUILTIN_PROVIDER_IMMUTABLE", "Mock provider cannot be modified."
+        )
     fields = request.model_fields_set
     if ("name" in fields and request.name is None) or (
         "enabled" in fields and request.enabled is None
@@ -793,7 +938,9 @@ async def update_provider(
 async def delete_provider(provider_id: str) -> OperationResponse:
     configurable_provider_or_404(provider_id)
     if provider_id == "mock":
-        raise ApiError(409, "BUILTIN_PROVIDER_IMMUTABLE", "Mock provider cannot be deleted.")
+        raise ApiError(
+            409, "BUILTIN_PROVIDER_IMMUTABLE", "Mock provider cannot be deleted."
+        )
     container.providers.unregister(provider_id)
     return OperationResponse(status="completed", resource_id=provider_id)
 
@@ -871,7 +1018,9 @@ async def create_task(request: TaskCreateRequest) -> Task:
 async def get_task(task_id: str) -> Task:
     task = task_service.get_task(task_id)
     if task is None:
-        raise ApiError(404, "RESOURCE_NOT_FOUND", "task not found", {"task_id": task_id})
+        raise ApiError(
+            404, "RESOURCE_NOT_FOUND", "task not found", {"task_id": task_id}
+        )
     return task
 
 
@@ -887,7 +1036,9 @@ async def update_task(task_id: str, request: TaskUpdateRequest) -> Task:
 )
 async def delete_task(task_id: str) -> OperationResponse:
     if not task_service.delete_task(task_id):
-        raise ApiError(404, "RESOURCE_NOT_FOUND", "task not found", {"task_id": task_id})
+        raise ApiError(
+            404, "RESOURCE_NOT_FOUND", "task not found", {"task_id": task_id}
+        )
     return OperationResponse(status="completed", resource_id=task_id, message="deleted")
 
 
@@ -937,5 +1088,7 @@ async def rebuild_index(request: IndexRebuildRequest) -> IndexJob:
 async def get_index_job(job_id: str) -> IndexJob:
     job = index_service.get_job(job_id)
     if job is None:
-        raise ApiError(404, "RESOURCE_NOT_FOUND", "index job not found", {"job_id": job_id})
+        raise ApiError(
+            404, "RESOURCE_NOT_FOUND", "index job not found", {"job_id": job_id}
+        )
     return job

backend/tests/test_api.py

@@ -1,26 +1,12 @@
 import asyncio
+import threading
+from types import SimpleNamespace
+
+import pytest
 
-from app.main import health, service_status
-from app.routes import (
-    get_index_status,
-    list_notes,
-    list_plugins,
-    list_provider_presets,
-    list_providers,
-    list_skills,
-)
-from app.routes import (
-    create_provider,
-    create_task,
-    delete_provider,
-    delete_task,
-    get_provider,
-    get_task,
-    list_tasks,
-    update_provider,
-    update_task,
-)
 from app.contracts import (
+    McpServerSecretStatus,
+    McpServerSecretWriteRequest,
     ProviderCreateRequest,
     ProviderType,
     ProviderUpdateRequest,
@@ -28,6 +14,61 @@ from app.contracts import (
     TaskStatus,
     TaskUpdateRequest,
 )
+from app.main import health, service_status
+from app.routes import (
+    create_provider,
+    create_task,
+    delete_provider,
+    delete_task,
+    get_index_status,
+    get_provider,
+    get_task,
+    list_notes,
+    list_plugins,
+    list_provider_presets,
+    list_providers,
+    list_skills,
+    list_tasks,
+    update_provider,
+    update_task,
+)
+
+
+def test_mcp_secret_routes_offload_blocking_lifecycle_work(monkeypatch) -> None:
+    from app import routes
+
+    caller_thread = threading.get_ident()
+    worker_threads: list[int] = []
+
+    class FakeMcpRegistry:
+        def put_secret(self, server_id, key, secret, *, kind):
+            worker_threads.append(threading.get_ident())
+            return McpServerSecretStatus(key=key, configured=True)
+
+        def delete_secret(self, server_id, key, *, kind):
+            worker_threads.append(threading.get_ident())
+            return McpServerSecretStatus(key=key, configured=False)
+
+    monkeypatch.setattr(
+        routes,
+        "container",
+        SimpleNamespace(mcp_servers=FakeMcpRegistry()),
+    )
+    written = asyncio.run(
+        routes.put_mcp_server_secret(
+            "server-1",
+            "TOKEN",
+            McpServerSecretWriteRequest(secret="hidden"),
+            kind="environment",
+        )
+    )
+    deleted = asyncio.run(
+        routes.delete_mcp_server_secret("server-1", "TOKEN", kind="environment")
+    )
+
+    assert written.configured is True
+    assert deleted.configured is False
+    assert worker_threads and all(item != caller_thread for item in worker_threads)
 
 
 def test_health() -> None:
@@ -36,6 +77,172 @@ def test_health() -> None:
     assert response.model_dump() == {"status": "ok"}
 
 
+def test_mcp_create_and_trust_are_not_executed_on_event_loop(monkeypatch) -> None:
+    from app import routes
+    from app.contracts import McpServerCreateRequest, McpServerTrustRequest
+
+    caller = threading.get_ident()
+    workers = []
+
+    class Registry:
+        def create(self, request):
+            workers.append(threading.get_ident())
+            return "created"
+
+        def trust(self, server_id, digest):
+            workers.append(threading.get_ident())
+            return "trusted"
+
+    monkeypatch.setattr(routes, "container", SimpleNamespace(mcp_servers=Registry()))
+    assert (
+        asyncio.run(
+            routes.create_mcp_server(McpServerCreateRequest(name="test", command="uvx"))
+        )
+        == "created"
+    )
+    assert (
+        asyncio.run(
+            routes.trust_mcp_server(
+                "test", McpServerTrustRequest(command_digest="a" * 64)
+            )
+        )
+        == "trusted"
+    )
+    assert len(workers) == 2
+    assert all(worker != caller for worker in workers)
+
+
+def test_mcp_split_config_and_secret_requests_persist_without_plaintext(
+    monkeypatch,
+) -> None:
+    from fastapi.testclient import TestClient
+
+    from app import routes
+    from app.agent.tools import ToolRegistry
+    from app.config import get_settings
+    from app.extensions.mcp_registry import McpServerRegistry
+    from app.main import app
+    from app.providers.credentials import EncryptedCredentialStore
+
+    service = McpServerRegistry(
+        ToolRegistry(),
+        EncryptedCredentialStore(),
+        get_settings().data_dir,
+        allow_process_launch=True,
+    )
+    monkeypatch.setattr(routes, "container", SimpleNamespace(mcp_servers=service))
+    client = TestClient(app)
+    config = {
+        "name": "MiniMax configuration test",
+        "command": "uvx",
+        "environment": {"MINIMAX_API_HOST": "https://api.minimaxi.com"},
+        "secret_environment_keys": ["MINIMAX_API_KEY"],
+        "startup_timeout_seconds": 120,
+        "tool_timeout_seconds": 300,
+    }
+    # Reproduce the old frontend payload. The backend still enforces separation.
+    invalid = client.post(
+        "/api/mcp/servers",
+        json={
+            **config,
+            "environment": {
+                **config["environment"],
+                "MINIMAX_API_KEY": "synthetic-only",
+            },
+        },
+    )
+    assert invalid.status_code == 422
+    assert invalid.json()["error"]["code"] == "MCP_ENVIRONMENT_INVALID"
+    created = client.post("/api/mcp/servers", json=config)
+    assert created.status_code == 201
+    server_id = created.json()["server_id"]
+    saved = client.put(
+        f"/api/mcp/servers/{server_id}/secrets/MINIMAX_API_KEY",
+        json={"secret": "synthetic-only"},
+    )
+    assert saved.status_code == 200
+    current = client.get(f"/api/mcp/servers/{server_id}")
+    assert current.json()["secret_environment"] == {"MINIMAX_API_KEY": True}
+    assert "synthetic-only" not in current.text
+    assert "synthetic-only" not in service._path.read_text(encoding="utf-8")
+    _, credentials_path = service.credentials._paths()
+    assert "synthetic-only" not in credentials_path.read_text(encoding="utf-8")
+    assert not current.json()["enabled"]  # Saving never starts a third-party process.
+    client.close()
+
+
+@pytest.mark.parametrize("operation", ["create", "trust"])
+def test_mcp_lifecycle_lock_contention_keeps_event_loop_responsive(
+    monkeypatch,
+    operation,
+) -> None:
+    from app import routes
+    from app.agent.tools import ToolRegistry
+    from app.config import get_settings
+    from app.contracts import McpServerCreateRequest, McpServerTrustRequest
+    from app.extensions.mcp_registry import McpServerRegistry
+    from app.providers.credentials import EncryptedCredentialStore
+
+    service = McpServerRegistry(
+        ToolRegistry(),
+        EncryptedCredentialStore(),
+        get_settings().data_dir,
+        allow_process_launch=True,
+    )
+    request = McpServerCreateRequest(
+        name="Lock contention fixture", command="not-executed"
+    )
+    server = service.create(request)
+    monkeypatch.setattr(routes, "container", SimpleNamespace(mcp_servers=service))
+    entered = threading.Event()
+    locked = threading.Event()
+    release = threading.Event()
+    original = getattr(service, operation)
+
+    def observed(*args):
+        entered.set()
+        return original(*args)
+
+    def hold_lifecycle_lock():
+        with service._lifecycle_lock:
+            locked.set()
+            release.wait(timeout=5)
+
+    monkeypatch.setattr(service, operation, observed)
+    holder = threading.Thread(target=hold_lifecycle_lock, daemon=True)
+    holder.start()
+    # An independent watchdog lets the test fail rather than hang if a regression
+    # blocks the event loop itself (an asyncio timeout alone cannot catch that).
+    watchdog = threading.Timer(5, release.set)
+    watchdog.start()
+
+    async def exercise():
+        pending = asyncio.create_task(
+            routes.create_mcp_server(request)
+            if operation == "create"
+            else routes.trust_mcp_server(
+                server.server_id,
+                McpServerTrustRequest(command_digest=server.command_digest),
+            )
+        )
+        try:
+            assert await asyncio.to_thread(entered.wait, 2)
+            assert not pending.done()
+            assert not release.is_set()
+            assert (await health()).status == "ok"
+        finally:
+            release.set()
+            await pending
+
+    try:
+        assert locked.wait(timeout=2)
+        asyncio.run(exercise())
+    finally:
+        release.set()
+        watchdog.cancel()
+        holder.join(timeout=2)
+
+
 def test_service_status() -> None:
     response = asyncio.run(service_status())
 
@@ -52,7 +259,9 @@ def test_core_collections_are_typed() -> None:
 
     assert notes.items == []
     assert notes.page.limit == 20
-    assert [skill.manifest.skill_id for skill in skills.items] == ["knowledge-assistant"]
+    assert [skill.manifest.skill_id for skill in skills.items] == [
+        "knowledge-assistant"
+    ]
     assert skills.items[0].status == "ready"
     assert [plugin.manifest.plugin_id for plugin in plugins.items] == ["text-tools"]
     assert plugins.items[0].status == "ready"
@@ -73,9 +282,15 @@ def test_provider_presets_include_openai_and_deepseek() -> None:
 def test_provider_presets_static_route_precedes_provider_id_route() -> None:
     from app.routes import router
 
-    get_paths = [route.path for route in router.routes if "GET" in getattr(route, "methods", set())]
+    get_paths = [
+        route.path
+        for route in router.routes
+        if "GET" in getattr(route, "methods", set())
+    ]
 
-    assert get_paths.index("/api/providers/presets") < get_paths.index("/api/providers/{provider_id}")
+    assert get_paths.index("/api/providers/presets") < get_paths.index(
+        "/api/providers/{provider_id}"
+    )
 
 
 def test_openapi_contains_documented_frontend_interfaces() -> None:
@@ -101,6 +316,14 @@ def test_openapi_contains_documented_frontend_interfaces() -> None:
         "/api/plugins/{plugin_id}/settings/{key}/secret",
         "/api/plugins/{plugin_id}/enable",
         "/api/plugins/{plugin_id}/disable",
+        "/api/mcp/servers",
+        "/api/mcp/servers/{server_id}",
+        "/api/mcp/servers/{server_id}/tools",
+        "/api/mcp/servers/{server_id}/trust",
+        "/api/mcp/servers/{server_id}/test",
+        "/api/mcp/servers/{server_id}/enable",
+        "/api/mcp/servers/{server_id}/disable",
+        "/api/mcp/servers/{server_id}/secrets/{key}",
         "/api/providers/test",
         "/api/providers/presets",
         "/api/credentials/{credential_id}",

backend/tests/test_mcp_registry.py

@@ -0,0 +1,769 @@
+import asyncio
+import hashlib
+import json
+import sys
+import threading
+import time
+from concurrent.futures import ThreadPoolExecutor
+
+import httpx
+import pytest
+
+from app.agent.tools import ToolExecutionContext, ToolRegistry
+from app.config import BACKEND_DIR, get_settings
+from app.contracts import McpServerCreateRequest, McpServerUpdateRequest, ToolCall
+from app.extensions.mcp import McpLegacySseClient
+from app.extensions.mcp_registry import McpRegistryError, McpServerRegistry
+from app.providers.credentials import CredentialStoreError, EncryptedCredentialStore
+
+SERVER = BACKEND_DIR / "extensions" / "fixtures" / "mcp-echo" / "server.py"
+
+
+def request(**overrides) -> McpServerCreateRequest:
+    values = {
+        "name": "Echo MCP",
+        "command": sys.executable,
+        "args": [str(SERVER)],
+        "permissions": ["notes.read", "secrets.use"],
+        "secret_environment_keys": ["TEST_MCP_SECRET"],
+    }
+    values.update(overrides)
+    return McpServerCreateRequest(**values)
+
+
+def registry(*, launch: bool = True) -> McpServerRegistry:
+    return McpServerRegistry(
+        ToolRegistry(),
+        EncryptedCredentialStore(),
+        get_settings().data_dir,
+        allow_process_launch=launch,
+    )
+
+
+def test_registry_requires_current_trust_and_never_returns_secret() -> None:
+    service = registry()
+    created = service.create(request())
+    assert created.trusted is False
+    assert created.secret_environment == {"TEST_MCP_SECRET": False}
+
+    service.put_secret(created.server_id, "TEST_MCP_SECRET", "do-not-return")
+    configured = service.get(created.server_id)
+    assert configured.secret_environment == {"TEST_MCP_SECRET": True}
+    assert "do-not-return" not in configured.model_dump_json()
+
+    with pytest.raises(McpRegistryError, match="approve"):
+        service.test(created.server_id)
+
+    service.trust(created.server_id, created.command_digest)
+    tested = service.test(created.server_id)
+    assert tested.status == "stopped"
+    assert tested.last_test_succeeded is True
+    assert tested.tools_count > 0
+    service.shutdown()
+
+
+def test_secret_change_disables_server_and_requires_a_new_connection_test() -> None:
+    service = registry()
+    created = service.create(request())
+    service.put_secret(created.server_id, "TEST_MCP_SECRET", "first")
+    service.trust(created.server_id, created.command_digest)
+    service.test(created.server_id)
+    service.enable(created.server_id)
+
+    service.put_secret(created.server_id, "TEST_MCP_SECRET", "second")
+    current = service.get(created.server_id)
+    assert current.enabled is False
+    assert current.last_test_succeeded is None
+    assert not any(
+        item.name.startswith(f"mcp.{created.server_id}.")
+        for item in service.tools.definitions()
+    )
+    with pytest.raises(McpRegistryError) as error:
+        service.enable(created.server_id)
+    assert error.value.code == "MCP_CONNECTION_TEST_REQUIRED"
+    service.shutdown()
+
+
+def test_update_disables_server_and_revokes_command_trust() -> None:
+    service = registry()
+    created = service.create(request(secret_environment_keys=[]))
+    service.trust(created.server_id, created.command_digest)
+    service.test(created.server_id)
+    enabled = service.enable(created.server_id)
+    assert enabled.enabled is True
+    assert any(
+        item.name.startswith(f"mcp.{created.server_id}.")
+        for item in service.tools.definitions()
+    )
+
+    updated = service.update(
+        created.server_id,
+        McpServerUpdateRequest(
+            **request(name="Changed", secret_environment_keys=[]).model_dump(),
+            version=enabled.version,
+        ),
+    )
+    assert updated.enabled is False
+    assert updated.trusted is False
+    assert not any(
+        item.name.startswith(f"mcp.{created.server_id}.")
+        for item in service.tools.definitions()
+    )
+    service.shutdown()
+
+
+def test_update_remains_retryable_when_removed_secret_cleanup_fails(
+    monkeypatch,
+) -> None:
+    service = registry()
+    created = service.create(request())
+    service.put_secret(created.server_id, "TEST_MCP_SECRET", "keep-until-retry")
+
+    def fail_delete_many(_secret_ids: list[str]) -> set[str]:
+        raise CredentialStoreError("credential store unavailable")
+
+    monkeypatch.setattr(service.credentials, "delete_many", fail_delete_many)
+    with pytest.raises(McpRegistryError) as error:
+        service.update(
+            created.server_id,
+            McpServerUpdateRequest(
+                **request(secret_environment_keys=[]).model_dump(),
+                version=created.version,
+            ),
+        )
+
+    current = service.get(created.server_id)
+    assert error.value.code == "MCP_SECRET_STORE_ERROR"
+    assert current.version == created.version
+    assert current.secret_environment == {"TEST_MCP_SECRET": True}
+    service.shutdown()
+
+
+def test_delete_keeps_server_retryable_when_secret_cleanup_fails(monkeypatch) -> None:
+    service = registry()
+    created = service.create(request())
+    service.put_secret(created.server_id, "TEST_MCP_SECRET", "keep-until-retry")
+
+    def fail_delete_many(_secret_ids: list[str]) -> set[str]:
+        raise CredentialStoreError("credential store unavailable")
+
+    monkeypatch.setattr(service.credentials, "delete_many", fail_delete_many)
+    with pytest.raises(McpRegistryError) as error:
+        service.delete(created.server_id)
+
+    current = service.get(created.server_id)
+    assert error.value.code == "MCP_SECRET_STORE_ERROR"
+    assert current.server_id == created.server_id
+    assert current.secret_environment == {"TEST_MCP_SECRET": True}
+    service.shutdown()
+
+
+def test_unavailable_server_removes_bridge_host(monkeypatch) -> None:
+    service = registry()
+    created = service.create(request(secret_environment_keys=[]))
+    with service._lock:
+        service._records[created.server_id] = {
+            **service._records[created.server_id],
+            "enabled": True,
+        }
+    removed: list[str] = []
+    monkeypatch.setattr(service.bridge, "remove", removed.append)
+
+    generation = object()
+    service._generations[created.server_id] = generation
+    service._unavailable(created.server_id, generation, "connection lost")
+
+    current = service.get(created.server_id)
+    assert removed == [f"mcp.{created.server_id}"]
+    assert current.enabled is False
+    assert current.status == "unhealthy"
+    service.shutdown()
+
+
+def test_old_failure_callback_cannot_stop_replacement_host(monkeypatch) -> None:
+    service = registry()
+    callbacks = []
+    original_start = service.bridge.start
+
+    def capture_callback(*args, **kwargs):
+        callbacks.append(args[4])
+        return original_start(*args, **kwargs)
+
+    monkeypatch.setattr(service.bridge, "start", capture_callback)
+    created = service.create(request(secret_environment_keys=[]))
+    service.trust(created.server_id, created.command_digest)
+    callback_thread = None
+    try:
+        service.test(created.server_id)
+        service.enable(created.server_id)
+        old_callback = callbacks[-1]
+        callback_started = threading.Event()
+        callback_finished = threading.Event()
+
+        def delayed_failure():
+            callback_started.set()
+            old_callback(f"mcp.{created.server_id}", "delayed old failure")
+            callback_finished.set()
+
+        # Queue the old callback while a replacement owns the lifecycle lock.
+        with service._lifecycle_lock:
+            callback_thread = threading.Thread(target=delayed_failure, daemon=True)
+            callback_thread.start()
+            assert callback_started.wait(timeout=2)
+            service.disable(created.server_id)
+            service.enable(created.server_id)
+        assert callback_finished.wait(timeout=2)
+        assert service.get(created.server_id).enabled is True
+        assert service.get(created.server_id).status == "ready"
+        assert service.tools.definitions()
+        callbacks[-1](f"mcp.{created.server_id}", "current failure")
+        assert service.get(created.server_id).enabled is False
+        assert service.get(created.server_id).status == "unhealthy"
+    finally:
+        service.shutdown()
+        if callback_thread is not None:
+            callback_thread.join(timeout=2)
+
+
+def test_header_case_only_rename_preserves_secret() -> None:
+    service = registry()
+    config = {
+        "name": "HTTP",
+        "transport": "streamable_http",
+        "url": "https://example.test/mcp",
+        "secret_header_keys": ["Authorization"],
+    }
+    created = service.create(McpServerCreateRequest(**config))
+    service.put_secret(created.server_id, "Authorization", "synthetic", kind="header")
+    config["secret_header_keys"] = ["authorization"]
+    updated = service.update(
+        created.server_id, McpServerUpdateRequest(**config, version=created.version)
+    )
+    assert updated.secret_headers == {"authorization": True}
+    assert (
+        service.credentials.resolve(
+            service._secret_id(created.server_id, "authorization", "header")
+        )
+        == "synthetic"
+    )
+
+
+def test_environment_secrets_are_case_sensitive_and_delete_independently() -> None:
+    service = registry()
+    created = service.create(request(secret_environment_keys=["TOKEN", "token"]))
+    service.put_secret(created.server_id, "TOKEN", "upper")
+    service.put_secret(created.server_id, "token", "lower")
+    assert (
+        service.credentials.resolve(service._secret_id(created.server_id, "TOKEN"))
+        == "upper"
+    )
+    assert (
+        service.credentials.resolve(service._secret_id(created.server_id, "token"))
+        == "lower"
+    )
+    service.delete_secret(created.server_id, "TOKEN")
+    assert service.get(created.server_id).secret_environment == {
+        "TOKEN": False,
+        "token": True,
+    }
+
+
+def test_legacy_environment_credential_migration_is_idempotent() -> None:
+    service = registry()
+    created = service.create(request(secret_environment_keys=["TOKEN"]))
+    suffix = hashlib.sha256(b"environment\0token").hexdigest()[:20]
+    legacy_id = f"mcp.{created.server_id}.{suffix}"
+    service.credentials.put(legacy_id, "legacy-value")
+    service._records[created.server_id]["secret_environment_version"] = 1
+    service._write()
+    migrated = registry()
+    assert migrated.get(created.server_id).secret_environment == {"TOKEN": True}
+    assert (
+        migrated.credentials.resolve(migrated._secret_id(created.server_id, "TOKEN"))
+        == "legacy-value"
+    )
+    assert not migrated.credentials.has(legacy_id)
+    migrated.put_secret(created.server_id, "TOKEN", "new-value")
+    assert (
+        registry().credentials.resolve(migrated._secret_id(created.server_id, "TOKEN"))
+        == "new-value"
+    )
+
+
+def test_ambiguous_legacy_credentials_are_not_assigned_to_two_variables() -> None:
+    service = registry()
+    created = service.create(request(secret_environment_keys=["TOKEN", "token"]))
+    suffix = hashlib.sha256(b"environment\0token").hexdigest()[:20]
+    legacy_id = f"mcp.{created.server_id}.{suffix}"
+    service.credentials.put(legacy_id, "cannot-reconstruct-originals")
+    service._records[created.server_id]["secret_environment_version"] = 1
+    service._write()
+    migrated = registry()
+    current = migrated.get(created.server_id)
+    assert current.secret_environment == {"TOKEN": False, "token": False}
+    assert current.enabled is False
+    assert current.last_test_succeeded is None
+    assert migrated.credentials.has(
+        legacy_id
+    )  # Keep the original ciphertext recoverable.
+    migrated.put_secret(created.server_id, "TOKEN", "upper")
+    migrated.put_secret(created.server_id, "token", "lower")
+    assert registry().get(created.server_id).secret_environment == {
+        "TOKEN": True,
+        "token": True,
+    }
+    migrated.delete(created.server_id)
+    assert not migrated.credentials.has(legacy_id)
+
+
+def test_credential_id_migration_keeps_new_values_and_is_atomic(monkeypatch) -> None:
+    credentials = EncryptedCredentialStore()
+    credentials.put("mcp.old", "old-value")
+    credentials.put("mcp.new", "new-value")
+    original_write = credentials._write_tokens
+
+    def fail_write(_tokens):
+        raise CredentialStoreError("synthetic failure")
+
+    monkeypatch.setattr(credentials, "_write_tokens", fail_write)
+    with pytest.raises(CredentialStoreError):
+        credentials.move_many({"mcp.old": "mcp.new"})
+    assert credentials.resolve("mcp.old") == "old-value"
+    assert credentials.resolve("mcp.new") == "new-value"
+    monkeypatch.setattr(credentials, "_write_tokens", original_write)
+    credentials.move_many({"mcp.old": "mcp.new"})
+    assert credentials.resolve("mcp.old") is None
+    assert credentials.resolve("mcp.new") == "new-value"
+
+
+def test_ambiguous_legacy_secret_is_not_resurrected_after_removing_a_key() -> None:
+    service = registry()
+    created = service.create(request(secret_environment_keys=["TOKEN", "token"]))
+    legacy_id = service._legacy_environment_secret_id(created.server_id, "TOKEN")
+    service.credentials.put(legacy_id, "ambiguous-old-value")
+    service._records[created.server_id]["secret_environment_version"] = 1
+    service._write()
+    migrated = registry()
+    migrated.update(
+        created.server_id,
+        McpServerUpdateRequest(
+            **request(secret_environment_keys=["token"]).model_dump(),
+            version=created.version,
+        ),
+    )
+    assert registry().get(created.server_id).secret_environment == {"token": False}
+
+
+def test_production_rejects_process_launch_even_after_approval() -> None:
+    service = registry(launch=False)
+    created = service.create(request(secret_environment_keys=[]))
+    service.trust(created.server_id, created.command_digest)
+    with pytest.raises(McpRegistryError) as error:
+        service.enable(created.server_id)
+    assert error.value.code == "MCP_SANDBOX_REQUIRED"
+
+
+@pytest.mark.parametrize("startup,tool", [(120, 300), (1.5, 2.5)])
+def test_server_timeouts_survive_bridge_adaptation_and_reload(startup, tool) -> None:
+    service = registry()
+    created = service.create(
+        request(
+            secret_environment_keys=[],
+            startup_timeout_seconds=startup,
+            tool_timeout_seconds=tool,
+        )
+    )
+    service.trust(created.server_id, created.command_digest)
+    try:
+        tested = service.test(created.server_id)
+        assert tested.last_test_succeeded is True
+        assert tested.startup_timeout_seconds == startup
+        assert tested.tool_timeout_seconds == tool
+        restored = registry().get(created.server_id)
+        assert restored.startup_timeout_seconds == startup
+        assert restored.tool_timeout_seconds == tool
+    finally:
+        service.shutdown()
+
+
+def test_enable_requires_successful_test_and_update_checks_version() -> None:
+    service = registry()
+    created = service.create(request(secret_environment_keys=[]))
+    service.trust(created.server_id, created.command_digest)
+    with pytest.raises(McpRegistryError) as error:
+        service.enable(created.server_id)
+    assert error.value.code == "MCP_CONNECTION_TEST_REQUIRED"
+
+    with pytest.raises(McpRegistryError) as error:
+        service.update(
+            created.server_id,
+            McpServerUpdateRequest(
+                **request(secret_environment_keys=[]).model_dump(), version=99
+            ),
+        )
+    assert error.value.code == "MCP_SERVER_VERSION_CONFLICT"
+
+
+def test_http_transport_rejects_invalid_cross_transport_fields() -> None:
+    service = registry()
+    with pytest.raises(McpRegistryError) as error:
+        service.create(
+            request(
+                transport="streamable_http",
+                url="https://example.invalid/mcp",
+                secret_environment_keys=[],
+            )
+        )
+    assert error.value.code == "MCP_CONFIG_INVALID"
+
+
+def test_registry_rejects_corrupt_persisted_json(tmp_path) -> None:
+    path = tmp_path / "mcp"
+    path.mkdir()
+    (path / "servers.json").write_text("{broken", encoding="utf-8")
+    with pytest.raises(McpRegistryError) as error:
+        McpServerRegistry(
+            ToolRegistry(),
+            EncryptedCredentialStore(),
+            tmp_path,
+            allow_process_launch=True,
+        )
+    assert error.value.code == "MCP_REGISTRY_INVALID"
+
+
+def test_registry_rejects_structurally_invalid_record(tmp_path) -> None:
+    path = tmp_path / "mcp"
+    path.mkdir()
+    (path / "servers.json").write_text(
+        json.dumps({"server-1": {"name": "Broken", "transport": "stdio"}}),
+        encoding="utf-8",
+    )
+    with pytest.raises(McpRegistryError) as error:
+        McpServerRegistry(
+            ToolRegistry(),
+            EncryptedCredentialStore(),
+            tmp_path,
+            allow_process_launch=True,
+        )
+    assert error.value.code == "MCP_REGISTRY_INVALID"
+
+
+def test_registry_rejects_create_before_exceeding_persisted_limit(
+    monkeypatch,
+) -> None:
+    service = registry()
+    service.create(request(name="Only server"))
+    monkeypatch.setattr("app.extensions.mcp_registry._MAX_MCP_SERVERS", 1)
+    with pytest.raises(McpRegistryError) as error:
+        service.create(request(name="One too many"))
+    assert error.value.code == "MCP_SERVER_LIMIT_REACHED"
+    assert len(service.list()) == 1
+    service.shutdown()
+
+
+def test_stdio_command_is_not_parsed_as_a_shell_string() -> None:
+    service = registry()
+    created = service.create(
+        request(
+            command=f'"{sys.executable}" "{SERVER}"',
+            args=[],
+            secret_environment_keys=[],
+        )
+    )
+    service.trust(created.server_id, created.command_digest)
+    with pytest.raises(McpRegistryError) as error:
+        service.test(created.server_id)
+    assert error.value.code == "PLUGIN_HOST_START_FAILED"
+    assert service.get(created.server_id).last_test_succeeded is False
+    service.shutdown()
+
+
+def test_enabled_server_is_restored_from_persisted_registry() -> None:
+    first = registry()
+    created = first.create(request(secret_environment_keys=[]))
+    first.trust(created.server_id, created.command_digest)
+    first.test(created.server_id)
+    first.enable(created.server_id)
+    first.shutdown()
+
+    restored = registry()
+    restored.restore_enabled()
+    current = restored.get(created.server_id)
+    assert current.enabled is True
+    assert current.status == "ready"
+    assert any(
+        item.name.startswith(f"mcp.{created.server_id}.")
+        for item in restored.tools.definitions()
+    )
+    restored.shutdown()
+
+
+def test_lifecycle_operations_are_serialized_and_tool_names_are_isolated() -> None:
+    service = registry()
+    servers = [
+        service.create(request(name=f"Echo {index}", secret_environment_keys=[]))
+        for index in range(2)
+    ]
+    for server in servers:
+        service.trust(server.server_id, server.command_digest)
+        service.test(server.server_id)
+
+    with ThreadPoolExecutor(max_workers=4) as pool:
+        enabled = list(
+            pool.map(lambda item: service.enable(item.server_id), servers * 2)
+        )
+    assert all(item.enabled for item in enabled)
+    names = [
+        item.name for item in service.tools.definitions() if item.source == "mcp_server"
+    ]
+    assert len(names) == len(set(names))
+    assert all(
+        any(name.startswith(f"mcp.{item.server_id}.") for name in names)
+        for item in servers
+    )
+
+    with ThreadPoolExecutor(max_workers=4) as pool:
+        list(pool.map(lambda item: service.disable(item.server_id), servers * 2))
+    assert not any(item.source == "mcp_server" for item in service.tools.definitions())
+    service.shutdown()
+
+
+def _http_result(request_id: int, result: dict) -> httpx.Response:
+    return httpx.Response(
+        200,
+        headers={"content-type": "application/json"},
+        json={"jsonrpc": "2.0", "id": request_id, "result": result},
+    )
+
+
+def test_streamable_http_supports_session_headers_secrets_and_tool_summary(
+    monkeypatch,
+) -> None:
+    requests: list[httpx.Request] = []
+    request_timeouts: dict[str, float] = {}
+
+    def handler(request_value: httpx.Request) -> httpx.Response:
+        requests.append(request_value)
+        if request_value.method == "GET":
+            return httpx.Response(405)
+        if request_value.method == "DELETE":
+            return httpx.Response(405)
+        payload = json.loads(request_value.content)
+        timeout = request_value.extensions.get("timeout", {}).get("read")
+        if isinstance(timeout, (int, float)):
+            request_timeouts[payload.get("method", "notification")] = float(timeout)
+        if payload.get("method") == "initialize":
+            response = _http_result(
+                payload["id"],
+                {
+                    "protocolVersion": "2025-11-25",
+                    "capabilities": {"tools": {}},
+                    "serverInfo": {"name": "HTTP Fixture", "version": "1"},
+                },
+            )
+            response.headers["MCP-Session-Id"] = "session-test"
+            return response
+        if payload.get("method") == "tools/list":
+            return _http_result(
+                payload["id"],
+                {
+                    "tools": [
+                        {
+                            "name": "echo",
+                            "description": "Echo over HTTP",
+                            "inputSchema": {"type": "object", "properties": {}},
+                        }
+                    ]
+                },
+            )
+        if payload.get("method") == "tools/call":
+            return _http_result(
+                payload["id"], {"structuredContent": {"transport": "http"}}
+            )
+        return httpx.Response(202)
+
+    real_client = httpx.Client
+    monkeypatch.setattr(
+        "app.extensions.mcp.httpx.Client",
+        lambda **kwargs: real_client(transport=httpx.MockTransport(handler), **kwargs),
+    )
+    service = registry()
+    created = service.create(
+        McpServerCreateRequest(
+            name="Remote MCP",
+            transport="streamable_http",
+            url="https://mcp.example.test/mcp",
+            headers={"X-Client": "NotesAgent"},
+            secret_header_keys=["Authorization"],
+        )
+    )
+    service.put_secret(
+        created.server_id, "Authorization", "Bearer hidden", kind="header"
+    )
+    service.trust(created.server_id, created.command_digest)
+    tested = service.test(created.server_id)
+
+    assert tested.last_test_succeeded is True
+    assert tested.secret_headers == {"Authorization": True}
+    assert "Bearer hidden" not in tested.model_dump_json()
+    assert service.list_tools(created.server_id)[0].remote_name == "echo"
+    assert any(
+        request.headers.get("mcp-session-id") == "session-test" for request in requests
+    )
+    assert any(
+        request.headers.get("mcp-protocol-version") == "2025-11-25"
+        for request in requests
+    )
+    assert all(
+        request.headers.get("authorization") == "Bearer hidden" for request in requests
+    )
+    assert request_timeouts["initialize"] == 15
+    assert request_timeouts["notifications/initialized"] == 15
+    assert request_timeouts["tools/list"] == 15
+    enabled = service.enable(created.server_id)
+    tool_name = service.list_tools(created.server_id)[0].name
+    result = asyncio.run(
+        service.tools.execute(
+            ToolCall(tool_call_id="call-1", name=tool_name, arguments={}),
+            ToolExecutionContext(run_id="run-1"),
+        )
+    )
+    assert enabled.enabled is True
+    assert result.success is True
+    assert result.output == {"transport": "http"}
+    assert request_timeouts["tools/call"] == 30
+    service.disable(created.server_id)
+    service.shutdown()
+
+
+class _LegacyEventStream(httpx.SyncByteStream):
+    def __init__(self) -> None:
+        self.closed = threading.Event()
+
+    def __iter__(self):
+        yield b"event: endpoint\ndata: /messages\n\n"
+        time.sleep(0.1)
+        initialize = {
+            "jsonrpc": "2.0",
+            "id": 1,
+            "result": {
+                "protocolVersion": "2024-11-05",
+                "capabilities": {"tools": {}},
+                "serverInfo": {"name": "Legacy Fixture"},
+            },
+        }
+        yield f"data: {json.dumps(initialize)}\n\n".encode()
+        time.sleep(0.1)
+        tools = {
+            "jsonrpc": "2.0",
+            "id": 2,
+            "result": {"tools": []},
+        }
+        yield f"data: {json.dumps(tools)}\n\n".encode()
+        self.closed.wait()
+
+    def close(self) -> None:
+        self.closed.set()
+
+
+def test_legacy_sse_uses_same_origin_endpoint(monkeypatch) -> None:
+    posted_urls: list[str] = []
+    event_stream = _LegacyEventStream()
+
+    def handler(request_value: httpx.Request) -> httpx.Response:
+        if request_value.method == "GET":
+            return httpx.Response(
+                200,
+                headers={"content-type": "text/event-stream"},
+                stream=event_stream,
+            )
+        posted_urls.append(str(request_value.url))
+        return httpx.Response(202)
+
+    real_client = httpx.Client
+    monkeypatch.setattr(
+        "app.extensions.mcp.httpx.Client",
+        lambda **kwargs: real_client(transport=httpx.MockTransport(handler), **kwargs),
+    )
+    service = registry()
+    created = service.create(
+        McpServerCreateRequest(
+            name="Legacy MCP",
+            transport="sse",
+            url="https://legacy.example.test/sse",
+        )
+    )
+    service.trust(created.server_id, created.command_digest)
+    tested = service.test(created.server_id)
+    assert tested.last_test_succeeded is True
+    assert posted_urls and all(
+        url == "https://legacy.example.test/messages" for url in posted_urls
+    )
+    service.shutdown()
+    event_stream.close()
+
+
+class _EndingLegacyEventStream(httpx.SyncByteStream):
+    def __iter__(self):
+        yield b"event: endpoint\ndata: /messages\n\n"
+
+
+def test_legacy_sse_eof_marks_client_unavailable(monkeypatch) -> None:
+    def handler(_request_value: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            headers={"content-type": "text/event-stream"},
+            stream=_EndingLegacyEventStream(),
+        )
+
+    real_client = httpx.Client
+    monkeypatch.setattr(
+        "app.extensions.mcp.httpx.Client",
+        lambda **kwargs: real_client(transport=httpx.MockTransport(handler), **kwargs),
+    )
+    broken = threading.Event()
+    client = McpLegacySseClient(
+        "https://legacy.example.test/sse",
+        headers={},
+        startup_timeout_seconds=1,
+        on_seen=lambda: None,
+        on_broken=lambda _message: broken.set(),
+        on_tools_changed=lambda: None,
+    )
+    client.start()
+    assert broken.wait(timeout=1)
+    client.stop()
+
+
+class _CrossOriginLegacyEventStream(httpx.SyncByteStream):
+    def __iter__(self):
+        yield b"event: endpoint\ndata: https://attacker.example/messages\n\n"
+
+
+def test_legacy_sse_rejects_cross_origin_message_endpoint(monkeypatch) -> None:
+    def handler(request_value: httpx.Request) -> httpx.Response:
+        assert request_value.method == "GET"
+        return httpx.Response(
+            200,
+            headers={"content-type": "text/event-stream"},
+            stream=_CrossOriginLegacyEventStream(),
+        )
+
+    real_client = httpx.Client
+    monkeypatch.setattr(
+        "app.extensions.mcp.httpx.Client",
+        lambda **kwargs: real_client(transport=httpx.MockTransport(handler), **kwargs),
+    )
+    service = registry()
+    created = service.create(
+        McpServerCreateRequest(
+            name="Unsafe legacy MCP",
+            transport="sse",
+            url="https://legacy.example.test/sse",
+        )
+    )
+    service.trust(created.server_id, created.command_digest)
+    with pytest.raises(McpRegistryError) as error:
+        service.test(created.server_id)
+    assert error.value.code == "MCP_HTTP_RESPONSE_INVALID"
+    service.shutdown()

backend/tests/test_mcp_sse_limits.py

@@ -0,0 +1,83 @@
+import json
+from contextlib import closing
+
+import httpx
+import pytest
+
+from app.extensions import mcp
+
+
+class ChunkStream(httpx.SyncByteStream):
+    def __init__(self, chunks):
+        self.chunks = chunks
+        self.bytes_read = 0
+
+    def __iter__(self):
+        for chunk in self.chunks:
+            self.bytes_read += len(chunk)
+            yield chunk
+
+
+def test_sse_rejects_unterminated_line_before_reading_entire_stream(monkeypatch):
+    monkeypatch.setattr(mcp, "MAX_MCP_MESSAGE_BYTES", 1024)
+    stream = ChunkStream([b"x" * 256] * 256)
+    with (
+        closing(httpx.Response(200, stream=stream)) as response,
+        pytest.raises(mcp.McpBridgeError, match="too large"),
+    ):
+        list(mcp._iter_sse(response))
+    assert stream.bytes_read == 1280
+
+
+def test_sse_limits_combined_event_before_partial_line_is_complete(monkeypatch):
+    monkeypatch.setattr(mcp, "MAX_MCP_MESSAGE_BYTES", 32)
+    stream = ChunkStream(
+        [b"data: 123456789\n", b"data: 123456789\n", b"x", b"not-read"]
+    )
+    with (
+        closing(httpx.Response(200, stream=stream)) as response,
+        pytest.raises(mcp.McpBridgeError, match="too large"),
+    ):
+        list(mcp._iter_sse(response))
+    assert stream.bytes_read == 33
+
+
+@pytest.mark.parametrize("separator", [b"\n", b"\r", b"\r\n"])
+@pytest.mark.parametrize("chunk_size", [1, 2, 7, 1024])
+def test_sse_preserves_utf8_and_line_endings_across_chunks(separator, chunk_size):
+    payload = json.dumps(
+        {"jsonrpc": "2.0", "id": 1, "result": {"text": "中文"}}, ensure_ascii=False
+    )
+    wire = b"\xef\xbb\xbf" + separator.join(
+        [
+            b": heartbeat",
+            b"event: message",
+            b"id: replay-1",
+            ("data: " + payload).encode(),
+            b"",
+            b"",
+        ]
+    )
+    stream = ChunkStream(
+        [wire[index : index + chunk_size] for index in range(0, len(wire), chunk_size)]
+    )
+    with closing(httpx.Response(200, stream=stream)) as response:
+        assert list(mcp._iter_sse(response)) == [("message", "replay-1", payload)]
+
+
+def test_sse_event_limit_resets_between_events(monkeypatch):
+    monkeypatch.setattr(mcp, "MAX_MCP_MESSAGE_BYTES", 16)
+    with closing(
+        httpx.Response(200, stream=ChunkStream([b"data: one\n\ndata: two\r\r"]))
+    ) as response:
+        assert list(mcp._iter_sse(response)) == [
+            ("message", None, "one"),
+            ("message", None, "two"),
+        ]
+
+
+def test_sse_preserves_multiline_data_and_final_unterminated_line():
+    with closing(
+        httpx.Response(200, stream=ChunkStream([b"data: first\ndata: last"]))
+    ) as response:
+        assert list(mcp._iter_sse(response)) == [("message", None, "first\nlast")]

frontend/src/components/common/PrimarySidebar.vue

@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import { useRoute, useRouter } from 'vue-router'
 import { computed, ref } from 'vue'
-import { ArrowLeftBold, ArrowRightBold, Brush, ChatDotRound, CircleCheck, Connection, Cpu, FolderOpened, Lightning, Search, Setting } from '@element-plus/icons-vue'
+import { ArrowLeftBold, ArrowRightBold, Brush, ChatDotRound, CircleCheck, Connection, Cpu, FolderOpened, Lightning, Monitor, Search, Setting } from '@element-plus/icons-vue'
 import AppIcon from './AppIcon.vue'
 
 const route = useRoute()
@@ -16,6 +16,7 @@ const navItems = [
   { name: 'tasks', icon: CircleCheck, label: '任务' },
   { name: 'skills', icon: Lightning, label: 'Skill' },
   { name: 'plugins', icon: Connection, label: 'Plugin' },
+  { name: 'mcp-servers', icon: Monitor, label: 'MCP' },
   { name: 'themes', icon: Brush, label: '主题' },
   { name: 'settings', icon: Setting, label: '设置' },
 ]

frontend/src/contracts/index.ts

@@ -193,7 +193,7 @@ export interface ToolDefinition {
   name: string
   description: string
   parameters: Record<string, unknown>
-  source?: 'builtin' | 'plugin'
+  source?: 'builtin' | 'plugin' | 'mcp_server'
   plugin_id?: string
 }
 
@@ -535,6 +535,51 @@ export interface OperationResponse {
   message?: string | null
 }
 
+export type McpServerTransport = 'stdio' | 'streamable_http' | 'sse'
+export type McpServerState = 'stopped' | 'starting' | 'ready' | 'unhealthy' | 'error'
+
+export interface McpServerInput {
+  version?: number
+  name: string
+  transport: McpServerTransport
+  command?: string | null
+  args: string[]
+  url?: string | null
+  headers: Record<string, string>
+  environment: Record<string, string>
+  secret_environment_keys: string[]
+  secret_header_keys: string[]
+  permissions: string[]
+  startup_timeout_seconds: number
+  tool_timeout_seconds: number
+}
+
+export interface McpServer extends Omit<McpServerInput, 'secret_environment_keys' | 'secret_header_keys'> {
+  server_id: string
+  version: number
+  secret_environment: Record<string, boolean>
+  secret_headers: Record<string, boolean>
+  enabled: boolean
+  trusted: boolean
+  command_digest: string
+  command_summary: string
+  status: McpServerState
+  tools_count: number
+  protocol_version?: string | null
+  remote_server_name?: string | null
+  remote_server_version?: string | null
+  error?: string | null
+  last_tested_at?: string | null
+  last_test_succeeded?: boolean | null
+}
+
+export interface McpToolSummary {
+  name: string
+  remote_name: string
+  description: string
+  permission?: string | null
+}
+
 export interface ApiNoteBlock {
   block_id: string
   note_id: string

frontend/src/features/mcp/McpServersView.spec.ts

@@ -0,0 +1,169 @@
+// @vitest-environment happy-dom
+import { flushPromises, mount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { McpServer } from '@/contracts'
+import * as service from '@/services/mcpServerService'
+import McpServersView from './McpServersView.vue'
+
+vi.mock('@/services/mcpServerService', () => ({
+  listMcpServers: vi.fn(), createMcpServer: vi.fn(), updateMcpServer: vi.fn(),
+  deleteMcpServer: vi.fn(), trustMcpServer: vi.fn(), testMcpServer: vi.fn(),
+  enableMcpServer: vi.fn(), disableMcpServer: vi.fn(), putMcpServerSecret: vi.fn(),
+}))
+
+const server: McpServer = {
+  server_id: 'server-1', version: 2, name: 'Remote', transport: 'streamable_http',
+  command: null, args: [], url: 'https://mcp.example.test/mcp', headers: {}, environment: {},
+  secret_environment: {}, secret_headers: { Authorization: false }, permissions: [],
+  startup_timeout_seconds: 15, tool_timeout_seconds: 30, enabled: false, trusted: true,
+  command_digest: 'a'.repeat(64), command_summary: 'https://mcp.example.test/mcp',
+  status: 'stopped', tools_count: 1, last_test_succeeded: false,
+}
+
+async function render(items: McpServer[] = []) {
+  vi.mocked(service.listMcpServers).mockResolvedValue(items)
+  const wrapper = mount(McpServersView, { global: { stubs: { AppIcon: true } } })
+  await flushPromises()
+  return wrapper
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.stubGlobal('confirm', vi.fn(() => true))
+})
+
+describe('McpServersView', () => {
+  it('switches transport templates and round-trips the JSON configuration mode', async () => {
+    const wrapper = await render()
+    await wrapper.findAll('button').find(button => button.text() === '新增服务器')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === 'Streamable HTTP')!.trigger('click')
+    expect(wrapper.find('input[placeholder="https://example.com/mcp"]').exists()).toBe(true)
+
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    const raw = (wrapper.get('.json-editor').element as HTMLTextAreaElement).value
+    expect(JSON.parse(raw)).toMatchObject({ transport: 'streamable_http', command: null })
+    expect(raw).not.toContain('secret_value')
+
+    await wrapper.findAll('button').find(button => button.text() === '表单配置')!.trigger('click')
+    expect(wrapper.text()).toContain('MCP URL')
+  })
+
+  it('rejects invalid JSON without sending a create request', async () => {
+    const wrapper = await render()
+    await wrapper.findAll('button').find(button => button.text() === '新增服务器')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    await wrapper.get('.json-editor').setValue('{invalid')
+    await flushPromises()
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+    expect(wrapper.text()).toContain('服务器配置不是有效 JSON')
+    expect(service.createMcpServer).not.toHaveBeenCalled()
+  })
+
+  it('keeps secrets request-only, exposes test failures, and confirms deletion', async () => {
+    const wrapper = await render([server])
+    const password = wrapper.get('input[type="password"]')
+    await password.setValue('request-only-secret')
+    vi.mocked(service.putMcpServerSecret).mockResolvedValue({} as never)
+    await wrapper.findAll('button').find(button => button.text() === '保存')!.trigger('click')
+    await flushPromises()
+    expect(service.putMcpServerSecret).toHaveBeenCalledWith('server-1', 'Authorization', 'request-only-secret', 'header')
+    expect((password.element as HTMLInputElement).value).toBe('')
+
+    vi.mocked(service.testMcpServer).mockRejectedValue(new Error('连接失败'))
+    await wrapper.findAll('button').find(button => button.text().includes('测试连接'))!.trigger('click')
+    await flushPromises()
+    expect(wrapper.text()).toContain('连接失败')
+
+    vi.mocked(service.deleteMcpServer).mockResolvedValue({ status: 'completed' })
+    await wrapper.findAll('button').find(button => button.text().includes('删除'))!.trigger('click')
+    await flushPromises()
+    expect(confirm).toHaveBeenCalled()
+    expect(service.deleteMcpServer).toHaveBeenCalledWith('server-1')
+  })
+
+  it('confirms permission changes before updating an existing server', async () => {
+    const wrapper = await render([server])
+    vi.mocked(service.updateMcpServer).mockResolvedValue(server)
+    await wrapper.findAll('button').find(button => button.text().includes('编辑'))!.trigger('click')
+    await wrapper.get('input[placeholder="network.request, notes.read"]').setValue('notes.read')
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+    expect(confirm).toHaveBeenCalledWith(expect.stringContaining('旧测试与授权会失效'))
+    expect(service.updateMcpServer).toHaveBeenCalled()
+  })
+
+  it('saves an environment API key via the encrypted endpoint, not the config body', async () => {
+    const wrapper = await render()
+    vi.mocked(service.createMcpServer).mockResolvedValue({ ...server, server_id: 'new-server' })
+    vi.mocked(service.putMcpServerSecret).mockResolvedValue({})
+    await wrapper.findAll('button').find(button => button.text() === '新增服务器')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    await wrapper.get('.json-editor').setValue(JSON.stringify({ command: 'uvx', environment: { MINIMAX_API_KEY: 'synthetic-only' }, secret_environment_keys: ['MINIMAX_API_KEY'] }))
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+    expect(service.createMcpServer).toHaveBeenCalledWith(expect.objectContaining({ environment: {}, secret_environment_keys: ['MINIMAX_API_KEY'] }))
+    expect(JSON.stringify(vi.mocked(service.createMcpServer).mock.calls)).not.toContain('synthetic-only')
+    expect(service.putMcpServerSecret).toHaveBeenCalledWith('new-server', 'MINIMAX_API_KEY', 'synthetic-only', 'environment')
+    expect(wrapper.find('.modal-backdrop').exists()).toBe(false)
+  })
+
+  it('retains imported keys over mode switches and retries partial saves without duplicates', async () => {
+    const wrapper = await render()
+    vi.mocked(service.createMcpServer).mockResolvedValue({ ...server, server_id: 'new-server', version: 1 })
+    vi.mocked(service.updateMcpServer).mockResolvedValue({ ...server, server_id: 'new-server', version: 2 })
+    vi.mocked(service.putMcpServerSecret).mockRejectedValueOnce(new Error('credential store unavailable')).mockResolvedValue({})
+    await wrapper.findAll('button').find(button => button.text() === '新增服务器')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    await wrapper.get('.json-editor').setValue(JSON.stringify({ command: 'uvx', env: { API_KEY: 'retry-value' } }))
+    await wrapper.findAll('button').find(button => button.text() === '表单配置')!.trigger('click')
+    expect(wrapper.text()).toContain('已识别 1 项密钥')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    expect((wrapper.get('.json-editor').element as HTMLTextAreaElement).value).not.toContain('retry-value')
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+    expect(wrapper.get('.modal-card [role="alert"]').text()).toContain('服务器配置已保存，但密钥保存失败')
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+    expect(service.createMcpServer).toHaveBeenCalledTimes(1)
+    expect(service.updateMcpServer).toHaveBeenCalledWith('new-server', expect.objectContaining({ version: 1 }))
+    expect(service.putMcpServerSecret).toHaveBeenCalledTimes(2)
+    expect(wrapper.find('.modal-backdrop').exists()).toBe(false)
+  })
+
+  it('clears staged keys on cancel and accepts minimal JSON while editing', async () => {
+    const wrapper = await render([server])
+    await wrapper.findAll('button').find(button => button.text() === '新增服务器')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    await wrapper.get('.json-editor').setValue('{"command":"uvx","env":{"API_KEY":"cancelled-value"}}')
+    await wrapper.findAll('button').find(button => button.text() === '表单配置')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === '取消')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text().includes('编辑'))!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    await wrapper.get('.json-editor').setValue('{"name":"Minimal","url":"https://example.test/mcp"}')
+    vi.mocked(service.updateMcpServer).mockResolvedValue(server)
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+    expect(service.updateMcpServer).toHaveBeenCalledWith('server-1', expect.objectContaining({ version: 2, headers: {}, args: [] }))
+    expect(service.putMcpServerSecret).not.toHaveBeenCalled()
+  })
+
+  it('saves an imported Header secret after a case-only declaration rename', async () => {
+    const wrapper = await render()
+    vi.mocked(service.createMcpServer).mockResolvedValue({ ...server, secret_headers: { authorization: false } })
+    vi.mocked(service.putMcpServerSecret).mockResolvedValue({})
+    await wrapper.findAll('button').find(button => button.text() === '新增服务器')!.trigger('click')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    await wrapper.get('.json-editor').setValue(JSON.stringify({ url: 'https://example.test/mcp', headers: { Authorization: 'synthetic-draft' } }))
+    await wrapper.findAll('button').find(button => button.text() === '表单配置')!.trigger('click')
+    await wrapper.get('textarea[placeholder="Authorization"]').setValue('authorization')
+    await wrapper.findAll('button').find(button => button.text() === 'JSON 配置')!.trigger('click')
+    expect(wrapper.text()).toContain('已识别 1 项密钥')
+    expect((wrapper.get('.json-editor').element as HTMLTextAreaElement).value).not.toContain('synthetic-draft')
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+    expect(service.createMcpServer).toHaveBeenCalledWith(expect.objectContaining({ headers: {}, secret_header_keys: ['authorization'] }))
+    expect(service.putMcpServerSecret).toHaveBeenCalledWith('server-1', 'authorization', 'synthetic-draft', 'header')
+    expect(wrapper.find('.modal-backdrop').exists()).toBe(false)
+  })
+})

frontend/src/features/mcp/McpServersView.vue

@@ -0,0 +1,275 @@
+<script setup lang="ts">
+import { computed, onMounted, reactive, ref } from 'vue'
+import { Connection, Delete, EditPen, Plus, Refresh, VideoPlay } from '@element-plus/icons-vue'
+import AppIcon from '@/components/common/AppIcon.vue'
+import type { McpServer, McpServerInput, McpServerTransport } from '@/contracts'
+import * as service from '@/services/mcpServerService'
+import { emptyMcpConfig, mergeImportedSecrets, normalizeMcpConfig, parseMcpJson, type ImportedSecret, type SecretKind } from './configuration'
+
+const servers = ref<McpServer[]>([])
+const busy = ref('')
+const error = ref('')
+const dialogOpen = ref(false)
+const editingId = ref<string | null>(null)
+const editingOriginal = ref<McpServer | null>(null)
+const editorMode = ref<'form' | 'json'>('form')
+const argsText = ref('')
+const environmentText = ref('{}')
+const headersText = ref('{}')
+const secretKeysText = ref('')
+const secretHeaderKeysText = ref('')
+const permissionsText = ref('')
+const rawConfig = ref('')
+const secretDrafts = reactive<Record<string, string>>({})
+const form = reactive<McpServerInput>(emptyMcpConfig())
+const importedSecrets = ref<ImportedSecret[]>([])
+
+const dialogTitle = computed(() => editingId.value ? '编辑 MCP 服务器' : '新增 MCP 服务器')
+
+async function load() {
+  error.value = ''
+  try { servers.value = await service.listMcpServers() }
+  catch (cause) { error.value = message(cause, '读取 MCP 服务器失败') }
+}
+
+function resetEditor(input: McpServerInput) {
+  Object.assign(form, emptyMcpConfig(), { version: undefined }, input)
+  argsText.value = input.args.join('\n')
+  environmentText.value = JSON.stringify(input.environment, null, 2)
+  headersText.value = JSON.stringify(input.headers, null, 2)
+  secretKeysText.value = input.secret_environment_keys.join('\n')
+  secretHeaderKeysText.value = input.secret_header_keys.join('\n')
+  permissionsText.value = input.permissions.join(', ')
+  editorMode.value = 'form'
+  rawConfig.value = ''
+}
+
+function openCreate() {
+  if (busy.value) return
+  error.value = ''
+  importedSecrets.value = []
+  editingId.value = null
+  editingOriginal.value = null
+  resetEditor(emptyMcpConfig())
+  dialogOpen.value = true
+}
+
+function openEdit(server: McpServer) {
+  if (busy.value) return
+  error.value = ''
+  importedSecrets.value = []
+  editingId.value = server.server_id
+  editingOriginal.value = server
+  resetEditor({
+    version: server.version, name: server.name, transport: server.transport,
+    command: server.command, args: [...server.args], url: server.url,
+    headers: { ...server.headers }, environment: { ...server.environment },
+    secret_environment_keys: Object.keys(server.secret_environment),
+    secret_header_keys: Object.keys(server.secret_headers), permissions: [...server.permissions],
+    startup_timeout_seconds: server.startup_timeout_seconds,
+    tool_timeout_seconds: server.tool_timeout_seconds,
+  })
+  dialogOpen.value = true
+}
+
+function applyTemplate(transport: McpServerTransport) {
+  form.transport = transport
+  if (transport === 'stdio') {
+    form.command = 'uvx'; form.url = null
+    argsText.value = '--isolated\n--from\npackage-name==1.0.0\nserver-command'
+  } else {
+    form.command = null; argsText.value = ''; form.url = transport === 'sse' ? 'http://127.0.0.1:3000/sse' : 'http://127.0.0.1:3000/mcp'
+  }
+}
+
+function parseObject(value: string, label: string): Record<string, string> {
+  let parsed: unknown
+  try { parsed = JSON.parse(value || '{}') } catch { throw new Error(`${label}必须是 JSON 对象`) }
+  if (!parsed || Array.isArray(parsed) || typeof parsed !== 'object' || Object.values(parsed).some(item => typeof item !== 'string')) throw new Error(`${label}必须是字符串键值 JSON 对象`)
+  return parsed as Record<string, string>
+}
+
+function formPayload(): McpServerInput {
+  const stdio = form.transport === 'stdio'
+  return {
+    version: form.version,
+    name: form.name.trim(), transport: form.transport,
+    command: stdio ? form.command?.trim() : null,
+    args: stdio ? argsText.value.split('\n').map(value => value.trim()).filter(Boolean) : [],
+    url: stdio ? null : form.url?.trim(),
+    headers: stdio ? {} : parseObject(headersText.value, '普通 Header'),
+    environment: stdio ? parseObject(environmentText.value, '普通环境变量') : {},
+    secret_environment_keys: stdio ? splitKeys(secretKeysText.value) : [],
+    secret_header_keys: stdio ? [] : splitKeys(secretHeaderKeysText.value),
+    permissions: permissionsText.value.split(',').map(value => value.trim()).filter(Boolean),
+    startup_timeout_seconds: form.startup_timeout_seconds,
+    tool_timeout_seconds: form.tool_timeout_seconds,
+  }
+}
+
+function payload(requireConnection = true): McpServerInput {
+  const { config, secrets } = editorMode.value === 'form'
+    ? normalizeMcpConfig(formPayload(), '', requireConnection) : parseMcpJson(rawConfig.value, form.name, requireConnection)
+  // Keep only still-declared drafts. A mode switch must not discard imported keys,
+  // and editing the declaration must not later send a removed key to the Secret API.
+  importedSecrets.value = mergeImportedSecrets(config, importedSecrets.value, secrets)
+  if (editingId.value) config.version = form.version
+  if (editorMode.value === 'json') rawConfig.value = JSON.stringify(config, null, 2)
+  else {
+    environmentText.value = JSON.stringify(config.environment, null, 2)
+    headersText.value = JSON.stringify(config.headers, null, 2)
+    secretKeysText.value = config.secret_environment_keys.join('\n')
+    secretHeaderKeysText.value = config.secret_header_keys.join('\n')
+  }
+  return config
+}
+
+function switchMode(mode: 'form' | 'json') {
+  try {
+    if (mode === editorMode.value) return
+    error.value = ''
+    if (mode === 'json') rawConfig.value = JSON.stringify(payload(false), null, 2)
+    else resetEditor(payload(false))
+    editorMode.value = mode
+  } catch (cause) { error.value = message(cause, '配置转换失败') }
+}
+
+async function save() {
+  if (busy.value) return
+  let saved: McpServer | undefined
+  try {
+    error.value = ''
+    const input = payload()
+    if (!input.name || (input.transport === 'stdio' ? !input.command : !input.url)) throw new Error('请填写服务器名称和连接地址')
+    if (editingOriginal.value && executionChanged(editingOriginal.value, input) && !confirm('连接命令、地址或认证配置已变化，保存后旧测试与授权会失效。是否保存？')) return
+    busy.value = 'save'
+    saved = editingId.value ? await service.updateMcpServer(editingId.value, input) : await service.createMcpServer(input)
+    // Commit the returned ID/version before saving secrets so a partial failure can
+    // retry this server instead of creating a duplicate or sending a stale version.
+    editingId.value = saved.server_id
+    editingOriginal.value = saved
+    resetEditor({ ...input, version: saved.version })
+    for (const item of [...importedSecrets.value]) {
+      await service.putMcpServerSecret(saved.server_id, item.key, item.value, item.kind)
+      importedSecrets.value = importedSecrets.value.filter(candidate => candidate !== item)
+    }
+    closeEditor()
+    await load()
+  } catch (cause) {
+    if (saved) await load()
+    error.value = `${saved ? '服务器配置已保存，但密钥保存失败；可点击保存重试。' : ''}${message(cause, '保存失败')}`
+  }
+  finally { busy.value = '' }
+}
+
+function closeEditor() {
+  importedSecrets.value = []
+  rawConfig.value = ''
+  environmentText.value = '{}'
+  headersText.value = '{}'
+  dialogOpen.value = false
+}
+
+function executionChanged(server: McpServer, input: McpServerInput) {
+  const sortedEntries = (value: Record<string, string>) => Object.entries(value).sort(([left], [right]) => left.localeCompare(right))
+  const current = [
+    server.transport, server.command, server.args, server.url,
+    sortedEntries(server.headers), sortedEntries(server.environment),
+    Object.keys(server.secret_headers).sort(), Object.keys(server.secret_environment).sort(),
+    [...server.permissions].sort(), server.startup_timeout_seconds, server.tool_timeout_seconds,
+  ]
+  const next = [
+    input.transport, input.command, input.args, input.url,
+    sortedEntries(input.headers), sortedEntries(input.environment),
+    [...input.secret_header_keys].sort(), [...input.secret_environment_keys].sort(),
+    [...input.permissions].sort(), input.startup_timeout_seconds, input.tool_timeout_seconds,
+  ]
+  return JSON.stringify(current) !== JSON.stringify(next)
+}
+
+async function approve(server: McpServer): Promise<McpServer | null> {
+  if (server.trusted) return server
+  const localWarning = server.transport === 'stdio' ? '\n\n本机进程尚无系统级沙箱，仅应运行可信服务器。' : '\n\n连接可能向该地址发送配置的 Header。'
+  if (!confirm(`请确认 MCP 连接：\n\n${server.command_summary}${localWarning}\n\n是否继续？`)) return null
+  return service.trustMcpServer(server)
+}
+
+async function test(server: McpServer) { await act(server, 'test', current => service.testMcpServer(current.server_id)) }
+async function toggle(server: McpServer) { await act(server, 'toggle', current => current.enabled ? service.disableMcpServer(current.server_id) : service.enableMcpServer(current.server_id)) }
+async function act(server: McpServer, action: string, operation: (server: McpServer) => Promise<McpServer>) {
+  busy.value = `${action}:${server.server_id}`; error.value = ''
+  try { const current = action === 'toggle' && server.enabled ? server : await approve(server); if (!current) return; await operation(current); await load() }
+  catch (cause) { error.value = message(cause, '操作失败') }
+  finally { busy.value = '' }
+}
+
+async function remove(server: McpServer) {
+  if (!confirm(`删除“${server.name}”及其加密凭据？`)) return
+  try { busy.value = `delete:${server.server_id}`; await service.deleteMcpServer(server.server_id); await load() }
+  catch (cause) { error.value = message(cause, '删除失败') } finally { busy.value = '' }
+}
+
+async function saveSecret(server: McpServer, key: string, kind: SecretKind) {
+  const draftKey = `${server.server_id}:${kind}:${key}`
+  const value = secretDrafts[draftKey]?.trim()
+  if (!value) return
+  try { busy.value = `secret:${draftKey}`; await service.putMcpServerSecret(server.server_id, key, value, kind); secretDrafts[draftKey] = ''; await load() }
+  catch (cause) { error.value = message(cause, '保存密钥失败') } finally { busy.value = '' }
+}
+
+function splitKeys(value: string) { return value.split(/[\n,]/).map(item => item.trim()).filter(Boolean) }
+function message(cause: unknown, fallback: string) { return cause instanceof Error ? cause.message : fallback }
+onMounted(load)
+</script>
+
+<template>
+  <section class="feature-page mcp-page">
+    <header class="feature-header"><div><h1>MCP 服务器</h1><p>管理独立 MCP Server 的连接、凭据与工具生命周期。</p></div><div class="inline-actions"><button class="button-secondary" :disabled="!!busy" @click="load"><AppIcon :icon="Refresh" /> 刷新</button><button class="button-primary" @click="openCreate"><AppIcon :icon="Plus" /> 新增服务器</button></div></header>
+    <div class="notice-banner">stdio 本机进程仅在开发环境开放；Streamable HTTP 为首选远程传输，SSE 仅用于兼容旧服务器。uvx 隔离依赖但不是安全沙箱。</div>
+    <div v-if="error" class="error-banner">{{ error }}</div>
+    <div v-if="!servers.length" class="panel empty"><AppIcon :icon="Connection" :size="34" /><h2>尚未配置 MCP 服务器</h2><p>添加 Server，测试连接成功后才能启用工具。</p><button class="button-primary" @click="openCreate">新增服务器</button></div>
+    <div v-else class="server-list">
+      <article v-for="server in servers" :key="server.server_id" class="panel server-card">
+        <div class="server-main"><div class="server-title"><AppIcon :icon="Connection" :size="24" /><div><h2>{{ server.name }}</h2><code>{{ server.command_summary }}</code></div></div><span class="badge" :class="{ success: server.status === 'ready', error: ['error','unhealthy'].includes(server.status) }">{{ server.status }}</span></div>
+        <div class="metadata"><span>{{ server.transport }}</span><span>v{{ server.version }}</span><span>{{ server.tools_count }} 个工具</span><span>{{ server.trusted ? '连接已确认' : '等待确认连接' }}</span><span v-if="server.last_test_succeeded">当前配置测试成功</span><span v-if="server.remote_server_name">{{ server.remote_server_name }} {{ server.remote_server_version }}</span></div>
+        <div v-if="server.error" class="error-banner compact">{{ server.error }}</div>
+        <div v-if="Object.keys(server.secret_environment).length || Object.keys(server.secret_headers).length" class="secrets">
+          <label v-for="(configured, key) in server.secret_environment" :key="`env:${key}`"><span>环境变量 · {{ key }} <small>{{ configured ? '已加密保存' : '未配置' }}</small></span><span class="secret-input"><input v-model="secretDrafts[`${server.server_id}:environment:${key}`]" type="password" autocomplete="new-password" placeholder="输入后保存（不会回显）"><button class="button-secondary" @click="saveSecret(server, key, 'environment')">保存</button></span></label>
+          <label v-for="(configured, key) in server.secret_headers" :key="`header:${key}`"><span>HTTP Header · {{ key }} <small>{{ configured ? '已加密保存' : '未配置' }}</small></span><span class="secret-input"><input v-model="secretDrafts[`${server.server_id}:header:${key}`]" type="password" autocomplete="new-password" placeholder="输入后保存（不会回显）"><button class="button-secondary" @click="saveSecret(server, key, 'header')">保存</button></span></label>
+        </div>
+        <footer class="card-actions"><button class="button-secondary" :disabled="!!busy || server.enabled" @click="test(server)"><AppIcon :icon="VideoPlay" /> 测试连接</button><button class="button-secondary" :disabled="!!busy" @click="openEdit(server)"><AppIcon :icon="EditPen" /> 编辑</button><button class="button-danger" :disabled="!!busy" @click="remove(server)"><AppIcon :icon="Delete" /> 删除</button><button class="button-primary" :disabled="!!busy || (!server.enabled && !server.last_test_succeeded)" :title="!server.enabled && !server.last_test_succeeded ? '请先测试当前配置' : ''" @click="toggle(server)">{{ server.enabled ? '停用' : '启用' }}</button></footer>
+      </article>
+    </div>
+
+    <div v-if="dialogOpen" class="modal-backdrop" @click.self="!busy && closeEditor()">
+      <form class="modal-card" @submit.prevent="save">
+        <fieldset :disabled="!!busy" class="editor-fields">
+        <header><h2><AppIcon :icon="Plus" /> {{ dialogTitle }}</h2><button type="button" class="close" @click="closeEditor">×</button></header>
+        <div v-if="error" class="error-banner" role="alert">{{ error }}</div>
+        <div v-if="importedSecrets.length" class="notice-banner">已识别 {{ importedSecrets.length }} 项密钥，保存时将单独加密，不会写入普通服务器配置；取消将清除未保存密钥。</div>
+        <div class="mode-tabs"><button type="button" :class="{ active: editorMode === 'form' }" @click="switchMode('form')">表单配置</button><button type="button" :class="{ active: editorMode === 'json' }" @click="switchMode('json')">JSON 配置</button></div>
+        <template v-if="editorMode === 'form'">
+          <label>服务器名称<input v-model="form.name" maxlength="80" placeholder="例如：文件系统工具"></label>
+          <div class="template-row"><span>服务器配置</span><button type="button" class="template" :class="{ active: form.transport === 'stdio' }" @click="applyTemplate('stdio')">stdio 模板</button><button type="button" class="template" :class="{ active: form.transport === 'streamable_http' }" @click="applyTemplate('streamable_http')">Streamable HTTP</button><button type="button" class="template" :class="{ active: form.transport === 'sse' }" @click="applyTemplate('sse')">SSE（兼容）</button></div>
+          <template v-if="form.transport === 'stdio'"><label>可执行命令<input v-model="form.command" placeholder="uvx、npx 或可信可执行文件路径"></label><label>参数（每行一项）<textarea v-model="argsText" rows="5"></textarea></label><div class="two-columns"><label>普通环境变量（JSON）<textarea v-model="environmentText" rows="5"></textarea></label><label>敏感环境变量名（每行一项）<textarea v-model="secretKeysText" rows="5" placeholder="API_KEY"></textarea></label></div></template>
+          <template v-else><label>MCP URL<input v-model="form.url" placeholder="https://example.com/mcp"></label><div class="two-columns"><label>普通 Header（JSON）<textarea v-model="headersText" rows="5" placeholder='{"X-Client":"NotesAgent"}'></textarea></label><label>敏感 Header 名（每行一项）<textarea v-model="secretHeaderKeysText" rows="5" placeholder="Authorization"></textarea></label></div></template>
+          <label>声明权限（逗号分隔，可选）<input v-model="permissionsText" placeholder="network.request, notes.read"></label>
+          <div class="two-columns"><label>启动超时（秒）<input v-model.number="form.startup_timeout_seconds" type="number" min="1" max="120"></label><label>工具超时（秒）<input v-model.number="form.tool_timeout_seconds" type="number" min="1" max="300"></label></div>
+        </template>
+        <label v-else>服务器 JSON 配置<textarea v-model="rawConfig" class="json-editor" rows="22" spellcheck="false"></textarea><small>支持 NotesAgent 配置、command/args/env 和单服务器 mcpServers 配置。已声明的 Secret 及常见 API Key、Token、Authorization 会拆分后加密保存。其他敏感值请显式声明；不要把密钥放入命令或参数。</small><small>兼容导入 timeout 为启动超时，sse_read_timeout 为工具等待上限（不保留 SSE 读取超时语义）。</small></label>
+        <footer><button type="button" class="button-secondary" @click="closeEditor">取消</button><button class="button-primary" :disabled="busy === 'save'">保存</button></footer>
+        </fieldset>
+      </form>
+    </div>
+  </section>
+</template>
+
+<style scoped>
+.editor-fields { display: grid; gap: var(--space-lg); border: 0; padding: 0; margin: 0; min-width: 0; }
+.mcp-page { overflow: auto; }.notice-banner,.error-banner { margin-bottom: var(--space-lg); }.server-list { display: grid; gap: var(--space-lg); }.server-card { display: grid; gap: var(--space-md); }
+.server-main,.server-title,.metadata,.card-actions,.inline-actions,.template-row,.modal-card header,.modal-card footer { display: flex; align-items: center; gap: var(--space-sm); }.server-main { justify-content: space-between; }.server-title { align-items: flex-start; }.server-title h2 { margin-bottom: 4px; }.server-title code { color: var(--color-text-secondary); overflow-wrap: anywhere; }.metadata { flex-wrap: wrap; color: var(--color-text-tertiary); font-size: var(--font-size-sm); }.metadata span + span::before { content: '·'; margin-right: var(--space-sm); }.compact { margin: 0; }
+.card-actions { justify-content: flex-end; border-top: 1px solid var(--color-border-subtle); padding-top: var(--space-md); }.empty { text-align: center; place-items: center; display: grid; gap: var(--space-md); padding: 64px; }.secrets { border: 1px solid var(--color-border-subtle); border-radius: var(--radius-md); padding: var(--space-md); display: grid; gap: var(--space-sm); }.secrets label { display: grid; grid-template-columns: minmax(220px,.7fr) 1fr; align-items: center; gap: var(--space-md); }.secrets small,.modal-card small { color: var(--color-text-tertiary); }.secret-input { display: flex; gap: var(--space-sm); }.secret-input input { flex: 1; }
+.modal-backdrop { position: fixed; inset: 0; z-index: 1000; background: rgb(0 0 0 / .48); display: grid; place-items: center; padding: var(--space-xl); }.modal-card { width: min(800px,100%); max-height: calc(100vh - 48px); overflow: auto; background: var(--color-background-primary); border: 1px solid var(--color-border-default); border-radius: var(--radius-xl); box-shadow: var(--shadow-xl); padding: var(--space-xl); display: grid; gap: var(--space-lg); animation: modal-in var(--motion-normal) ease-out; }.modal-card header,.modal-card footer { justify-content: space-between; }.modal-card footer { justify-content: flex-end; }.modal-card label { display: grid; gap: var(--space-xs); font-weight: 600; }.modal-card input,.modal-card textarea { width: 100%; border: 1px solid var(--color-border-default); border-radius: var(--radius-md); padding: 10px 12px; color: var(--color-text-primary); background: var(--color-background-secondary); font: inherit; }.modal-card textarea { resize: vertical; font-family: var(--font-family-mono); font-size: var(--font-size-sm); }.json-editor { line-height: 1.55; }.close { border: 0; background: transparent; color: var(--color-text-secondary); font-size: 28px; cursor: pointer; }
+.template-row { flex-wrap: wrap; }.template-row > span { margin-right: auto; font-weight: 600; }.template,.mode-tabs button { border: 1px solid var(--color-border-default); background: var(--color-background-secondary); color: var(--color-text-secondary); padding: 7px 10px; border-radius: var(--radius-md); cursor: pointer; }.template.active,.mode-tabs button.active { color: var(--color-accent-primary); border-color: var(--color-accent-primary); background: var(--color-accent-soft); }.mode-tabs { display: inline-flex; justify-self: start; gap: 2px; padding: 3px; border-radius: var(--radius-md); background: var(--color-background-secondary); }.two-columns { display: grid; grid-template-columns: 1fr 1fr; gap: var(--space-md); }
+@keyframes modal-in { from { opacity: 0; transform: translateY(8px) scale(.99); } } @media (max-width:720px) { .two-columns,.secrets label { grid-template-columns:1fr; }.card-actions { flex-wrap:wrap; } }
+</style>

frontend/src/features/mcp/configuration.spec.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'vitest'
+import { emptyMcpConfig, mergeImportedSecrets, normalizeMcpConfig, parseMcpJson } from './configuration'
+
+describe('MCP configuration normalization', () => {
+  it('retains renamed HTTP drafts with the latest spelling and value', () => {
+    const config = { ...emptyMcpConfig(), secret_header_keys: ['authorization'] }
+    const previous = [{ kind: 'header' as const, key: 'Authorization', value: 'old-value' }]
+    expect(mergeImportedSecrets(config, previous, [])).toEqual([{ kind: 'header', key: 'authorization', value: 'old-value' }])
+    expect(mergeImportedSecrets(config, previous, [{ kind: 'header', key: 'AUTHORIZATION', value: 'new-value' }])).toEqual([{ kind: 'header', key: 'authorization', value: 'new-value' }])
+    expect(mergeImportedSecrets(emptyMcpConfig(), previous, [])).toEqual([])
+  })
+
+  it('does not transfer an environment draft across a case-only rename', () => {
+    const config = { ...emptyMcpConfig(), secret_environment_keys: ['TOKEN', 'token'] }
+    const previous = [{ kind: 'environment' as const, key: 'TOKEN', value: 'upper' }, { kind: 'environment' as const, key: 'token', value: 'lower' }]
+    expect(mergeImportedSecrets(config, previous, [])).toEqual(previous)
+    expect(mergeImportedSecrets({ ...config, secret_environment_keys: ['token'] }, [previous[0]!], [])).toEqual([])
+  })
+  it('fills backend defaults for minimal JSON', () => {
+    const { config } = parseMcpJson('{"name":"demo","command":"uvx"}')
+    expect(config).toMatchObject({ transport: 'stdio', args: [], headers: {}, environment: {}, permissions: [], secret_header_keys: [] })
+  })
+
+  it('extracts a key pasted into environment despite its existing secret declaration', () => {
+    const { config, secrets } = normalizeMcpConfig({
+      name: 'MiniMax', command: 'uvx', secret_environment_keys: ['MINIMAX_API_KEY'],
+      environment: { MINIMAX_API_KEY: 'synthetic-key', MINIMAX_API_HOST: 'https://api.minimaxi.com' },
+    })
+    expect(config.environment).toEqual({ MINIMAX_API_HOST: 'https://api.minimaxi.com' })
+    expect(config.secret_environment_keys).toEqual(['MINIMAX_API_KEY'])
+    expect(JSON.stringify(config)).not.toContain('synthetic-key')
+    expect(secrets).toEqual([{ kind: 'environment', key: 'MINIMAX_API_KEY', value: 'synthetic-key' }])
+  })
+
+  it('imports a standard single-server wrapper and legacy timeouts', () => {
+    const { config, secrets } = normalizeMcpConfig({ mcpServers: { MiniMax: {
+      command: 'uvx', args: ['--with', 'mcp<2', 'minimax-coding-plan-mcp', '-y'],
+      env: { MINIMAX_API_KEY: 'synthetic-key' }, timeout: 120, sse_read_timeout: 300,
+    } } })
+    expect(config).toMatchObject({ name: 'MiniMax', transport: 'stdio', environment: {}, startup_timeout_seconds: 120, tool_timeout_seconds: 300 })
+    expect(secrets).toHaveLength(1)
+  })
+
+  it('extracts case-insensitive HTTP credentials without duplicate declarations', () => {
+    const { config, secrets } = normalizeMcpConfig({ url: 'https://example.test/mcp', headers: { authorization: 'synthetic' }, secret_header_keys: ['Authorization'] })
+    expect(config.headers).toEqual({})
+    expect(config.secret_header_keys).toEqual(['Authorization'])
+    expect(secrets[0]?.key).toBe('Authorization')
+  })
+
+  it.each([
+    [{ command: 'uvx', args: 'not-array' }, 'args'],
+    [{ command: 'uvx', environment: [] }, 'environment'],
+    [{ command: 'uvx', timeout: 121 }, '启动超时'],
+    [{ command: 'uvx', args: ['[https://example.test](https://example.test)'] }, '纯 URL'],
+    [{ command: 'uvx', api_key: 'do-not-echo' }, '顶层'],
+    [{ command: 'uvx', env: {}, environment: {} }, '只保留一个'],
+    [{ mcpServers: { one: {}, two: {} } }, '一次导入一个'],
+  ])('rejects invalid fields without leaking their values', (input, hint) => {
+    expect(() => normalizeMcpConfig(input)).toThrow(hint)
+    try { normalizeMcpConfig(input) } catch (error) { expect(String(error)).not.toContain('do-not-echo') }
+  })
+})

frontend/src/features/mcp/configuration.ts

@@ -0,0 +1,139 @@
+import type { McpServerInput } from '@/contracts'
+
+export type SecretKind = 'environment' | 'header'
+export interface ImportedSecret { kind: SecretKind; key: string; value: string }
+
+export function mergeImportedSecrets(config: McpServerInput, previous: ImportedSecret[], incoming: ImportedSecret[]): ImportedSecret[] {
+  const merged = new Map<string, ImportedSecret>()
+  for (const item of [...previous, ...incoming]) {
+    const normalize = (key: string) => item.kind === 'header' ? key.toLowerCase() : key
+    const keys = item.kind === 'header' ? config.secret_header_keys : config.secret_environment_keys
+    const declared = keys.find(key => normalize(key) === normalize(item.key))
+    if (declared === undefined) continue
+    // HTTP identity is case-insensitive, but the Secret API requires the current
+    // declared spelling. New inline values replace older drafts of that identity.
+    merged.set(`${item.kind}:${normalize(declared)}`, { ...item, key: declared })
+  }
+  return [...merged.values()]
+}
+
+export function emptyMcpConfig(): McpServerInput {
+  return {
+    name: '', transport: 'stdio', command: '', args: [], url: null, headers: {},
+    environment: {}, secret_environment_keys: [], secret_header_keys: [], permissions: [],
+    startup_timeout_seconds: 15, tool_timeout_seconds: 30,
+  }
+}
+
+function object(value: unknown, label: string): Record<string, unknown> {
+  if (!value || Array.isArray(value) || typeof value !== 'object') throw new Error(`${label}必须是 JSON 对象`)
+  return value as Record<string, unknown>
+}
+
+function strings(value: unknown, label: string): string[] {
+  if (value === undefined) return []
+  if (!Array.isArray(value) || value.some(item => typeof item !== 'string')) throw new Error(`${label}必须是字符串数组`)
+  return [...value]
+}
+
+function entries(value: unknown, label: string): Record<string, string> {
+  if (value === undefined) return {}
+  const result = object(value, label)
+  if (Object.values(result).some(item => typeof item !== 'string')) throw new Error(`${label}必须是字符串键值 JSON 对象`)
+  return { ...result } as Record<string, string>
+}
+
+function timeout(value: unknown, fallback: number, max: number, label: string): number {
+  if (value === undefined) return fallback
+  if (typeof value !== 'number' || !Number.isFinite(value) || value < 1 || value > max) throw new Error(`${label}必须是 1–${max} 秒之间的数字`)
+  return value
+}
+
+// Do not silently rewrite executable arguments or secret values copied from chat.
+function checkUrl(value: string, label: string) {
+  if (/^\[https?:\/\//i.test(value)) throw new Error(`${label}请填写纯 URL，不要粘贴 Markdown 链接`)
+}
+
+export function parseMcpJson(raw: string, fallbackName = '', requireConnection = true) {
+  let parsed: unknown
+  try { parsed = JSON.parse(raw) }
+  catch { throw new Error('服务器配置不是有效 JSON；请检查逗号、引号和无效的 \\_ 转义') }
+  return normalizeMcpConfig(parsed, fallbackName, requireConnection)
+}
+
+/** Normalize external client JSON before it reaches either the form or the API.
+ * Inline secrets leave the public config here and are sent only to the Secret API.
+ */
+export function normalizeMcpConfig(parsed: unknown, fallbackName = '', requireConnection = true) {
+  let raw = object(parsed, '服务器配置')
+  if ('mcpServers' in raw) {
+    const servers = Object.entries(object(raw.mcpServers, 'mcpServers'))
+    if (servers.length !== 1) throw new Error('请一次导入一个 MCP 服务器')
+    fallbackName = servers[0]![0]
+    raw = object(servers[0]![1], '服务器配置')
+  }
+  const allowed = new Set([...Object.keys(emptyMcpConfig()), 'version', 'env', 'type', 'timeout', 'sse_read_timeout'])
+  if (Object.keys(raw).some(key => !allowed.has(key))) {
+    // Never echo arbitrary unknown keys: pasted secrets sometimes become JSON keys.
+    throw new Error('服务器配置含不支持的字段；API Key 请放在 env/environment 的对应变量中，不要放在顶层')
+  }
+  if (raw.env !== undefined && raw.environment !== undefined) throw new Error('env 与 environment 请只保留一个，避免覆盖配置')
+  const transport = raw.transport ?? raw.type ?? (raw.url ? 'streamable_http' : 'stdio')
+  if (!['stdio', 'streamable_http', 'sse'].includes(transport as string)) throw new Error('transport 必须是 stdio、streamable_http 或 sse')
+  const config = emptyMcpConfig()
+  config.transport = transport as McpServerInput['transport']
+  const name = raw.name ?? (fallbackName || (typeof raw.command === 'string' ? raw.command : 'MCP 服务器'))
+  if (typeof name !== 'string' || (requireConnection && !name.trim()) || name.trim().length > 80) throw new Error('服务器名称必须为 1–80 个字符')
+  config.name = name.trim()
+  for (const key of ['command', 'url'] as const) {
+    const value = raw[key]
+    if (value !== undefined && value !== null && typeof value !== 'string') throw new Error(`${key}必须是字符串`)
+    config[key] = typeof value === 'string' ? value.trim() : null
+  }
+  config.args = strings(raw.args, 'args')
+  if (config.args.length > 64) throw new Error('args 最多允许 64 项')
+  for (const value of config.args) checkUrl(value, 'args 中的地址')
+  config.environment = entries(raw.environment ?? raw.env, 'environment/env')
+  config.headers = entries(raw.headers, 'headers')
+  config.secret_environment_keys = [...new Set(strings(raw.secret_environment_keys, 'secret_environment_keys'))]
+  config.secret_header_keys = [...new Set(strings(raw.secret_header_keys, 'secret_header_keys'))]
+  config.permissions = strings(raw.permissions, 'permissions')
+  config.startup_timeout_seconds = timeout(raw.startup_timeout_seconds ?? raw.timeout, 15, 120, '启动超时')
+  // Compatibility policy: legacy read timeout becomes the tool wait budget, not an SSE transport setting.
+  config.tool_timeout_seconds = timeout(raw.tool_timeout_seconds ?? raw.sse_read_timeout, 30, 300, '工具超时')
+  if (config.transport === 'stdio') {
+    if (requireConnection && !config.command) throw new Error('stdio 配置必须填写 command')
+    if (config.url || Object.keys(config.headers).length || config.secret_header_keys.length) throw new Error('stdio 配置不能包含 URL 或 HTTP Header')
+  } else {
+    if (requireConnection && !config.url) throw new Error('HTTP/SSE 配置必须填写 url')
+    if (config.url) {
+      checkUrl(config.url, 'url')
+      let url: URL
+      try { url = new URL(config.url) } catch { throw new Error('url 必须是有效的 HTTP(S) 地址') }
+      if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash) throw new Error('url 必须为不含账号密码或片段的 HTTP(S) 地址')
+    }
+    if (config.command || config.args.length || Object.keys(config.environment).length || config.secret_environment_keys.length) throw new Error('HTTP/SSE 配置不能包含 command、args 或环境变量')
+  }
+  const secrets: ImportedSecret[] = []
+  for (const kind of ['environment', 'header'] as const) {
+    const values = kind === 'environment' ? config.environment : config.headers
+    const keys = kind === 'environment' ? config.secret_environment_keys : config.secret_header_keys
+    const identity = (key: string) => kind === 'header' ? key.toLowerCase() : key
+    const allKeys = [...Object.keys(values), ...keys]
+    if (kind === 'header' && (new Set(keys.map(identity)).size !== keys.length || new Set(Object.keys(values).map(identity)).size !== Object.keys(values).length)) throw new Error('HTTP Header 名称不能仅大小写不同而重复声明')
+    const validKey = kind === 'environment' ? /^[A-Za-z_][A-Za-z0-9_]{0,127}$/ : /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/
+    if (allKeys.some(key => !validKey.test(key))) throw new Error(`${kind === 'environment' ? '环境变量' : 'Header'}名称无效；敏感变量名只能填名称，不能填密钥值`)
+    for (const [key, value] of Object.entries(values)) {
+      const declared = keys.find(item => identity(item) === identity(key))
+      const sensitive = /api[_-]?key|token|secret|password|authorization|cookie|credential/i.test(key)
+      if (declared || sensitive) {
+        if (!value || value.length > 32768) throw new Error('密钥值必须为 1–32768 个字符')
+        const secretKey = declared ?? key
+        if (!declared) keys.push(key)
+        secrets.push({ kind, key: secretKey, value })
+        delete values[key]
+      } else if (/host|url|endpoint/i.test(key)) checkUrl(value, '环境变量或 Header 地址')
+    }
+  }
+  return { config, secrets }
+}

frontend/src/features/workspace/FileTreePanel.spec.ts

@@ -74,4 +74,33 @@ describe('FileTreePanel file switching', () => {
     expect(editorStore.content).toContain('# 二叉搜索树')
     expect(editorStore.currentNoteId).toBe('note-bst')
   })
+
+  it('creates a Markdown note inside the selected folder', async () => {
+    const router = createRouter({
+      history: createMemoryHistory(),
+      routes: [{ path: '/workspace', component: { template: '<div />' } }],
+    })
+    await router.push('/workspace')
+    await router.isReady()
+
+    const workspaceStore = useWorkspaceStore()
+    await workspaceStore.openVault('C:/vault')
+    const createFile = vi.spyOn(workspaceService, 'createFile').mockResolvedValue({
+      id: 'note-new', note_id: 'note-new', name: '新笔记.md',
+      path: '/数据结构/新笔记.md', type: 'file',
+    })
+    wrapper = mount(FileTreePanel, { attachTo: document.body, global: { plugins: [router] } })
+
+    await wrapper.findAll('.tree-node').find((node) => node.text().includes('数据结构'))!.trigger('click')
+    await wrapper.get('button[aria-label="新建笔记"]').trigger('click')
+    await wrapper.get('.new-item input').setValue('新笔记')
+    await wrapper.get('.new-item').trigger('submit')
+    await waitForPath('/数据结构/新笔记.md')
+    await vi.waitFor(() => {
+      expect(workspaceStore.activeFilePath).toBe('/数据结构/新笔记.md')
+    })
+
+    expect(createFile).toHaveBeenCalledWith('/数据结构', '新笔记.md', '# 新笔记\n\n')
+    expect(wrapper.findAll('.tree-node').some((node) => node.classes().includes('active') && node.text().includes('新笔记.md'))).toBe(true)
+  })
 })

frontend/src/features/workspace/FileTreePanel.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref } from 'vue'
+import { ref, watch } from 'vue'
 import { useRouter } from 'vue-router'
 import type { FileNode } from '@/contracts'
 import * as workspaceService from '@/services/workspaceService'
@@ -15,9 +15,19 @@ const router = useRouter()
 const newItemType = ref<'file' | 'folder' | null>(null)
 const newItemName = ref('')
 const parentPath = ref('/')
+const selectedTreePath = ref(workspaceStore.activeFilePath ?? '/')
+const selectedFolderPath = ref(
+  workspaceStore.activeFilePath ? containingFolder(workspaceStore.activeFilePath) : '/',
+)
 const contextTarget = ref<FileNode | null>(null)
 const contextMenuPosition = ref({ x: 0, y: 0 })
 
+watch(() => workspaceStore.activeFilePath, (path) => {
+  if (!path) return
+  selectedTreePath.value = path
+  selectedFolderPath.value = containingFolder(path)
+})
+
 function beginCreate(type: 'file' | 'folder', parent = '/') {
   newItemType.value = type
   newItemName.value = ''
@@ -31,19 +41,28 @@ async function createItem() {
     const name = rawName.endsWith('.md') ? rawName : `${rawName}.md`
     const file = await workspaceService.createFile(parentPath.value, name, `# ${rawName}\n\n`)
     workspaceStore.addFileToTree(parentPath.value, file)
+    selectedTreePath.value = file.path
+    selectedFolderPath.value = parentPath.value
     await editorStore.loadFile(file.path)
     workspaceStore.openFile(file.path)
     await router.push('/workspace')
   } else {
     const folder = await workspaceService.createFolder(parentPath.value, rawName)
     workspaceStore.addFileToTree(parentPath.value, folder)
+    selectedTreePath.value = folder.path
+    selectedFolderPath.value = folder.path
   }
   newItemType.value = null
   newItemName.value = ''
 }
 
 async function openNode(node: FileNode) {
-  if (node.type === 'folder') return workspaceStore.toggleFolder(node.path)
+  selectedTreePath.value = node.path
+  if (node.type === 'folder') {
+    selectedFolderPath.value = node.path
+    return workspaceStore.toggleFolder(node.path)
+  }
+  selectedFolderPath.value = containingFolder(node.path)
   // 先同步活动文件，让真实点击立即生效；内容加载失败时再恢复原状态。
   const previousPath = workspaceStore.activeFilePath
   const wasOpen = workspaceStore.openFiles.includes(node.path)
@@ -61,6 +80,8 @@ async function openNode(node: FileNode) {
 function openContextMenu(event: MouseEvent, node: FileNode) {
   event.preventDefault()
   event.stopPropagation()
+  selectedTreePath.value = node.path
+  selectedFolderPath.value = node.type === 'folder' ? node.path : containingFolder(node.path)
   contextTarget.value = node
   contextMenuPosition.value = { x: event.clientX, y: event.clientY }
 }
@@ -79,6 +100,12 @@ async function renameTarget() {
     await workspaceService.renameFile(oldPath, normalizedName)
     workspaceStore.renamePath(oldPath, newPath, normalizedName)
     editorStore.renameFilePath(oldPath, newPath)
+    if (selectedTreePath.value === oldPath || selectedTreePath.value.startsWith(`${oldPath}/`)) {
+      selectedTreePath.value = `${newPath}${selectedTreePath.value.slice(oldPath.length)}`
+    }
+    if (selectedFolderPath.value === oldPath || selectedFolderPath.value.startsWith(`${oldPath}/`)) {
+      selectedFolderPath.value = `${newPath}${selectedFolderPath.value.slice(oldPath.length)}`
+    }
   }
   closeContextMenu()
 }
@@ -90,19 +117,28 @@ async function deleteTarget() {
   await workspaceService.deleteFile(node.path)
   const activeWasRemoved = workspaceStore.closePath(node.path)
   workspaceStore.removeFromTree(node.path)
+  if (selectedTreePath.value === node.path || selectedTreePath.value.startsWith(`${node.path}/`)) {
+    selectedTreePath.value = containingFolder(node.path)
+    selectedFolderPath.value = selectedTreePath.value
+  }
   if (activeWasRemoved) {
     editorStore.closeFile()
     if (workspaceStore.activeFilePath) await editorStore.loadFile(workspaceStore.activeFilePath)
   }
   closeContextMenu()
 }
+
+function containingFolder(path: string): string {
+  const separator = path.lastIndexOf('/')
+  return separator > 0 ? path.slice(0, separator) : '/'
+}
 </script>
 
 <template>
   <section class="file-tree-panel" @click="closeContextMenu">
     <div class="toolbar">
-      <button type="button" title="新建笔记" aria-label="新建笔记" @click.stop="beginCreate('file')"><AppIcon :icon="DocumentAdd" /></button>
+      <button type="button" title="新建笔记" aria-label="新建笔记" @click.stop="beginCreate('file', selectedFolderPath)"><AppIcon :icon="DocumentAdd" /></button>
-      <button type="button" title="新建文件夹" aria-label="新建文件夹" @click.stop="beginCreate('folder')"><AppIcon :icon="FolderAdd" /></button>
+      <button type="button" title="新建文件夹" aria-label="新建文件夹" @click.stop="beginCreate('folder', selectedFolderPath)"><AppIcon :icon="FolderAdd" /></button>
     </div>
     <form v-if="newItemType" class="new-item" @submit.prevent="createItem">
       <input v-model="newItemName" :placeholder="newItemType === 'file' ? '笔记名称' : '文件夹名称'" autofocus />
@@ -111,7 +147,7 @@ async function deleteTarget() {
     </form>
     <div class="tree">
       <FileTreeNode v-for="node in workspaceStore.fileTree" :key="node.id" :node="node"
-        :active-path="workspaceStore.activeFilePath" @open="openNode" @context-menu="openContextMenu" />
+        :active-path="selectedTreePath" @open="openNode" @context-menu="openContextMenu" />
     </div>
     <Teleport to="body">
       <div v-if="contextTarget" class="context-menu"

frontend/src/router/index.ts

@@ -44,6 +44,12 @@ const routes = [
     component: () => import('@/features/skills/SkillsView.vue'),
     meta: { title: 'Skill 管理', requiresVault: true },
   },
+  {
+    path: '/extensions/mcp',
+    name: 'mcp-servers',
+    component: () => import('@/features/mcp/McpServersView.vue'),
+    meta: { title: 'MCP 服务器', requiresVault: true },
+  },
   {
     path: '/extensions/plugins',
     name: 'plugins',

frontend/src/services/index.ts

@@ -8,6 +8,7 @@ export * as chatService from './chatService'
 export * as agentService from './agentService'
 export * as skillService from './skillService'
 export * as pluginService from './pluginService'
+export * as mcpServerService from './mcpServerService'
 export * as providerService from './providerService'
 export * as taskService from './taskService'
 export * as indexService from './indexService'

frontend/src/services/mcpServerService.ts

@@ -0,0 +1,18 @@
+import apiClient from './apiClient'
+import type { McpServer, McpServerInput, McpToolSummary, OperationResponse } from '@/contracts'
+
+const base = '/api/mcp/servers'
+
+export async function listMcpServers(): Promise<McpServer[]> {
+  return (await apiClient.get<{ items: McpServer[] }>(base)).items
+}
+export const createMcpServer = (input: McpServerInput) => apiClient.post<McpServer>(base, input)
+export const updateMcpServer = (id: string, input: McpServerInput) => apiClient.put<McpServer>(`${base}/${id}`, input)
+export const listMcpServerTools = async (id: string) => (await apiClient.get<{ items: McpToolSummary[] }>(`${base}/${id}/tools`)).items
+export const deleteMcpServer = (id: string) => apiClient.delete<OperationResponse>(`${base}/${id}`)
+export const trustMcpServer = (server: McpServer) => apiClient.post<McpServer>(`${base}/${server.server_id}/trust`, { command_digest: server.command_digest })
+export const testMcpServer = (id: string) => apiClient.post<McpServer>(`${base}/${id}/test`)
+export const enableMcpServer = (id: string) => apiClient.post<McpServer>(`${base}/${id}/enable`)
+export const disableMcpServer = (id: string) => apiClient.post<McpServer>(`${base}/${id}/disable`)
+export const putMcpServerSecret = (id: string, key: string, secret: string, kind: 'environment' | 'header' = 'environment') => apiClient.put(`${base}/${id}/secrets/${encodeURIComponent(key)}?kind=${kind}`, { secret })
+export const deleteMcpServerSecret = (id: string, key: string, kind: 'environment' | 'header' = 'environment') => apiClient.delete(`${base}/${id}/secrets/${encodeURIComponent(key)}?kind=${kind}`)