Proxy:
@@ -105,6 +111,18 @@ const authStore = useAuthStore()
const addServerLabel = computed(() => authStore.isTeamsEdition ? 'Add Personal Server' : 'Add Server')
+const routingModeLabel = computed(() => {
+ const mode = systemStore.routingMode
+ switch (mode) {
+ case 'direct':
+ return 'Direct'
+ case 'code_execution':
+ return 'Code Exec'
+ default:
+ return 'Retrieve'
+ }
+})
+
const searchQuery = ref('')
const copyTooltip = ref('Copy MCP address')
const showAddServerModal = ref(false)
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 86ff6610..40e3d6e3 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -1,4 +1,4 @@
-import type { APIResponse, Server, Tool, ToolApproval, SearchResult, StatusUpdate, SecretRef, MigrationAnalysis, ConfigSecretsResponse, GetToolCallsResponse, GetToolCallDetailResponse, GetServerToolCallsResponse, GetConfigResponse, ValidateConfigResponse, ConfigApplyResult, ServerTokenMetrics, GetRegistriesResponse, SearchRegistryServersResponse, RepositoryServer, GetSessionsResponse, GetSessionDetailResponse, InfoResponse, ActivityListResponse, ActivityDetailResponse, ActivitySummaryResponse, ImportResponse, AgentTokenInfo, CreateAgentTokenRequest, CreateAgentTokenResponse } from '@/types'
+import type { APIResponse, Server, Tool, ToolApproval, SearchResult, StatusUpdate, SecretRef, MigrationAnalysis, ConfigSecretsResponse, GetToolCallsResponse, GetToolCallDetailResponse, GetServerToolCallsResponse, GetConfigResponse, ValidateConfigResponse, ConfigApplyResult, ServerTokenMetrics, GetRegistriesResponse, SearchRegistryServersResponse, RepositoryServer, GetSessionsResponse, GetSessionDetailResponse, InfoResponse, ActivityListResponse, ActivityDetailResponse, ActivitySummaryResponse, ImportResponse, AgentTokenInfo, CreateAgentTokenRequest, CreateAgentTokenResponse, RoutingInfo } from '@/types'
// Event types for API service
export interface APIAuthEvent {
@@ -205,8 +205,13 @@ class APIService {
}
// Status endpoint
- async getStatus(): Promise
> {
- return this.request<{ edition: string; running: boolean }>('/api/v1/status')
+ async getStatus(): Promise> {
+ return this.request<{ edition: string; running: boolean; routing_mode: string }>('/api/v1/status')
+ }
+
+ // Routing mode endpoint
+ async getRouting(): Promise> {
+ return this.request('/api/v1/routing')
}
// Server endpoints
diff --git a/frontend/src/stores/system.ts b/frontend/src/stores/system.ts
index b6030dca..5e8ffb57 100644
--- a/frontend/src/stores/system.ts
+++ b/frontend/src/stores/system.ts
@@ -1,6 +1,6 @@
import { defineStore } from 'pinia'
import { ref, computed } from 'vue'
-import type { StatusUpdate, Theme, Toast, InfoResponse } from '@/types'
+import type { StatusUpdate, Theme, Toast, InfoResponse, RoutingInfo } from '@/types'
import api from '@/services/api'
export const useSystemStore = defineStore('system', () => {
@@ -11,6 +11,7 @@ export const useSystemStore = defineStore('system', () => {
const currentTheme = ref('corporate')
const toasts = ref([])
const info = ref(null)
+ const routing = ref(null)
// Available themes
const themes: Theme[] = [
@@ -59,6 +60,9 @@ export const useSystemStore = defineStore('system', () => {
const updateAvailable = computed(() => info.value?.update?.available ?? false)
const latestVersion = computed(() => info.value?.update?.latest_version ?? '')
+ // Routing mode
+ const routingMode = computed(() => routing.value?.routing_mode ?? status.value?.routing_mode ?? 'retrieve_tools')
+
// Actions
function connectEventSource() {
if (eventSource.value) {
@@ -348,6 +352,17 @@ export const useSystemStore = defineStore('system', () => {
}
}
+ async function fetchRouting() {
+ try {
+ const response = await api.getRouting()
+ if (response.success && response.data) {
+ routing.value = response.data
+ }
+ } catch (error) {
+ console.error('Failed to fetch routing:', error)
+ }
+ }
+
// Initialize theme on store creation
loadTheme()
@@ -359,6 +374,7 @@ export const useSystemStore = defineStore('system', () => {
toasts,
themes,
info,
+ routing,
// Computed
isRunning,
@@ -368,6 +384,7 @@ export const useSystemStore = defineStore('system', () => {
version,
updateAvailable,
latestVersion,
+ routingMode,
// Actions
connectEventSource,
@@ -378,5 +395,6 @@ export const useSystemStore = defineStore('system', () => {
removeToast,
clearToasts,
fetchInfo,
+ fetchRouting,
}
-})
\ No newline at end of file
+})
diff --git a/frontend/src/types/api.ts b/frontend/src/types/api.ts
index c5ce201c..dd3ca82f 100644
--- a/frontend/src/types/api.ts
+++ b/frontend/src/types/api.ts
@@ -115,6 +115,7 @@ export interface SearchResult {
export interface StatusUpdate {
running: boolean
listen_addr: string
+ routing_mode?: string
upstream_stats: {
connected_servers: number
total_servers: number
@@ -124,6 +125,19 @@ export interface StatusUpdate {
timestamp: number
}
+// Routing mode types
+export interface RoutingInfo {
+ routing_mode: string
+ description: string
+ endpoints: {
+ default: string
+ direct: string
+ code_execution: string
+ retrieve_tools: string
+ }
+ available_modes: string[]
+}
+
// Dashboard stats
export interface DashboardStats {
servers: {
diff --git a/internal/config/config.go b/internal/config/config.go
index a47100a4..2d8e1902 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -12,6 +12,11 @@ import (
const (
defaultPort = "127.0.0.1:8080" // Localhost-only binding by default for security
+
+ // Routing mode constants (Spec 031)
+ RoutingModeRetrieveTools = "retrieve_tools" // Default: BM25 search via retrieve_tools + call_tool_read/write/destructive
+ RoutingModeDirect = "direct" // All upstream tools exposed directly with serverName__toolName naming
+ RoutingModeCodeExecution = "code_execution" // JS orchestration via code_execution tool with tool catalog
)
// Duration is a wrapper around time.Duration that can be marshaled to/from JSON.
@@ -123,6 +128,10 @@ type Config struct {
// Sensitive data detection settings (Spec 026)
SensitiveDataDetection *SensitiveDataDetectionConfig `json:"sensitive_data_detection,omitempty" mapstructure:"sensitive-data-detection"`
+ // Routing mode (Spec 031): how MCP tools are exposed to clients
+ // Valid values: "retrieve_tools" (default), "direct", "code_execution"
+ RoutingMode string `json:"routing_mode,omitempty" mapstructure:"routing-mode"`
+
// Tool-level quarantine settings (Spec 032)
// QuarantineEnabled controls whether tool-level quarantine is active.
// When nil (default), quarantine is enabled (secure by default).
@@ -856,6 +865,21 @@ func (c *Config) ValidateDetailed() []ValidationError {
})
}
+ // Validate routing mode (Spec 031)
+ if c.RoutingMode != "" {
+ validRoutingModes := map[string]bool{
+ RoutingModeRetrieveTools: true,
+ RoutingModeDirect: true,
+ RoutingModeCodeExecution: true,
+ }
+ if !validRoutingModes[c.RoutingMode] {
+ errors = append(errors, ValidationError{
+ Field: "routing_mode",
+ Message: fmt.Sprintf("invalid routing mode: %s (must be retrieve_tools, direct, or code_execution)", c.RoutingMode),
+ })
+ }
+ }
+
// Validate server configurations
serverNames := make(map[string]bool)
for i, server := range c.Servers {
@@ -988,6 +1012,11 @@ func (c *Config) Validate() error {
}
// CodeExecutionMaxToolCalls defaults to 0 (unlimited), which is valid
+ // Apply routing mode default (Spec 031)
+ if c.RoutingMode == "" {
+ c.RoutingMode = RoutingModeRetrieveTools
+ }
+
// Then perform detailed validation
errors := c.ValidateDetailed()
if len(errors) > 0 {
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 87438cc4..a98309bf 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -843,6 +843,112 @@ func TestConfig_WithSensitiveDataDetection(t *testing.T) {
assert.Equal(t, 4.5, restored.SensitiveDataDetection.EntropyThreshold)
}
+// Tests for routing mode (Spec 031)
+
+func TestRoutingModeDefault(t *testing.T) {
+ cfg := &Config{}
+ err := cfg.Validate()
+ require.NoError(t, err)
+ assert.Equal(t, RoutingModeRetrieveTools, cfg.RoutingMode, "default routing mode should be retrieve_tools")
+}
+
+func TestRoutingModeValidation(t *testing.T) {
+ tests := []struct {
+ name string
+ routingMode string
+ wantErr bool
+ }{
+ {
+ name: "empty defaults to retrieve_tools",
+ routingMode: "",
+ wantErr: false,
+ },
+ {
+ name: "retrieve_tools is valid",
+ routingMode: RoutingModeRetrieveTools,
+ wantErr: false,
+ },
+ {
+ name: "direct is valid",
+ routingMode: RoutingModeDirect,
+ wantErr: false,
+ },
+ {
+ name: "code_execution is valid",
+ routingMode: RoutingModeCodeExecution,
+ wantErr: false,
+ },
+ {
+ name: "invalid mode is rejected",
+ routingMode: "invalid_mode",
+ wantErr: true,
+ },
+ {
+ name: "typo mode is rejected",
+ routingMode: "Direct",
+ wantErr: true,
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ cfg := &Config{
+ RoutingMode: tt.routingMode,
+ }
+ err := cfg.Validate()
+ if tt.wantErr {
+ assert.Error(t, err)
+ assert.Contains(t, err.Error(), "routing_mode")
+ } else {
+ assert.NoError(t, err)
+ if tt.routingMode == "" {
+ assert.Equal(t, RoutingModeRetrieveTools, cfg.RoutingMode)
+ } else {
+ assert.Equal(t, tt.routingMode, cfg.RoutingMode)
+ }
+ }
+ })
+ }
+}
+
+func TestRoutingModeJSONSerialization(t *testing.T) {
+ cfg := &Config{
+ Listen: "127.0.0.1:8080",
+ RoutingMode: RoutingModeDirect,
+ }
+
+ data, err := json.Marshal(cfg)
+ require.NoError(t, err)
+
+ var restored Config
+ err = json.Unmarshal(data, &restored)
+ require.NoError(t, err)
+ assert.Equal(t, RoutingModeDirect, restored.RoutingMode)
+}
+
+func TestRoutingModeOmittedFromJSON(t *testing.T) {
+ // When routing_mode is empty, it should be omitted from JSON
+ cfg := &Config{
+ Listen: "127.0.0.1:8080",
+ }
+
+ data, err := json.Marshal(cfg)
+ require.NoError(t, err)
+
+ // Parse as map to check key presence
+ var m map[string]interface{}
+ err = json.Unmarshal(data, &m)
+ require.NoError(t, err)
+ _, exists := m["routing_mode"]
+ assert.False(t, exists, "routing_mode should be omitted when empty")
+}
+
+func TestRoutingModeConstants(t *testing.T) {
+ assert.Equal(t, "retrieve_tools", RoutingModeRetrieveTools)
+ assert.Equal(t, "direct", RoutingModeDirect)
+ assert.Equal(t, "code_execution", RoutingModeCodeExecution)
+}
+
// Tests for tool-level quarantine config (Spec 032)
func TestConfig_IsQuarantineEnabled(t *testing.T) {
diff --git a/internal/httpapi/routing_test.go b/internal/httpapi/routing_test.go
new file mode 100644
index 00000000..0257cae4
--- /dev/null
+++ b/internal/httpapi/routing_test.go
@@ -0,0 +1,182 @@
+package httpapi
+
+import (
+ "encoding/json"
+ "net/http"
+ "net/http/httptest"
+ "testing"
+
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+ "go.uber.org/zap"
+)
+
+// mockRoutingController is a mock controller for routing endpoint tests
+type mockRoutingController struct {
+ baseController
+ apiKey string
+ routingMode string
+}
+
+func (m *mockRoutingController) GetCurrentConfig() any {
+ return &config.Config{
+ APIKey: m.apiKey,
+ }
+}
+
+func (m *mockRoutingController) GetConfig() (*config.Config, error) {
+ return &config.Config{
+ APIKey: m.apiKey,
+ RoutingMode: m.routingMode,
+ }, nil
+}
+
+func TestHandleGetRouting(t *testing.T) {
+ t.Run("returns default retrieve_tools mode", func(t *testing.T) {
+ logger := zap.NewNop().Sugar()
+ mockCtrl := &mockRoutingController{apiKey: "test-key", routingMode: ""}
+ srv := NewServer(mockCtrl, logger, nil)
+
+ req := httptest.NewRequest(http.MethodGet, "/api/v1/routing", nil)
+ req.Header.Set("X-API-Key", "test-key")
+ w := httptest.NewRecorder()
+
+ srv.ServeHTTP(w, req)
+
+ assert.Equal(t, http.StatusOK, w.Code)
+
+ var resp struct {
+ Success bool `json:"success"`
+ Data map[string]interface{} `json:"data"`
+ }
+ err := json.NewDecoder(w.Body).Decode(&resp)
+ require.NoError(t, err)
+ assert.True(t, resp.Success)
+ assert.Equal(t, config.RoutingModeRetrieveTools, resp.Data["routing_mode"])
+ assert.NotEmpty(t, resp.Data["description"])
+ assert.NotNil(t, resp.Data["endpoints"])
+ assert.NotNil(t, resp.Data["available_modes"])
+ })
+
+ t.Run("returns direct mode", func(t *testing.T) {
+ logger := zap.NewNop().Sugar()
+ mockCtrl := &mockRoutingController{apiKey: "test-key", routingMode: "direct"}
+ srv := NewServer(mockCtrl, logger, nil)
+
+ req := httptest.NewRequest(http.MethodGet, "/api/v1/routing", nil)
+ req.Header.Set("X-API-Key", "test-key")
+ w := httptest.NewRecorder()
+
+ srv.ServeHTTP(w, req)
+
+ assert.Equal(t, http.StatusOK, w.Code)
+
+ var resp struct {
+ Success bool `json:"success"`
+ Data map[string]interface{} `json:"data"`
+ }
+ err := json.NewDecoder(w.Body).Decode(&resp)
+ require.NoError(t, err)
+ assert.Equal(t, "direct", resp.Data["routing_mode"])
+ assert.Contains(t, resp.Data["description"], "directly")
+ })
+
+ t.Run("returns code_execution mode", func(t *testing.T) {
+ logger := zap.NewNop().Sugar()
+ mockCtrl := &mockRoutingController{apiKey: "test-key", routingMode: "code_execution"}
+ srv := NewServer(mockCtrl, logger, nil)
+
+ req := httptest.NewRequest(http.MethodGet, "/api/v1/routing", nil)
+ req.Header.Set("X-API-Key", "test-key")
+ w := httptest.NewRecorder()
+
+ srv.ServeHTTP(w, req)
+
+ assert.Equal(t, http.StatusOK, w.Code)
+
+ var resp struct {
+ Success bool `json:"success"`
+ Data map[string]interface{} `json:"data"`
+ }
+ err := json.NewDecoder(w.Body).Decode(&resp)
+ require.NoError(t, err)
+ assert.Equal(t, "code_execution", resp.Data["routing_mode"])
+ assert.Contains(t, resp.Data["description"], "JavaScript")
+ })
+
+ t.Run("includes all endpoints", func(t *testing.T) {
+ logger := zap.NewNop().Sugar()
+ mockCtrl := &mockRoutingController{apiKey: "test-key", routingMode: "retrieve_tools"}
+ srv := NewServer(mockCtrl, logger, nil)
+
+ req := httptest.NewRequest(http.MethodGet, "/api/v1/routing", nil)
+ req.Header.Set("X-API-Key", "test-key")
+ w := httptest.NewRecorder()
+
+ srv.ServeHTTP(w, req)
+
+ assert.Equal(t, http.StatusOK, w.Code)
+
+ var resp struct {
+ Success bool `json:"success"`
+ Data map[string]interface{} `json:"data"`
+ }
+ err := json.NewDecoder(w.Body).Decode(&resp)
+ require.NoError(t, err)
+
+ endpoints, ok := resp.Data["endpoints"].(map[string]interface{})
+ require.True(t, ok, "endpoints should be an object")
+ assert.Equal(t, "/mcp", endpoints["default"])
+ assert.Equal(t, "/mcp/all", endpoints["direct"])
+ assert.Equal(t, "/mcp/code", endpoints["code_execution"])
+ assert.Equal(t, "/mcp/call", endpoints["retrieve_tools"])
+ })
+}
+
+func TestHandleGetStatus_IncludesRoutingMode(t *testing.T) {
+ t.Run("includes routing_mode in status response", func(t *testing.T) {
+ logger := zap.NewNop().Sugar()
+ mockCtrl := &mockRoutingController{apiKey: "test-key", routingMode: "direct"}
+ srv := NewServer(mockCtrl, logger, nil)
+
+ req := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
+ req.Header.Set("X-API-Key", "test-key")
+ w := httptest.NewRecorder()
+
+ srv.ServeHTTP(w, req)
+
+ assert.Equal(t, http.StatusOK, w.Code)
+
+ var resp struct {
+ Success bool `json:"success"`
+ Data map[string]interface{} `json:"data"`
+ }
+ err := json.NewDecoder(w.Body).Decode(&resp)
+ require.NoError(t, err)
+ assert.True(t, resp.Success)
+ assert.Equal(t, "direct", resp.Data["routing_mode"])
+ })
+
+ t.Run("defaults routing_mode to retrieve_tools", func(t *testing.T) {
+ logger := zap.NewNop().Sugar()
+ mockCtrl := &mockRoutingController{apiKey: "test-key", routingMode: ""}
+ srv := NewServer(mockCtrl, logger, nil)
+
+ req := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
+ req.Header.Set("X-API-Key", "test-key")
+ w := httptest.NewRecorder()
+
+ srv.ServeHTTP(w, req)
+
+ assert.Equal(t, http.StatusOK, w.Code)
+
+ var resp struct {
+ Success bool `json:"success"`
+ Data map[string]interface{} `json:"data"`
+ }
+ err := json.NewDecoder(w.Body).Decode(&resp)
+ require.NoError(t, err)
+ assert.Equal(t, config.RoutingModeRetrieveTools, resp.Data["routing_mode"])
+ })
+}
diff --git a/internal/httpapi/server.go b/internal/httpapi/server.go
index 1279b227..f6eeecce 100644
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@@ -447,6 +447,9 @@ func (s *Server) setupRoutes() {
// Info endpoint (server version, web UI URL, etc.)
r.Get("/info", s.handleGetInfo)
+ // Routing mode endpoint
+ r.Get("/routing", s.handleGetRouting)
+
// Server management
r.Get("/servers", s.handleGetServers)
r.Post("/servers", s.handleAddServer) // T001: Add server
@@ -673,18 +676,70 @@ func (s *Server) writeSuccess(w http.ResponseWriter, data interface{}) {
// @Failure 500 {object} contracts.ErrorResponse "Internal server error"
// @Router /api/v1/status [get]
func (s *Server) handleGetStatus(w http.ResponseWriter, _ *http.Request) {
+ // Get routing mode from config
+ routingMode := config.RoutingModeRetrieveTools
+ if cfg, err := s.controller.GetConfig(); err == nil && cfg != nil && cfg.RoutingMode != "" {
+ routingMode = cfg.RoutingMode
+ }
+
response := map[string]interface{}{
"running": s.controller.IsRunning(),
"edition": editionValue,
"listen_addr": s.controller.GetListenAddress(),
"upstream_stats": s.controller.GetUpstreamStats(),
"status": s.controller.GetStatus(),
+ "routing_mode": routingMode,
"timestamp": time.Now().Unix(),
}
s.writeSuccess(w, response)
}
+// handleGetRouting godoc
+// @Summary Get routing mode information
+// @Description Get the current routing mode and available MCP endpoints
+// @Tags status
+// @Produce json
+// @Security ApiKeyAuth
+// @Security ApiKeyQuery
+// @Success 200 {object} contracts.SuccessResponse "Routing mode information"
+// @Router /api/v1/routing [get]
+func (s *Server) handleGetRouting(w http.ResponseWriter, _ *http.Request) {
+ routingMode := config.RoutingModeRetrieveTools
+ if cfg, err := s.controller.GetConfig(); err == nil && cfg != nil && cfg.RoutingMode != "" {
+ routingMode = cfg.RoutingMode
+ }
+
+ // Build mode description
+ var description string
+ switch routingMode {
+ case config.RoutingModeDirect:
+ description = "All upstream tools exposed directly via serverName__toolName naming"
+ case config.RoutingModeCodeExecution:
+ description = "JavaScript orchestration via code_execution tool with tool catalog"
+ default:
+ description = "BM25 search via retrieve_tools + call_tool variants (default)"
+ }
+
+ response := map[string]interface{}{
+ "routing_mode": routingMode,
+ "description": description,
+ "endpoints": map[string]interface{}{
+ "default": "/mcp",
+ "direct": "/mcp/all",
+ "code_execution": "/mcp/code",
+ "retrieve_tools": "/mcp/call",
+ },
+ "available_modes": []string{
+ config.RoutingModeRetrieveTools,
+ config.RoutingModeDirect,
+ config.RoutingModeCodeExecution,
+ },
+ }
+
+ s.writeSuccess(w, response)
+}
+
// handleGetInfo godoc
// @Summary Get server information
// @Description Get essential server metadata including version, web UI URL, endpoint addresses, and update availability
diff --git a/internal/jsruntime/runtime.go b/internal/jsruntime/runtime.go
index 68d4251a..709aaa3b 100644
--- a/internal/jsruntime/runtime.go
+++ b/internal/jsruntime/runtime.go
@@ -12,13 +12,59 @@ import (
// ExecutionOptions contains optional parameters for JavaScript execution
type ExecutionOptions struct {
- Input map[string]interface{} // Input data accessible as global `input` variable
- TimeoutMs int // Execution timeout in milliseconds
- MaxToolCalls int // Maximum number of call_tool() invocations (0 = unlimited)
- AllowedServers []string // Whitelist of allowed server names (empty = all allowed)
- ExecutionID string // Unique execution ID for logging (auto-generated if empty)
+ Input map[string]interface{} // Input data accessible as global `input` variable
+ TimeoutMs int // Execution timeout in milliseconds
+ MaxToolCalls int // Maximum number of call_tool() invocations (0 = unlimited)
+ AllowedServers []string // Whitelist of allowed server names (empty = all allowed)
+ ExecutionID string // Unique execution ID for logging (auto-generated if empty)
+
+ // Auth enforcement (Spec 031)
+ AuthContext *AuthInfo // Auth context for permission enforcement (nil = no restrictions)
+ ToolAnnotationFunc ToolAnnotationLookup // Function to look up tool annotations for permission checking
}
+// AuthInfo carries authentication context for permission enforcement in JS execution.
+// This is a simplified view of the auth.AuthContext to avoid circular imports.
+type AuthInfo struct {
+ Type string // "admin", "agent", "user", etc.
+ AgentName string // Name of the agent token
+ AllowedServers []string // Servers this token can access (nil = all)
+ Permissions []string // Permission tiers: "read", "write", "destructive"
+}
+
+// CanAccessServer checks whether this auth context can access the named server.
+func (a *AuthInfo) CanAccessServer(name string) bool {
+ if a == nil || a.Type == "admin" || a.Type == "admin_user" {
+ return true
+ }
+ if name == "" {
+ return false
+ }
+ for _, s := range a.AllowedServers {
+ if s == "*" || s == name {
+ return true
+ }
+ }
+ return false
+}
+
+// HasPermission checks whether this auth context includes the given permission.
+func (a *AuthInfo) HasPermission(perm string) bool {
+ if a == nil || a.Type == "admin" || a.Type == "admin_user" {
+ return true
+ }
+ for _, p := range a.Permissions {
+ if p == perm {
+ return true
+ }
+ }
+ return false
+}
+
+// ToolAnnotationLookup is a function that returns the permission tier required for a tool.
+// Returns one of "read", "write", "destructive".
+type ToolAnnotationLookup func(serverName, toolName string) string
+
// ToolCaller is an interface for calling upstream MCP tools
type ToolCaller interface {
CallTool(ctx context.Context, serverName, toolName string, args map[string]interface{}) (interface{}, error)
@@ -26,16 +72,21 @@ type ToolCaller interface {
// ExecutionContext tracks the state of a single JavaScript execution
type ExecutionContext struct {
- ExecutionID string
- StartTime time.Time
- EndTime *time.Time
- Status string // "running", "success", "error", "timeout"
- ToolCalls []ToolCallRecord
- ResultValue interface{}
- ErrorDetails *JsError
- toolCaller ToolCaller
- maxToolCalls int
+ ExecutionID string
+ StartTime time.Time
+ EndTime *time.Time
+ Status string // "running", "success", "error", "timeout"
+ ToolCalls []ToolCallRecord
+ ResultValue interface{}
+ ErrorDetails *JsError
+ toolCaller ToolCaller
+ maxToolCalls int
allowedServerMap map[string]bool
+
+ // Auth enforcement (Spec 031)
+ authInfo *AuthInfo
+ toolAnnotationFunc ToolAnnotationLookup
+ maxPermissionLevel string // Tracks highest permission used: read < write < destructive
}
// ToolCallRecord represents a single call_tool() invocation
@@ -59,13 +110,16 @@ func Execute(ctx context.Context, caller ToolCaller, code string, opts Execution
// Create execution context
execCtx := &ExecutionContext{
- ExecutionID: opts.ExecutionID,
- StartTime: time.Now(),
- Status: "running",
- ToolCalls: make([]ToolCallRecord, 0),
- toolCaller: caller,
- maxToolCalls: opts.MaxToolCalls,
- allowedServerMap: make(map[string]bool),
+ ExecutionID: opts.ExecutionID,
+ StartTime: time.Now(),
+ Status: "running",
+ ToolCalls: make([]ToolCallRecord, 0),
+ toolCaller: caller,
+ maxToolCalls: opts.MaxToolCalls,
+ allowedServerMap: make(map[string]bool),
+ authInfo: opts.AuthContext,
+ toolAnnotationFunc: opts.ToolAnnotationFunc,
+ maxPermissionLevel: "",
}
// Build allowed server map for fast lookup
@@ -241,6 +295,39 @@ func (ec *ExecutionContext) makeCallToolFunction(vm *goja.Runtime) func(goja.Fun
})
}
+ // Auth context enforcement (Spec 031)
+ if ec.authInfo != nil {
+ // Check server access
+ if !ec.authInfo.CanAccessServer(serverName) {
+ return vm.ToValue(map[string]interface{}{
+ "ok": false,
+ "error": map[string]interface{}{
+ "code": "ACCESS_DENIED",
+ "message": fmt.Sprintf("token does not have access to server '%s'", serverName),
+ },
+ })
+ }
+
+ // Determine required permission via annotation lookup
+ requiredPerm := "read" // Default to read
+ if ec.toolAnnotationFunc != nil {
+ requiredPerm = ec.toolAnnotationFunc(serverName, toolName)
+ }
+
+ if !ec.authInfo.HasPermission(requiredPerm) {
+ return vm.ToValue(map[string]interface{}{
+ "ok": false,
+ "error": map[string]interface{}{
+ "code": "PERMISSION_DENIED",
+ "message": fmt.Sprintf("token does not have '%s' permission for tool '%s:%s'", requiredPerm, serverName, toolName),
+ },
+ })
+ }
+
+ // Track highest permission level
+ ec.updateMaxPermissionLevel(requiredPerm)
+ }
+
// Record tool call start
record := ToolCallRecord{
ServerName: serverName,
@@ -292,3 +379,22 @@ func validateSerializable(value interface{}) error {
}
return nil
}
+
+// permissionRank maps permission tiers to numeric rank for comparison.
+var permissionRank = map[string]int{
+ "read": 1,
+ "write": 2,
+ "destructive": 3,
+}
+
+// updateMaxPermissionLevel tracks the highest permission level used during execution.
+func (ec *ExecutionContext) updateMaxPermissionLevel(perm string) {
+ if permissionRank[perm] > permissionRank[ec.maxPermissionLevel] {
+ ec.maxPermissionLevel = perm
+ }
+}
+
+// GetMaxPermissionLevel returns the highest permission level used during execution.
+func (ec *ExecutionContext) GetMaxPermissionLevel() string {
+ return ec.maxPermissionLevel
+}
diff --git a/internal/jsruntime/runtime_test.go b/internal/jsruntime/runtime_test.go
index b688785a..29ca9699 100644
--- a/internal/jsruntime/runtime_test.go
+++ b/internal/jsruntime/runtime_test.go
@@ -19,7 +19,10 @@ type mockToolCaller struct {
func newMockToolCaller() *mockToolCaller {
return &mockToolCaller{
- calls: make([]struct{ server, tool string; args map[string]interface{} }, 0),
+ calls: make([]struct {
+ server, tool string
+ args map[string]interface{}
+ }, 0),
results: make(map[string]interface{}),
errors: make(map[string]error),
}
@@ -349,3 +352,241 @@ func TestExecuteSandboxRestrictions(t *testing.T) {
})
}
}
+
+// TestExecuteAuthContext_ServerAccessDenied tests auth enforcement blocks unauthorized server access
+func TestExecuteAuthContext_ServerAccessDenied(t *testing.T) {
+ caller := newMockToolCaller()
+
+ code := `
+ var res = call_tool("secret-server", "get_data", {});
+ ({ ok: res.ok, code: res.error ? res.error.code : null, msg: res.error ? res.error.message : null })
+ `
+ opts := ExecutionOptions{
+ AuthContext: &AuthInfo{
+ Type: "agent",
+ AgentName: "test-bot",
+ AllowedServers: []string{"github"}, // Only github, not secret-server
+ Permissions: []string{"read"},
+ },
+ }
+
+ result := Execute(context.Background(), caller, code, opts)
+ if !result.Ok {
+ t.Fatalf("expected ok=true, got error: %v", result.Error)
+ }
+
+ resultMap := result.Value.(map[string]interface{})
+ if resultMap["ok"] != false {
+ t.Errorf("expected tool call to fail, got ok=%v", resultMap["ok"])
+ }
+ if resultMap["code"] != "ACCESS_DENIED" {
+ t.Errorf("expected ACCESS_DENIED, got %v", resultMap["code"])
+ }
+ if len(caller.calls) != 0 {
+ t.Errorf("expected 0 upstream calls (blocked by auth), got %d", len(caller.calls))
+ }
+}
+
+// TestExecuteAuthContext_PermissionDenied tests auth enforcement blocks insufficient permissions
+func TestExecuteAuthContext_PermissionDenied(t *testing.T) {
+ caller := newMockToolCaller()
+
+ code := `
+ var res = call_tool("github", "delete_repo", {});
+ ({ ok: res.ok, code: res.error ? res.error.code : null })
+ `
+ opts := ExecutionOptions{
+ AuthContext: &AuthInfo{
+ Type: "agent",
+ AgentName: "reader-bot",
+ AllowedServers: []string{"github"},
+ Permissions: []string{"read"}, // Only read, needs destructive
+ },
+ ToolAnnotationFunc: func(serverName, toolName string) string {
+ if toolName == "delete_repo" {
+ return "destructive"
+ }
+ return "read"
+ },
+ }
+
+ result := Execute(context.Background(), caller, code, opts)
+ if !result.Ok {
+ t.Fatalf("expected ok=true, got error: %v", result.Error)
+ }
+
+ resultMap := result.Value.(map[string]interface{})
+ if resultMap["ok"] != false {
+ t.Errorf("expected tool call to fail, got ok=%v", resultMap["ok"])
+ }
+ if resultMap["code"] != "PERMISSION_DENIED" {
+ t.Errorf("expected PERMISSION_DENIED, got %v", resultMap["code"])
+ }
+}
+
+// TestExecuteAuthContext_PermissionAggregation tests that max permission level is tracked
+func TestExecuteAuthContext_PermissionAggregation(t *testing.T) {
+ caller := newMockToolCaller()
+
+ code := `
+ call_tool("github", "list_repos", {});
+ call_tool("github", "create_issue", {});
+ call_tool("github", "list_repos", {});
+ ({ done: true })
+ `
+ opts := ExecutionOptions{
+ AuthContext: &AuthInfo{
+ Type: "agent",
+ AgentName: "writer-bot",
+ AllowedServers: []string{"github"},
+ Permissions: []string{"read", "write", "destructive"},
+ },
+ ToolAnnotationFunc: func(serverName, toolName string) string {
+ if toolName == "create_issue" {
+ return "write"
+ }
+ return "read"
+ },
+ }
+
+ result := Execute(context.Background(), caller, code, opts)
+ if !result.Ok {
+ t.Fatalf("expected ok=true, got error: %v", result.Error)
+ }
+
+ if len(caller.calls) != 3 {
+ t.Errorf("expected 3 tool calls, got %d", len(caller.calls))
+ }
+}
+
+// TestExecuteAuthContext_AdminBypass tests that admin auth bypasses permission checks
+func TestExecuteAuthContext_AdminBypass(t *testing.T) {
+ caller := newMockToolCaller()
+
+ code := `
+ var res = call_tool("secret-server", "delete_all", {});
+ ({ ok: res.ok })
+ `
+ opts := ExecutionOptions{
+ AuthContext: &AuthInfo{
+ Type: "admin",
+ // No AllowedServers or Permissions - admin bypasses everything
+ },
+ ToolAnnotationFunc: func(serverName, toolName string) string {
+ return "destructive"
+ },
+ }
+
+ result := Execute(context.Background(), caller, code, opts)
+ if !result.Ok {
+ t.Fatalf("expected ok=true, got error: %v", result.Error)
+ }
+
+ resultMap := result.Value.(map[string]interface{})
+ if resultMap["ok"] != true {
+ t.Errorf("admin should bypass all auth checks, got ok=%v", resultMap["ok"])
+ }
+ if len(caller.calls) != 1 {
+ t.Errorf("expected 1 tool call (admin bypass), got %d", len(caller.calls))
+ }
+}
+
+// TestExecuteAuthContext_NoAuthContext tests backward compatibility with nil auth
+func TestExecuteAuthContext_NoAuthContext(t *testing.T) {
+ caller := newMockToolCaller()
+
+ code := `
+ var res = call_tool("any-server", "any-tool", {});
+ ({ ok: res.ok })
+ `
+ opts := ExecutionOptions{
+ // No AuthContext - should not enforce any restrictions
+ }
+
+ result := Execute(context.Background(), caller, code, opts)
+ if !result.Ok {
+ t.Fatalf("expected ok=true, got error: %v", result.Error)
+ }
+
+ resultMap := result.Value.(map[string]interface{})
+ if resultMap["ok"] != true {
+ t.Errorf("expected ok=true with no auth context, got %v", resultMap["ok"])
+ }
+}
+
+// TestAuthInfo_CanAccessServer tests the AuthInfo.CanAccessServer method
+func TestAuthInfo_CanAccessServer(t *testing.T) {
+ tests := []struct {
+ name string
+ auth *AuthInfo
+ server string
+ expected bool
+ }{
+ {"nil auth allows all", nil, "anything", true},
+ {"admin allows all", &AuthInfo{Type: "admin"}, "anything", true},
+ {"admin_user allows all", &AuthInfo{Type: "admin_user"}, "anything", true},
+ {"wildcard allows all", &AuthInfo{Type: "agent", AllowedServers: []string{"*"}}, "anything", true},
+ {"specific match", &AuthInfo{Type: "agent", AllowedServers: []string{"github"}}, "github", true},
+ {"no match", &AuthInfo{Type: "agent", AllowedServers: []string{"github"}}, "gitlab", false},
+ {"empty server name", &AuthInfo{Type: "agent", AllowedServers: []string{"github"}}, "", false},
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ result := tt.auth.CanAccessServer(tt.server)
+ if result != tt.expected {
+ t.Errorf("expected %v, got %v", tt.expected, result)
+ }
+ })
+ }
+}
+
+// TestAuthInfo_HasPermission tests the AuthInfo.HasPermission method
+func TestAuthInfo_HasPermission(t *testing.T) {
+ tests := []struct {
+ name string
+ auth *AuthInfo
+ perm string
+ expected bool
+ }{
+ {"nil auth allows all", nil, "destructive", true},
+ {"admin allows all", &AuthInfo{Type: "admin"}, "destructive", true},
+ {"has read", &AuthInfo{Type: "agent", Permissions: []string{"read"}}, "read", true},
+ {"no write", &AuthInfo{Type: "agent", Permissions: []string{"read"}}, "write", false},
+ {"has write", &AuthInfo{Type: "agent", Permissions: []string{"read", "write"}}, "write", true},
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ result := tt.auth.HasPermission(tt.perm)
+ if result != tt.expected {
+ t.Errorf("expected %v, got %v", tt.expected, result)
+ }
+ })
+ }
+}
+
+// TestPermissionLevelTracking tests max permission level tracking
+func TestPermissionLevelTracking(t *testing.T) {
+ ec := &ExecutionContext{}
+
+ ec.updateMaxPermissionLevel("read")
+ if ec.GetMaxPermissionLevel() != "read" {
+ t.Errorf("expected read, got %s", ec.GetMaxPermissionLevel())
+ }
+
+ ec.updateMaxPermissionLevel("write")
+ if ec.GetMaxPermissionLevel() != "write" {
+ t.Errorf("expected write, got %s", ec.GetMaxPermissionLevel())
+ }
+
+ ec.updateMaxPermissionLevel("read") // Lower level shouldn't downgrade
+ if ec.GetMaxPermissionLevel() != "write" {
+ t.Errorf("expected write (should not downgrade), got %s", ec.GetMaxPermissionLevel())
+ }
+
+ ec.updateMaxPermissionLevel("destructive")
+ if ec.GetMaxPermissionLevel() != "destructive" {
+ t.Errorf("expected destructive, got %s", ec.GetMaxPermissionLevel())
+ }
+}
diff --git a/internal/server/mcp.go b/internal/server/mcp.go
index bbd41212..bad7ca26 100644
--- a/internal/server/mcp.go
+++ b/internal/server/mcp.go
@@ -71,6 +71,11 @@ type MCPProxyServer struct {
mainServer *Server // Reference to main server for config persistence
config *config.Config // Add config reference for security checks
+ // Routing mode MCP server instances (Spec 031)
+ // Each instance has different tools registered for its routing mode.
+ directServer *mcpserver.MCPServer // Direct mode: upstream tools with serverName__toolName naming
+ codeExecServer *mcpserver.MCPServer // Code execution mode: code_execution + retrieve_tools
+
// Docker availability cache
dockerAvailableCache *bool
dockerCacheTime time.Time
@@ -216,7 +221,7 @@ func NewMCPProxyServer(
sessionStore: sessionStore,
}
- // Register proxy tools
+ // Register proxy tools for the default (retrieve_tools) server
proxy.registerTools(debugSearch)
// Register prompts if enabled
@@ -224,6 +229,9 @@ func NewMCPProxyServer(
proxy.registerPrompts()
}
+ // Initialize routing mode server instances (Spec 031)
+ proxy.initRoutingModeServers()
+
return proxy
}
diff --git a/internal/server/mcp_code_execution.go b/internal/server/mcp_code_execution.go
index 01b2a18b..a3492bb2 100644
--- a/internal/server/mcp_code_execution.go
+++ b/internal/server/mcp_code_execution.go
@@ -7,6 +7,8 @@ import (
"sync"
"time"
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/auth"
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
"github.com/smart-mcp-proxy/mcpproxy-go/internal/jsruntime"
"github.com/smart-mcp-proxy/mcpproxy-go/internal/storage"
"github.com/smart-mcp-proxy/mcpproxy-go/internal/upstream"
@@ -103,16 +105,16 @@ func (p *MCPProxyServer) handleCodeExecution(ctx context.Context, request mcp.Ca
// Create tool caller adapter that wraps the upstream manager
toolCaller := &upstreamToolCaller{
- upstreamManager: p.upstreamManager,
- logger: p.logger,
- executionID: options.ExecutionID,
- storage: p.storage,
- configPath: configPath,
- parentCallID: parentCallID,
- sessionID: sessionID,
- clientName: clientName,
- clientVersion: clientVersion,
- mainServer: p.mainServer,
+ upstreamManager: p.upstreamManager,
+ logger: p.logger,
+ executionID: options.ExecutionID,
+ storage: p.storage,
+ configPath: configPath,
+ parentCallID: parentCallID,
+ sessionID: sessionID,
+ clientName: clientName,
+ clientVersion: clientVersion,
+ mainServer: p.mainServer,
}
// Log pool metrics before acquisition
@@ -163,6 +165,18 @@ func (p *MCPProxyServer) handleCodeExecution(ctx context.Context, request mcp.Ca
}()
}
+ // Inject auth context for permission enforcement (Spec 031)
+ if authCtx := auth.AuthContextFromContext(ctx); authCtx != nil {
+ options.AuthContext = &jsruntime.AuthInfo{
+ Type: authCtx.Type,
+ AgentName: authCtx.AgentName,
+ AllowedServers: authCtx.AllowedServers,
+ Permissions: authCtx.Permissions,
+ }
+ // Provide tool annotation lookup function for permission tier resolution
+ options.ToolAnnotationFunc = p.lookupToolPermission
+ }
+
// Execute JavaScript
p.logger.Info("executing JavaScript code",
zap.String("execution_id", options.ExecutionID),
@@ -257,10 +271,10 @@ func (p *MCPProxyServer) handleCodeExecution(ctx context.Context, request mcp.Ca
// Record the parent code_execution call in history
codeExecRecord := &storage.ToolCallRecord{
- ID: parentCallID,
- ServerID: "code_execution", // Special server ID for built-in tool
- ServerName: "mcpproxy", // Built-in tool
- ToolName: "code_execution",
+ ID: parentCallID,
+ ServerID: "code_execution", // Special server ID for built-in tool
+ ServerName: "mcpproxy", // Built-in tool
+ ToolName: "code_execution",
Arguments: map[string]interface{}{
"code": code,
"input": options.Input,
@@ -331,18 +345,18 @@ type toolCallRecord struct {
// upstreamToolCaller adapts the upstream.Manager to implement jsruntime.ToolCaller
type upstreamToolCaller struct {
- upstreamManager *upstream.Manager
- logger *zap.Logger
- executionID string
- storage *storage.Manager
- configPath string
- toolCalls []toolCallRecord
- mu sync.Mutex
- parentCallID string // ID of the parent code_execution call
- sessionID string // MCP session ID
- clientName string // MCP client name
- clientVersion string // MCP client version
- mainServer *Server // Reference to main server for tokenizer access
+ upstreamManager *upstream.Manager
+ logger *zap.Logger
+ executionID string
+ storage *storage.Manager
+ configPath string
+ toolCalls []toolCallRecord
+ mu sync.Mutex
+ parentCallID string // ID of the parent code_execution call
+ sessionID string // MCP session ID
+ clientName string // MCP client name
+ clientVersion string // MCP client version
+ mainServer *Server // Reference to main server for tokenizer access
}
// CallTool implements jsruntime.ToolCaller interface
@@ -530,3 +544,37 @@ func (u *upstreamToolCaller) storeToolCallInHistory(serverName, toolName string,
)
}
}
+
+// lookupToolPermission returns the required permission tier for a tool based on its annotations.
+// This is used by the JS runtime to enforce auth context permissions during code_execution.
+func (p *MCPProxyServer) lookupToolPermission(serverName, toolName string) string {
+ // Primary: exact match via StateView (no BM25 fuzzy matching)
+ annotations := p.lookupToolAnnotations(serverName, toolName)
+ if annotations != nil {
+ callWith := contracts.DeriveCallWith(annotations)
+ perm := contracts.ToolVariantToOperationType[callWith]
+ if perm != "" {
+ return perm
+ }
+ }
+
+ // Fallback: search the index with enough candidates to find an exact match
+ if p.index != nil {
+ qualifiedName := serverName + ":" + toolName
+ results, err := p.index.Search(qualifiedName, 20)
+ if err == nil {
+ for _, r := range results {
+ if r.Tool != nil && r.Tool.ServerName == serverName && r.Tool.Name == toolName {
+ callWith := contracts.DeriveCallWith(r.Tool.Annotations)
+ perm := contracts.ToolVariantToOperationType[callWith]
+ if perm != "" {
+ return perm
+ }
+ }
+ }
+ }
+ }
+
+ // Default to read (safest)
+ return contracts.OperationTypeRead
+}
diff --git a/internal/server/mcp_routing.go b/internal/server/mcp_routing.go
new file mode 100644
index 00000000..5451dbc8
--- /dev/null
+++ b/internal/server/mcp_routing.go
@@ -0,0 +1,419 @@
+package server
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+ "strings"
+ "time"
+
+ "github.com/mark3labs/mcp-go/mcp"
+ mcpserver "github.com/mark3labs/mcp-go/server"
+ "go.uber.org/zap"
+
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/auth"
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/reqcontext"
+)
+
+const (
+ // DirectModeToolSeparator is the separator between server name and tool name in direct mode.
+ // Using double underscore to avoid conflicts with single underscores in tool names.
+ DirectModeToolSeparator = "__"
+)
+
+// ParseDirectToolName parses a direct mode tool name (serverName__toolName) into server and tool components.
+// Splits on the FIRST occurrence of "__" only, so tool names containing "__" are preserved.
+// Returns server name, tool name, and whether the parse was successful.
+func ParseDirectToolName(directName string) (serverName, toolName string, ok bool) {
+ idx := strings.Index(directName, DirectModeToolSeparator)
+ if idx <= 0 || idx+len(DirectModeToolSeparator) >= len(directName) {
+ return "", "", false
+ }
+ return directName[:idx], directName[idx+len(DirectModeToolSeparator):], true
+}
+
+// FormatDirectToolName formats a server name and tool name into a direct mode tool name.
+func FormatDirectToolName(serverName, toolName string) string {
+ return serverName + DirectModeToolSeparator + toolName
+}
+
+// buildDirectModeTools builds MCP tool definitions for direct mode.
+// Each upstream tool is exposed directly with serverName__toolName naming.
+// Only tools from connected, enabled, non-quarantined servers are included.
+func (p *MCPProxyServer) buildDirectModeTools() []mcpserver.ServerTool {
+ ctx := context.Background()
+
+ // Use DiscoverTools which already filters for connected, enabled, non-quarantined servers
+ tools, err := p.upstreamManager.DiscoverTools(ctx)
+ if err != nil {
+ p.logger.Error("failed to discover tools for direct mode", zap.Error(err))
+ return nil
+ }
+
+ serverTools := make([]mcpserver.ServerTool, 0, len(tools))
+ for _, tool := range tools {
+ directName := FormatDirectToolName(tool.ServerName, tool.Name)
+
+ // Build MCP tool options
+ opts := []mcp.ToolOption{
+ mcp.WithDescription(fmt.Sprintf("[%s] %s", tool.ServerName, tool.Description)),
+ }
+
+ // Apply annotations from upstream tool
+ if tool.Annotations != nil {
+ if tool.Annotations.Title != "" {
+ opts = append(opts, mcp.WithTitleAnnotation(tool.Annotations.Title))
+ }
+ if tool.Annotations.ReadOnlyHint != nil {
+ opts = append(opts, mcp.WithReadOnlyHintAnnotation(*tool.Annotations.ReadOnlyHint))
+ }
+ if tool.Annotations.DestructiveHint != nil {
+ opts = append(opts, mcp.WithDestructiveHintAnnotation(*tool.Annotations.DestructiveHint))
+ }
+ if tool.Annotations.IdempotentHint != nil {
+ opts = append(opts, mcp.WithIdempotentHintAnnotation(*tool.Annotations.IdempotentHint))
+ }
+ if tool.Annotations.OpenWorldHint != nil {
+ opts = append(opts, mcp.WithOpenWorldHintAnnotation(*tool.Annotations.OpenWorldHint))
+ }
+ }
+
+ mcpTool := mcp.NewTool(directName, opts...)
+
+ // Apply input schema from upstream tool
+ if tool.ParamsJSON != "" {
+ var schema map[string]interface{}
+ if err := json.Unmarshal([]byte(tool.ParamsJSON), &schema); err == nil {
+ mcpTool.InputSchema = mcp.ToolInputSchema{
+ Type: "object",
+ }
+ if props, ok := schema["properties"].(map[string]interface{}); ok {
+ mcpTool.InputSchema.Properties = props
+ }
+ if req, ok := schema["required"].([]interface{}); ok {
+ reqStrings := make([]string, 0, len(req))
+ for _, r := range req {
+ if s, ok := r.(string); ok {
+ reqStrings = append(reqStrings, s)
+ }
+ }
+ mcpTool.InputSchema.Required = reqStrings
+ }
+ }
+ }
+
+ serverTools = append(serverTools, mcpserver.ServerTool{
+ Tool: mcpTool,
+ Handler: p.makeDirectModeHandler(tool.ServerName, tool.Name, tool.Annotations),
+ })
+ }
+
+ p.logger.Info("built direct mode tools",
+ zap.Int("tool_count", len(serverTools)))
+
+ return serverTools
+}
+
+// makeDirectModeHandler creates a handler function for a direct mode tool.
+// It handles auth checks, permission enforcement, and upstream calls.
+func (p *MCPProxyServer) makeDirectModeHandler(serverName, toolName string, annotations *config.ToolAnnotations) mcpserver.ToolHandlerFunc {
+ return func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+ startTime := time.Now()
+
+ // Check auth context for server access and permissions
+ authCtx := auth.AuthContextFromContext(ctx)
+ if authCtx != nil {
+ // Check server access
+ if !authCtx.CanAccessServer(serverName) {
+ return mcp.NewToolResultError(fmt.Sprintf("Access denied: token does not have access to server '%s'", serverName)), nil
+ }
+
+ // Determine required permission from annotations
+ requiredVariant := contracts.DeriveCallWith(annotations)
+ requiredPerm := contracts.ToolVariantToOperationType[requiredVariant]
+ if requiredPerm == "" {
+ requiredPerm = contracts.OperationTypeRead
+ }
+
+ if !authCtx.HasPermission(requiredPerm) {
+ return mcp.NewToolResultError(fmt.Sprintf("Permission denied: token does not have '%s' permission required for tool '%s:%s'", requiredPerm, serverName, toolName)), nil
+ }
+ }
+
+ // Get session ID for activity logging
+ var sessionID string
+ if sess := mcpserver.ClientSessionFromContext(ctx); sess != nil {
+ sessionID = sess.SessionID()
+ }
+
+ // Get request ID from context
+ requestID := reqcontext.GetRequestID(ctx)
+
+ // Get arguments from the request
+ args := request.GetArguments()
+
+ // Emit activity event
+ enrichedArgs := injectAuthMetadata(ctx, args)
+ p.emitActivityToolCallStarted(serverName, toolName, sessionID, requestID, "mcp", enrichedArgs)
+
+ // Call upstream
+ qualifiedName := serverName + ":" + toolName
+ result, err := p.upstreamManager.CallTool(ctx, qualifiedName, args)
+
+ durationMs := time.Since(startTime).Milliseconds()
+
+ if err != nil {
+ // Emit error activity
+ p.emitActivityToolCallCompleted(serverName, toolName, sessionID, requestID, "mcp", "error", err.Error(), durationMs, enrichedArgs, "", false, "", nil)
+ return mcp.NewToolResultError(fmt.Sprintf("Error calling %s:%s: %v", serverName, toolName, err)), nil
+ }
+
+ // Format response
+ var responseText string
+ switch v := result.(type) {
+ case string:
+ responseText = v
+ default:
+ responseBytes, marshalErr := json.Marshal(v)
+ if marshalErr != nil {
+ responseText = fmt.Sprintf("%v", v)
+ } else {
+ responseText = string(responseBytes)
+ }
+ }
+
+ // Determine tool variant for activity logging
+ toolVariant := contracts.DeriveCallWith(annotations)
+
+ // Truncate if needed
+ truncated := false
+ if p.config.ToolResponseLimit > 0 && len(responseText) > p.config.ToolResponseLimit {
+ responseText = responseText[:p.config.ToolResponseLimit]
+ truncated = true
+ }
+
+ // Emit success activity
+ p.emitActivityToolCallCompleted(serverName, toolName, sessionID, requestID, "mcp", "success", "", durationMs, enrichedArgs, responseText, truncated, toolVariant, nil)
+
+ return mcp.NewToolResultText(responseText), nil
+ }
+}
+
+// buildCodeExecModeTools builds the tool set for code_execution routing mode.
+// Includes: code_execution (with enhanced description listing available tools) and retrieve_tools (for discovery).
+// Does NOT include call_tool_read/write/destructive.
+func (p *MCPProxyServer) buildCodeExecModeTools() []mcpserver.ServerTool {
+ tools := make([]mcpserver.ServerTool, 0, 2)
+
+ // Check if code execution is enabled in config
+ if p.config != nil && !p.config.EnableCodeExecution {
+ // Code execution is disabled: register a stub tool that returns a clear error message
+ codeExecutionTool := mcp.NewTool("code_execution",
+ mcp.WithDescription("Code execution is currently disabled. Enable it by setting \"enable_code_execution\": true in your mcpproxy config."),
+ mcp.WithTitleAnnotation("Code Execution (Disabled)"),
+ mcp.WithReadOnlyHintAnnotation(true),
+ mcp.WithString("code",
+ mcp.Required(),
+ mcp.Description("JavaScript source code (ES5.1+) to execute."),
+ ),
+ )
+ tools = append(tools, mcpserver.ServerTool{
+ Tool: codeExecutionTool,
+ Handler: func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+ return mcp.NewToolResultError("Code execution is disabled. Enable it by setting \"enable_code_execution\": true in your mcpproxy configuration file."), nil
+ },
+ })
+ } else {
+ // Build enhanced description with available tools catalog
+ ctx := context.Background()
+ toolCatalog := p.buildToolCatalogDescription(ctx)
+
+ codeExecDescription := fmt.Sprintf(
+ "Execute JavaScript code that orchestrates multiple upstream MCP tools in a single request. "+
+ "Use this when you need to combine results from 2+ tools, implement conditional logic, loops, or data transformations.\n\n"+
+ "**Available in JavaScript**:\n"+
+ "- `input` global: Your input data passed via the 'input' parameter\n"+
+ "- `call_tool(serverName, toolName, args)`: Call upstream tools (returns {ok, result} or {ok, error})\n"+
+ "- Standard ES5.1+ JavaScript (no require(), filesystem, or network access)\n\n"+
+ "**Available tools for orchestration**:\n%s\n\n"+
+ "Use call_tool('serverName', 'toolName', {args}) to invoke tools.",
+ toolCatalog,
+ )
+
+ // code_execution tool with enhanced description
+ codeExecutionTool := mcp.NewTool("code_execution",
+ mcp.WithDescription(codeExecDescription),
+ mcp.WithTitleAnnotation("Code Execution"),
+ mcp.WithDestructiveHintAnnotation(true),
+ mcp.WithString("code",
+ mcp.Required(),
+ mcp.Description("JavaScript source code (ES5.1+) to execute. Use `input` to access input data and `call_tool(serverName, toolName, args)` to invoke upstream tools."),
+ ),
+ mcp.WithObject("input",
+ mcp.Description("Input data accessible as global `input` variable in JavaScript code (default: {})"),
+ ),
+ mcp.WithObject("options",
+ mcp.Description("Execution options: timeout_ms (1-600000, default: 120000), max_tool_calls (>= 0, 0=unlimited), allowed_servers (array of server names, empty=all allowed)"),
+ ),
+ )
+ tools = append(tools, mcpserver.ServerTool{
+ Tool: codeExecutionTool,
+ Handler: p.handleCodeExecution,
+ })
+ }
+
+ // retrieve_tools for discovery
+ retrieveToolsTool := mcp.NewTool("retrieve_tools",
+ mcp.WithDescription("Search and discover available upstream tools using BM25 full-text search. Use this to find tools before orchestrating them with code_execution. Use natural language to describe what you want to accomplish."),
+ mcp.WithTitleAnnotation("Retrieve Tools"),
+ mcp.WithReadOnlyHintAnnotation(true),
+ mcp.WithString("query",
+ mcp.Required(),
+ mcp.Description("Natural language description of what you want to accomplish."),
+ ),
+ mcp.WithNumber("limit",
+ mcp.Description("Maximum number of tools to return (default: configured tools_limit, max: 100)"),
+ ),
+ )
+ tools = append(tools, mcpserver.ServerTool{
+ Tool: retrieveToolsTool,
+ Handler: p.handleRetrieveTools,
+ })
+
+ p.logger.Info("built code execution mode tools",
+ zap.Int("tool_count", len(tools)))
+
+ return tools
+}
+
+// buildToolCatalogDescription builds a human-readable catalog of available tools for the code_execution description.
+func (p *MCPProxyServer) buildToolCatalogDescription(ctx context.Context) string {
+ tools, err := p.upstreamManager.DiscoverTools(ctx)
+ if err != nil {
+ return " (unable to discover tools - use retrieve_tools to search)"
+ }
+
+ if len(tools) == 0 {
+ return " (no upstream tools available)"
+ }
+
+ var sb strings.Builder
+ for _, tool := range tools {
+ // Determine permission tier from annotations
+ callWith := contracts.DeriveCallWith(tool.Annotations)
+ perm := contracts.ToolVariantToOperationType[callWith]
+ if perm == "" {
+ perm = "read"
+ }
+
+ // Truncate description for catalog listing
+ desc := tool.Description
+ if len(desc) > 80 {
+ desc = desc[:77] + "..."
+ }
+
+ sb.WriteString(fmt.Sprintf("- %s:%s (%s) - %s\n", tool.ServerName, tool.Name, perm, desc))
+ }
+
+ return sb.String()
+}
+
+// initRoutingModeServers creates separate MCP server instances for each routing mode.
+// Each server instance has its own set of tools registered appropriate for that mode.
+// The main "server" field remains the retrieve_tools mode server (default).
+func (p *MCPProxyServer) initRoutingModeServers() {
+ // Create direct mode server
+ p.directServer = mcpserver.NewMCPServer(
+ "mcpproxy-go",
+ "1.0.0",
+ mcpserver.WithToolCapabilities(true),
+ mcpserver.WithRecovery(),
+ )
+
+ // Create code execution mode server
+ p.codeExecServer = mcpserver.NewMCPServer(
+ "mcpproxy-go",
+ "1.0.0",
+ mcpserver.WithToolCapabilities(true),
+ mcpserver.WithRecovery(),
+ )
+
+ // Register tools for code execution mode (static tools that don't change)
+ codeExecTools := p.buildCodeExecModeTools()
+ for _, st := range codeExecTools {
+ p.codeExecServer.AddTool(st.Tool, st.Handler)
+ }
+
+ // Note: Direct mode tools are built lazily/on-demand via RefreshDirectModeTools
+ // because upstream servers may not be connected yet during initialization.
+ // The servers.changed event will trigger a refresh.
+
+ p.logger.Info("routing mode servers initialized",
+ zap.String("default_mode", p.config.RoutingMode))
+}
+
+// RefreshDirectModeTools rebuilds the direct mode server's tool set.
+// Should be called when upstream servers change (connect/disconnect/tool updates).
+func (p *MCPProxyServer) RefreshDirectModeTools() {
+ if p.directServer == nil {
+ return
+ }
+
+ directTools := p.buildDirectModeTools()
+
+ // Convert to the format needed by SetTools
+ serverTools := make([]mcpserver.ServerTool, len(directTools))
+ copy(serverTools, directTools)
+
+ // Replace all tools atomically
+ p.directServer.SetTools(serverTools...)
+
+ p.logger.Info("refreshed direct mode tools",
+ zap.Int("tool_count", len(directTools)))
+}
+
+// RefreshCodeExecModeTools rebuilds the code execution mode server's tool catalog description.
+// Should be called when upstream servers change to update the available tools listing.
+func (p *MCPProxyServer) RefreshCodeExecModeTools() {
+ if p.codeExecServer == nil {
+ return
+ }
+
+ codeExecTools := p.buildCodeExecModeTools()
+ serverTools := make([]mcpserver.ServerTool, len(codeExecTools))
+ copy(serverTools, codeExecTools)
+
+ p.codeExecServer.SetTools(serverTools...)
+
+ p.logger.Info("refreshed code execution mode tools",
+ zap.Int("tool_count", len(codeExecTools)))
+}
+
+// GetMCPServerForMode returns the MCP server instance for the given routing mode.
+// Falls back to the default retrieve_tools server for unknown modes.
+func (p *MCPProxyServer) GetMCPServerForMode(mode string) *mcpserver.MCPServer {
+ switch mode {
+ case config.RoutingModeDirect:
+ if p.directServer != nil {
+ return p.directServer
+ }
+ case config.RoutingModeCodeExecution:
+ if p.codeExecServer != nil {
+ return p.codeExecServer
+ }
+ }
+ // Default: retrieve_tools mode (the original server)
+ return p.server
+}
+
+// GetDirectServer returns the direct mode MCP server instance.
+func (p *MCPProxyServer) GetDirectServer() *mcpserver.MCPServer {
+ return p.directServer
+}
+
+// GetCodeExecServer returns the code execution mode MCP server instance.
+func (p *MCPProxyServer) GetCodeExecServer() *mcpserver.MCPServer {
+ return p.codeExecServer
+}
diff --git a/internal/server/mcp_routing_test.go b/internal/server/mcp_routing_test.go
new file mode 100644
index 00000000..5b46d23b
--- /dev/null
+++ b/internal/server/mcp_routing_test.go
@@ -0,0 +1,390 @@
+package server
+
+import (
+ "context"
+ "testing"
+
+ "github.com/mark3labs/mcp-go/mcp"
+ mcpserver "github.com/mark3labs/mcp-go/server"
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+ "go.uber.org/zap"
+
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/auth"
+ "github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+)
+
+func TestParseDirectToolName(t *testing.T) {
+ tests := []struct {
+ name string
+ directName string
+ wantServer string
+ wantTool string
+ wantOk bool
+ }{
+ {
+ name: "simple tool name",
+ directName: "github__create_issue",
+ wantServer: "github",
+ wantTool: "create_issue",
+ wantOk: true,
+ },
+ {
+ name: "tool with underscores",
+ directName: "my-server__my_tool_name",
+ wantServer: "my-server",
+ wantTool: "my_tool_name",
+ wantOk: true,
+ },
+ {
+ name: "tool name contains double underscore",
+ directName: "server__tool__with__double",
+ wantServer: "server",
+ wantTool: "tool__with__double",
+ wantOk: true,
+ },
+ {
+ name: "no separator",
+ directName: "noseparator",
+ wantServer: "",
+ wantTool: "",
+ wantOk: false,
+ },
+ {
+ name: "single underscore only",
+ directName: "server_tool",
+ wantServer: "",
+ wantTool: "",
+ wantOk: false,
+ },
+ {
+ name: "empty string",
+ directName: "",
+ wantServer: "",
+ wantTool: "",
+ wantOk: false,
+ },
+ {
+ name: "separator at start",
+ directName: "__toolname",
+ wantServer: "",
+ wantTool: "",
+ wantOk: false,
+ },
+ {
+ name: "separator at end",
+ directName: "server__",
+ wantServer: "",
+ wantTool: "",
+ wantOk: false,
+ },
+ {
+ name: "just separator",
+ directName: "__",
+ wantServer: "",
+ wantTool: "",
+ wantOk: false,
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ server, tool, ok := ParseDirectToolName(tt.directName)
+ assert.Equal(t, tt.wantOk, ok)
+ assert.Equal(t, tt.wantServer, server)
+ assert.Equal(t, tt.wantTool, tool)
+ })
+ }
+}
+
+func TestFormatDirectToolName(t *testing.T) {
+ tests := []struct {
+ name string
+ serverName string
+ toolName string
+ want string
+ }{
+ {
+ name: "simple names",
+ serverName: "github",
+ toolName: "create_issue",
+ want: "github__create_issue",
+ },
+ {
+ name: "server with hyphens",
+ serverName: "my-server",
+ toolName: "get_user",
+ want: "my-server__get_user",
+ },
+ {
+ name: "tool with underscores",
+ serverName: "api",
+ toolName: "list_all_items",
+ want: "api__list_all_items",
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ got := FormatDirectToolName(tt.serverName, tt.toolName)
+ assert.Equal(t, tt.want, got)
+ })
+ }
+}
+
+func TestDirectToolNameRoundTrip(t *testing.T) {
+ // Test that formatting and parsing are inverse operations
+ testCases := []struct {
+ serverName string
+ toolName string
+ }{
+ {"github", "create_issue"},
+ {"my-server", "list_repos"},
+ {"api", "search_files"},
+ {"db-server", "query_users_table"},
+ }
+
+ for _, tc := range testCases {
+ formatted := FormatDirectToolName(tc.serverName, tc.toolName)
+ parsedServer, parsedTool, ok := ParseDirectToolName(formatted)
+ assert.True(t, ok, "should parse successfully for %s/%s", tc.serverName, tc.toolName)
+ assert.Equal(t, tc.serverName, parsedServer)
+ assert.Equal(t, tc.toolName, parsedTool)
+ }
+}
+
+func TestDirectModeToolSeparator(t *testing.T) {
+ assert.Equal(t, "__", DirectModeToolSeparator)
+}
+
+func TestGetMCPServerForMode(t *testing.T) {
+ // Create a minimal MCPProxyServer with mock servers
+ proxy := &MCPProxyServer{}
+
+ // Create distinct server instances so we can verify identity
+ mainServer := mcpserver.NewMCPServer("main", "1.0.0", mcpserver.WithToolCapabilities(true))
+ directServer := mcpserver.NewMCPServer("direct", "1.0.0", mcpserver.WithToolCapabilities(true))
+ codeExecServer := mcpserver.NewMCPServer("code_exec", "1.0.0", mcpserver.WithToolCapabilities(true))
+
+ proxy.server = mainServer
+ proxy.directServer = directServer
+ proxy.codeExecServer = codeExecServer
+
+ tests := []struct {
+ name string
+ mode string
+ expected *mcpserver.MCPServer
+ }{
+ {
+ name: "retrieve_tools returns main server",
+ mode: "retrieve_tools",
+ expected: mainServer,
+ },
+ {
+ name: "direct returns direct server",
+ mode: "direct",
+ expected: directServer,
+ },
+ {
+ name: "code_execution returns code exec server",
+ mode: "code_execution",
+ expected: codeExecServer,
+ },
+ {
+ name: "empty mode returns main server",
+ mode: "",
+ expected: mainServer,
+ },
+ {
+ name: "unknown mode returns main server",
+ mode: "unknown",
+ expected: mainServer,
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ got := proxy.GetMCPServerForMode(tt.mode)
+ assert.Same(t, tt.expected, got)
+ })
+ }
+}
+
+func TestGetMCPServerForMode_NilFallback(t *testing.T) {
+ // When routing mode servers are nil, should fall back to main server
+ mainServer := mcpserver.NewMCPServer("main", "1.0.0", mcpserver.WithToolCapabilities(true))
+ proxy := &MCPProxyServer{
+ server: mainServer,
+ }
+
+ assert.Same(t, mainServer, proxy.GetMCPServerForMode("direct"))
+ assert.Same(t, mainServer, proxy.GetMCPServerForMode("code_execution"))
+ assert.Same(t, mainServer, proxy.GetMCPServerForMode("retrieve_tools"))
+}
+
+func TestDirectModeHandler_PermissionDenied(t *testing.T) {
+ logger, _ := zap.NewDevelopment()
+ proxy := &MCPProxyServer{
+ logger: logger,
+ config: &config.Config{},
+ }
+
+ // Create a handler for a read-only tool
+ readOnlyHint := true
+ annotations := &config.ToolAnnotations{
+ ReadOnlyHint: &readOnlyHint,
+ }
+ handler := proxy.makeDirectModeHandler("github", "list_repos", annotations)
+
+ // Create a context with agent token that only has write permission (no read)
+ agentCtx := auth.WithAuthContext(context.Background(), &auth.AuthContext{
+ Type: auth.AuthTypeAgent,
+ AgentName: "test-agent",
+ AllowedServers: []string{"github"},
+ Permissions: []string{"write"}, // Only write, no read
+ })
+
+ request := mcp.CallToolRequest{
+ Params: mcp.CallToolParams{
+ Name: "github__list_repos",
+ },
+ }
+
+ result, err := handler(agentCtx, request)
+ require.NoError(t, err) // Handler returns errors as tool results, not Go errors
+ require.NotNil(t, result)
+ assert.True(t, result.IsError)
+ assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "Permission denied")
+}
+
+func TestDirectModeHandler_ServerAccessDenied(t *testing.T) {
+ logger, _ := zap.NewDevelopment()
+ proxy := &MCPProxyServer{
+ logger: logger,
+ config: &config.Config{},
+ }
+
+ handler := proxy.makeDirectModeHandler("gitlab", "list_repos", nil)
+
+ // Create a context with agent token that only has access to github
+ agentCtx := auth.WithAuthContext(context.Background(), &auth.AuthContext{
+ Type: auth.AuthTypeAgent,
+ AgentName: "test-agent",
+ AllowedServers: []string{"github"}, // Only github, not gitlab
+ Permissions: []string{"read"},
+ })
+
+ request := mcp.CallToolRequest{
+ Params: mcp.CallToolParams{
+ Name: "gitlab__list_repos",
+ },
+ }
+
+ result, err := handler(agentCtx, request)
+ require.NoError(t, err)
+ require.NotNil(t, result)
+ assert.True(t, result.IsError)
+ assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "Access denied")
+}
+
+func TestDirectModeHandler_AgentWithCorrectPermissions(t *testing.T) {
+ logger, _ := zap.NewDevelopment()
+ proxy := &MCPProxyServer{
+ logger: logger,
+ config: &config.Config{},
+ }
+
+ // A read-only tool requires "read" permission
+ readOnlyHint := true
+ annotations := &config.ToolAnnotations{
+ ReadOnlyHint: &readOnlyHint,
+ }
+ handler := proxy.makeDirectModeHandler("github", "list_repos", annotations)
+
+ // Agent with read permission and github access should pass auth checks
+ agentCtx := auth.WithAuthContext(context.Background(), &auth.AuthContext{
+ Type: auth.AuthTypeAgent,
+ AgentName: "test-agent",
+ AllowedServers: []string{"github"},
+ Permissions: []string{"read"},
+ })
+
+ request := mcp.CallToolRequest{
+ Params: mcp.CallToolParams{
+ Name: "github__list_repos",
+ },
+ }
+
+ // Will panic due to nil upstreamManager, but we use recover to verify
+ // that auth checks passed (if it had failed at auth, result would be returned cleanly)
+ func() {
+ defer func() {
+ r := recover()
+ // If we reach here, the auth check passed and we hit the upstream call
+ // which panics due to nil manager. This is expected behavior.
+ assert.NotNil(t, r, "should panic at upstream call, proving auth checks passed")
+ }()
+ handler(agentCtx, request)
+ }()
+}
+
+func TestDirectModeHandler_DestructiveToolNeedsDestructivePermission(t *testing.T) {
+ logger, _ := zap.NewDevelopment()
+ proxy := &MCPProxyServer{
+ logger: logger,
+ config: &config.Config{},
+ }
+
+ destructiveHint := true
+ annotations := &config.ToolAnnotations{
+ DestructiveHint: &destructiveHint,
+ }
+ handler := proxy.makeDirectModeHandler("github", "delete_repo", annotations)
+
+ // Agent with only read+write but no destructive permission
+ agentCtx := auth.WithAuthContext(context.Background(), &auth.AuthContext{
+ Type: auth.AuthTypeAgent,
+ AgentName: "test-agent",
+ AllowedServers: []string{"github"},
+ Permissions: []string{"read", "write"},
+ })
+
+ request := mcp.CallToolRequest{
+ Params: mcp.CallToolParams{
+ Name: "github__delete_repo",
+ },
+ }
+
+ result, err := handler(agentCtx, request)
+ require.NoError(t, err)
+ require.NotNil(t, result)
+ assert.True(t, result.IsError)
+ assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "Permission denied")
+ assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "destructive")
+}
+
+func TestDirectModeHandler_NoAuthContext(t *testing.T) {
+ logger, _ := zap.NewDevelopment()
+ proxy := &MCPProxyServer{
+ logger: logger,
+ config: &config.Config{},
+ }
+
+ handler := proxy.makeDirectModeHandler("github", "list_repos", nil)
+
+ // No auth context in context - should pass auth checks (backward compatible)
+ request := mcp.CallToolRequest{
+ Params: mcp.CallToolParams{
+ Name: "github__list_repos",
+ },
+ }
+
+ // Will panic due to nil upstreamManager, proving auth checks passed
+ func() {
+ defer func() {
+ r := recover()
+ assert.NotNil(t, r, "should panic at upstream call, proving auth checks passed")
+ }()
+ handler(context.Background(), request)
+ }()
+}
diff --git a/internal/server/server.go b/internal/server/server.go
index 550eb061..5c0360fe 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -134,6 +134,7 @@ func NewServerWithConfigPath(cfg *config.Config, configPath string, logger *zap.
server.mcpProxy = mcpProxy
go server.forwardRuntimeStatus()
+ go server.listenForRoutingModeRefresh()
server.runtime.StartBackgroundInitialization()
return server, nil
@@ -356,6 +357,24 @@ func (s *Server) forwardRuntimeStatus() {
}
}
+// listenForRoutingModeRefresh subscribes to server events and refreshes routing mode
+// tool sets when upstream servers change (Spec 031).
+func (s *Server) listenForRoutingModeRefresh() {
+ eventCh := s.runtime.SubscribeEvents()
+ defer s.runtime.UnsubscribeEvents(eventCh)
+
+ for evt := range eventCh {
+ if evt.Type == runtime.EventTypeServersChanged {
+ s.logger.Debug("servers changed, refreshing routing mode tools",
+ zap.String("event_type", string(evt.Type)))
+ if s.mcpProxy != nil {
+ s.mcpProxy.RefreshDirectModeTools()
+ s.mcpProxy.RefreshCodeExecModeTools()
+ }
+ }
+ }
+}
+
// Start starts the MCP proxy server
func (s *Server) Start(ctx context.Context) error {
// Spec 024: Track server start time for lifecycle events
@@ -408,7 +427,12 @@ func (s *Server) Start(ctx context.Context) error {
zap.String("listen", listenAddr))
// Create Streamable HTTP server with custom routing
- streamableServer := server.NewStreamableHTTPServer(s.mcpProxy.GetMCPServer())
+ // Use the MCP server instance that corresponds to the configured routing_mode
+ routingMode := ""
+ if cfg != nil {
+ routingMode = cfg.RoutingMode
+ }
+ streamableServer := server.NewStreamableHTTPServer(s.mcpProxy.GetMCPServerForMode(routingMode))
// Create custom HTTP server for handling multiple routes
if err := s.startCustomHTTPServer(ctx, streamableServer); err != nil {
@@ -1473,6 +1497,30 @@ func (s *Server) startCustomHTTPServer(ctx context.Context, streamableServer *se
mux.Handle("/mcp", mcpHandler)
mux.Handle("/mcp/", mcpHandler) // Handle trailing slash
+ // Routing mode dedicated endpoints (Spec 031)
+ // Each endpoint always serves its specific routing mode regardless of config.
+ // /mcp/all → direct mode (all tools with serverName__toolName naming)
+ directStreamable := server.NewStreamableHTTPServer(s.mcpProxy.GetMCPServerForMode(config.RoutingModeDirect))
+ directHandler := s.mcpAuthMiddleware(loggingHandler(directStreamable))
+ mux.Handle("/mcp/all", directHandler)
+ mux.Handle("/mcp/all/", directHandler)
+
+ // /mcp/code → code_execution mode (JS orchestration)
+ codeExecStreamable := server.NewStreamableHTTPServer(s.mcpProxy.GetMCPServerForMode(config.RoutingModeCodeExecution))
+ codeExecHandler := s.mcpAuthMiddleware(loggingHandler(codeExecStreamable))
+ mux.Handle("/mcp/code", codeExecHandler)
+ mux.Handle("/mcp/code/", codeExecHandler)
+
+ // /mcp/call → retrieve_tools mode (explicit, same as default server)
+ callToolStreamable := server.NewStreamableHTTPServer(s.mcpProxy.GetMCPServer())
+ callToolHandler := s.mcpAuthMiddleware(loggingHandler(callToolStreamable))
+ mux.Handle("/mcp/call", callToolHandler)
+ mux.Handle("/mcp/call/", callToolHandler)
+
+ s.logger.Info("Registered routing mode MCP endpoints",
+ zap.String("default_mode", cfg.RoutingMode),
+ zap.Strings("endpoints", []string{"/mcp/all", "/mcp/code", "/mcp/call"}))
+
// Legacy endpoints for backward compatibility
mux.Handle("/v1/tool_code", mcpHandler)
mux.Handle("/v1/tool-code", mcpHandler) // Alias for python client
@@ -1597,7 +1645,8 @@ func (s *Server) startCustomHTTPServer(ctx context.Context, streamableServer *se
// List all registered endpoints for visibility
allEndpoints := []string{
- "/mcp", "/mcp/", // MCP protocol endpoints
+ "/mcp", "/mcp/", // MCP protocol endpoints (default routing mode)
+ "/mcp/all", "/mcp/code", "/mcp/call", // Routing mode endpoints (Spec 031)
"/v1/tool_code", "/v1/tool-code", // Legacy MCP endpoints
"/api/v1/*", "/events", // REST API and SSE endpoints
"/ui/", "/", // Web UI endpoints
diff --git a/oas/docs.go b/oas/docs.go
index da4b190a..42c453ce 100644
--- a/oas/docs.go
+++ b/oas/docs.go
@@ -6,10 +6,10 @@ import "github.com/swaggo/swag/v2"
const docTemplate = `{
"schemes": {{ marshal .Schemes }},
- "components": {"schemas":{"config.Config":{"properties":{"activity_cleanup_interval_min":{"description":"Background cleanup interval in minutes (default: 60)","type":"integer"},"activity_max_records":{"description":"Max records before pruning (default: 100000)","type":"integer"},"activity_max_response_size":{"description":"Response truncation limit in bytes (default: 65536)","type":"integer"},"activity_retention_days":{"description":"Activity logging settings (RFC-003)","type":"integer"},"allow_server_add":{"type":"boolean"},"allow_server_remove":{"type":"boolean"},"api_key":{"description":"Security settings","type":"string"},"call_tool_timeout":{"type":"string"},"check_server_repo":{"description":"Repository detection settings","type":"boolean"},"code_execution_max_tool_calls":{"description":"Max tool calls per execution (0 = unlimited, default: 0)","type":"integer"},"code_execution_pool_size":{"description":"JavaScript runtime pool size (default: 10)","type":"integer"},"code_execution_timeout_ms":{"description":"Timeout in milliseconds (default: 120000, max: 600000)","type":"integer"},"data_dir":{"type":"string"},"debug_search":{"type":"boolean"},"disable_management":{"type":"boolean"},"docker_isolation":{"$ref":"#/components/schemas/config.DockerIsolationConfig"},"docker_recovery":{"$ref":"#/components/schemas/config.DockerRecoveryConfig"},"enable_code_execution":{"description":"Code execution settings","type":"boolean"},"enable_prompts":{"description":"Prompts settings","type":"boolean"},"enable_socket":{"description":"Enable Unix socket/named pipe for local IPC (default: true)","type":"boolean"},"enable_tray":{"description":"Deprecated: EnableTray is unused and has no runtime effect. Kept for backward compatibility.","type":"boolean"},"environment":{"$ref":"#/components/schemas/secureenv.EnvConfig"},"features":{"$ref":"#/components/schemas/config.FeatureFlags"},"intent_declaration":{"$ref":"#/components/schemas/config.IntentDeclarationConfig"},"listen":{"type":"string"},"logging":{"$ref":"#/components/schemas/config.LogConfig"},"mcpServers":{"items":{"$ref":"#/components/schemas/config.ServerConfig"},"type":"array","uniqueItems":false},"oauth_expiry_warning_hours":{"description":"Health status settings","type":"number"},"quarantine_enabled":{"description":"Tool-level quarantine settings (Spec 032)\nQuarantineEnabled controls whether tool-level quarantine is active.\nWhen nil (default), quarantine is enabled (secure by default).\nSet to explicit false to disable tool-level quarantine.","type":"boolean"},"read_only_mode":{"type":"boolean"},"registries":{"description":"Registries configuration for MCP server discovery","items":{"$ref":"#/components/schemas/config.RegistryEntry"},"type":"array","uniqueItems":false},"require_mcp_auth":{"description":"Require authentication on /mcp endpoint (default: false)","type":"boolean"},"sensitive_data_detection":{"$ref":"#/components/schemas/config.SensitiveDataDetectionConfig"},"tls":{"$ref":"#/components/schemas/config.TLSConfig"},"tokenizer":{"$ref":"#/components/schemas/config.TokenizerConfig"},"tool_response_limit":{"type":"integer"},"tools_limit":{"type":"integer"},"top_k":{"description":"Deprecated: TopK is superseded by ToolsLimit and has no runtime effect. Kept for backward compatibility.","type":"integer"},"tray_endpoint":{"description":"Tray endpoint override (unix:// or npipe://)","type":"string"}},"type":"object"},"config.CustomPattern":{"properties":{"category":{"description":"Category (defaults to \"custom\")","type":"string"},"keywords":{"description":"Keywords to match (mutually exclusive with Regex)","items":{"type":"string"},"type":"array","uniqueItems":false},"name":{"description":"Unique identifier for this pattern","type":"string"},"regex":{"description":"Regex pattern (mutually exclusive with Keywords)","type":"string"},"severity":{"description":"Risk level: critical, high, medium, low","type":"string"}},"type":"object"},"config.DockerIsolationConfig":{"description":"Docker isolation settings","properties":{"cpu_limit":{"description":"CPU limit for containers","type":"string"},"default_images":{"additionalProperties":{"type":"string"},"description":"Map of runtime type to Docker image","type":"object"},"enabled":{"description":"Global enable/disable for Docker isolation","type":"boolean"},"extra_args":{"description":"Additional docker run arguments","items":{"type":"string"},"type":"array","uniqueItems":false},"log_driver":{"description":"Docker log driver (default: json-file)","type":"string"},"log_max_files":{"description":"Maximum number of log files (default: 3)","type":"string"},"log_max_size":{"description":"Maximum size of log files (default: 100m)","type":"string"},"memory_limit":{"description":"Memory limit for containers","type":"string"},"network_mode":{"description":"Docker network mode (default: bridge)","type":"string"},"registry":{"description":"Custom registry (defaults to docker.io)","type":"string"},"timeout":{"description":"Container startup timeout","type":"string"}},"type":"object"},"config.DockerRecoveryConfig":{"description":"Docker recovery settings","properties":{"enabled":{"description":"Enable Docker recovery monitoring (default: true)","type":"boolean"},"max_retries":{"description":"Maximum retry attempts (0 = unlimited)","type":"integer"},"notify_on_failure":{"description":"Show notification on recovery failure (default: true)","type":"boolean"},"notify_on_retry":{"description":"Show notification on each retry (default: false)","type":"boolean"},"notify_on_start":{"description":"Show notification when recovery starts (default: true)","type":"boolean"},"notify_on_success":{"description":"Show notification on successful recovery (default: true)","type":"boolean"},"persistent_state":{"description":"Save recovery state across restarts (default: true)","type":"boolean"}},"type":"object"},"config.FeatureFlags":{"description":"Deprecated: Features flags are unused and have no runtime effect. Kept for backward compatibility.","properties":{"enable_async_storage":{"type":"boolean"},"enable_caching":{"type":"boolean"},"enable_contract_tests":{"type":"boolean"},"enable_debug_logging":{"description":"Development features","type":"boolean"},"enable_docker_isolation":{"type":"boolean"},"enable_event_bus":{"type":"boolean"},"enable_health_checks":{"type":"boolean"},"enable_metrics":{"type":"boolean"},"enable_oauth":{"description":"Security features","type":"boolean"},"enable_observability":{"description":"Observability features","type":"boolean"},"enable_quarantine":{"type":"boolean"},"enable_runtime":{"description":"Runtime features","type":"boolean"},"enable_search":{"description":"Storage features","type":"boolean"},"enable_sse":{"type":"boolean"},"enable_tracing":{"type":"boolean"},"enable_tray":{"type":"boolean"},"enable_web_ui":{"description":"UI features","type":"boolean"}},"type":"object"},"config.IntentDeclarationConfig":{"description":"Intent declaration settings (Spec 018)","properties":{"strict_server_validation":{"description":"StrictServerValidation controls whether server annotation mismatches\ncause rejection (true) or just warnings (false).\nDefault: true (reject mismatches)","type":"boolean"}},"type":"object"},"config.IsolationConfig":{"description":"Per-server isolation settings","properties":{"enabled":{"description":"Enable Docker isolation for this server (nil = inherit global)","type":"boolean"},"extra_args":{"description":"Additional docker run arguments for this server","items":{"type":"string"},"type":"array","uniqueItems":false},"image":{"description":"Custom Docker image (overrides default)","type":"string"},"log_driver":{"description":"Docker log driver override for this server","type":"string"},"log_max_files":{"description":"Maximum number of log files override","type":"string"},"log_max_size":{"description":"Maximum size of log files override","type":"string"},"network_mode":{"description":"Custom network mode for this server","type":"string"},"working_dir":{"description":"Custom working directory in container","type":"string"}},"type":"object"},"config.LogConfig":{"description":"Logging configuration","properties":{"compress":{"type":"boolean"},"enable_console":{"type":"boolean"},"enable_file":{"type":"boolean"},"filename":{"type":"string"},"json_format":{"type":"boolean"},"level":{"type":"string"},"log_dir":{"description":"Custom log directory","type":"string"},"max_age":{"description":"days","type":"integer"},"max_backups":{"description":"number of backup files","type":"integer"},"max_size":{"description":"MB","type":"integer"}},"type":"object"},"config.OAuthConfig":{"description":"OAuth configuration (keep even when empty to signal OAuth requirement)","properties":{"client_id":{"type":"string"},"client_secret":{"type":"string"},"extra_params":{"additionalProperties":{"type":"string"},"description":"Additional OAuth parameters (e.g., RFC 8707 resource)","type":"object"},"pkce_enabled":{"type":"boolean"},"redirect_uri":{"type":"string"},"scopes":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"config.RegistryEntry":{"properties":{"count":{"description":"number or string","type":"string"},"description":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"protocol":{"type":"string"},"servers_url":{"type":"string"},"tags":{"items":{"type":"string"},"type":"array","uniqueItems":false},"url":{"type":"string"}},"type":"object"},"config.SensitiveDataDetectionConfig":{"description":"Sensitive data detection settings (Spec 026)","properties":{"categories":{"additionalProperties":{"type":"boolean"},"description":"Enable/disable specific detection categories","type":"object"},"custom_patterns":{"description":"User-defined detection patterns","items":{"$ref":"#/components/schemas/config.CustomPattern"},"type":"array","uniqueItems":false},"enabled":{"description":"Enable sensitive data detection (default: true)","type":"boolean"},"entropy_threshold":{"description":"Shannon entropy threshold for high-entropy detection (default: 4.5)","type":"number"},"max_payload_size_kb":{"description":"Max size to scan before truncating (default: 1024)","type":"integer"},"scan_requests":{"description":"Scan tool call arguments (default: true)","type":"boolean"},"scan_responses":{"description":"Scan tool responses (default: true)","type":"boolean"},"sensitive_keywords":{"description":"Keywords to flag","items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"config.ServerConfig":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"command":{"type":"string"},"created":{"type":"string"},"enabled":{"type":"boolean"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"headers":{"additionalProperties":{"type":"string"},"description":"For HTTP servers","type":"object"},"isolation":{"$ref":"#/components/schemas/config.IsolationConfig"},"name":{"type":"string"},"oauth":{"$ref":"#/components/schemas/config.OAuthConfig"},"protocol":{"description":"stdio, http, sse, streamable-http, auto","type":"string"},"quarantined":{"description":"Security quarantine status","type":"boolean"},"shared":{"description":"Server edition: shared with all users","type":"boolean"},"skip_quarantine":{"description":"Skip tool-level quarantine for this server","type":"boolean"},"updated":{"type":"string"},"url":{"type":"string"},"working_dir":{"description":"Working directory for stdio servers","type":"string"}},"type":"object"},"config.TLSConfig":{"description":"TLS configuration","properties":{"certs_dir":{"description":"Directory for certificates","type":"string"},"enabled":{"description":"Enable HTTPS","type":"boolean"},"hsts":{"description":"Enable HTTP Strict Transport Security","type":"boolean"},"require_client_cert":{"description":"Enable mTLS","type":"boolean"}},"type":"object"},"config.TokenizerConfig":{"description":"Tokenizer configuration for token counting","properties":{"default_model":{"description":"Default model for tokenization (e.g., \"gpt-4\")","type":"string"},"enabled":{"description":"Enable token counting","type":"boolean"},"encoding":{"description":"Default encoding (e.g., \"cl100k_base\")","type":"string"}},"type":"object"},"configimport.FailedServer":{"properties":{"details":{"type":"string"},"error":{"type":"string"},"name":{"type":"string"}},"type":"object"},"configimport.ImportSummary":{"properties":{"failed":{"type":"integer"},"imported":{"type":"integer"},"skipped":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"configimport.SkippedServer":{"properties":{"name":{"type":"string"},"reason":{"description":"\"already_exists\", \"filtered_out\", \"invalid_name\"","type":"string"}},"type":"object"},"contracts.APIResponse":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.ActivityDetailResponse":{"properties":{"activity":{"$ref":"#/components/schemas/contracts.ActivityRecord"}},"type":"object"},"contracts.ActivityListResponse":{"properties":{"activities":{"items":{"$ref":"#/components/schemas/contracts.ActivityRecord"},"type":"array","uniqueItems":false},"limit":{"type":"integer"},"offset":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"contracts.ActivityRecord":{"properties":{"arguments":{"description":"Tool call arguments","type":"object"},"detection_types":{"description":"List of detection types found","items":{"type":"string"},"type":"array","uniqueItems":false},"duration_ms":{"description":"Execution duration in milliseconds","type":"integer"},"error_message":{"description":"Error details if status is \"error\"","type":"string"},"has_sensitive_data":{"description":"Sensitive data detection fields (Spec 026)","type":"boolean"},"id":{"description":"Unique identifier (ULID format)","type":"string"},"max_severity":{"description":"Highest severity level detected (critical, high, medium, low)","type":"string"},"metadata":{"description":"Additional context-specific data","type":"object"},"request_id":{"description":"HTTP request ID for correlation","type":"string"},"response":{"description":"Tool response (potentially truncated)","type":"string"},"response_truncated":{"description":"True if response was truncated","type":"boolean"},"server_name":{"description":"Name of upstream MCP server","type":"string"},"session_id":{"description":"MCP session ID for correlation","type":"string"},"source":{"$ref":"#/components/schemas/contracts.ActivitySource"},"status":{"description":"Result status: \"success\", \"error\", \"blocked\"","type":"string"},"timestamp":{"description":"When activity occurred","type":"string"},"tool_name":{"description":"Name of tool called","type":"string"},"type":{"$ref":"#/components/schemas/contracts.ActivityType"}},"type":"object"},"contracts.ActivitySource":{"description":"How activity was triggered: \"mcp\", \"cli\", \"api\"","type":"string","x-enum-varnames":["ActivitySourceMCP","ActivitySourceCLI","ActivitySourceAPI"]},"contracts.ActivitySummaryResponse":{"properties":{"blocked_count":{"description":"Count of blocked activities","type":"integer"},"end_time":{"description":"End of the period (RFC3339)","type":"string"},"error_count":{"description":"Count of error activities","type":"integer"},"period":{"description":"Time period (1h, 24h, 7d, 30d)","type":"string"},"start_time":{"description":"Start of the period (RFC3339)","type":"string"},"success_count":{"description":"Count of successful activities","type":"integer"},"top_servers":{"description":"Top servers by activity count","items":{"$ref":"#/components/schemas/contracts.ActivityTopServer"},"type":"array","uniqueItems":false},"top_tools":{"description":"Top tools by activity count","items":{"$ref":"#/components/schemas/contracts.ActivityTopTool"},"type":"array","uniqueItems":false},"total_count":{"description":"Total activity count","type":"integer"}},"type":"object"},"contracts.ActivityTopServer":{"properties":{"count":{"description":"Activity count","type":"integer"},"name":{"description":"Server name","type":"string"}},"type":"object"},"contracts.ActivityTopTool":{"properties":{"count":{"description":"Activity count","type":"integer"},"server":{"description":"Server name","type":"string"},"tool":{"description":"Tool name","type":"string"}},"type":"object"},"contracts.ActivityType":{"description":"Type of activity","type":"string","x-enum-varnames":["ActivityTypeToolCall","ActivityTypePolicyDecision","ActivityTypeQuarantineChange","ActivityTypeServerChange"]},"contracts.ConfigApplyResult":{"properties":{"applied_immediately":{"type":"boolean"},"changed_fields":{"items":{"type":"string"},"type":"array","uniqueItems":false},"requires_restart":{"type":"boolean"},"restart_reason":{"type":"string"},"success":{"type":"boolean"},"validation_errors":{"items":{"$ref":"#/components/schemas/contracts.ValidationError"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.DCRStatus":{"properties":{"attempted":{"type":"boolean"},"error":{"type":"string"},"status_code":{"type":"integer"},"success":{"type":"boolean"}},"type":"object"},"contracts.DeprecatedConfigWarning":{"properties":{"field":{"type":"string"},"message":{"type":"string"},"replacement":{"type":"string"}},"type":"object"},"contracts.Diagnostics":{"properties":{"deprecated_configs":{"description":"Deprecated config fields found","items":{"$ref":"#/components/schemas/contracts.DeprecatedConfigWarning"},"type":"array","uniqueItems":false},"docker_status":{"$ref":"#/components/schemas/contracts.DockerStatus"},"missing_secrets":{"description":"Renamed to avoid conflict","items":{"$ref":"#/components/schemas/contracts.MissingSecretInfo"},"type":"array","uniqueItems":false},"oauth_issues":{"description":"OAuth parameter mismatches","items":{"$ref":"#/components/schemas/contracts.OAuthIssue"},"type":"array","uniqueItems":false},"oauth_required":{"items":{"$ref":"#/components/schemas/contracts.OAuthRequirement"},"type":"array","uniqueItems":false},"runtime_warnings":{"items":{"type":"string"},"type":"array","uniqueItems":false},"timestamp":{"type":"string"},"total_issues":{"type":"integer"},"upstream_errors":{"items":{"$ref":"#/components/schemas/contracts.UpstreamError"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.DockerStatus":{"properties":{"available":{"type":"boolean"},"error":{"type":"string"},"version":{"type":"string"}},"type":"object"},"contracts.ErrorResponse":{"properties":{"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.GetConfigResponse":{"properties":{"config":{"description":"The configuration object","type":"object"},"config_path":{"description":"Path to config file","type":"string"}},"type":"object"},"contracts.GetRegistriesResponse":{"properties":{"registries":{"items":{"$ref":"#/components/schemas/contracts.Registry"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.GetServerLogsResponse":{"properties":{"count":{"type":"integer"},"logs":{"items":{"$ref":"#/components/schemas/contracts.LogEntry"},"type":"array","uniqueItems":false},"server_name":{"type":"string"}},"type":"object"},"contracts.GetServerToolCallsResponse":{"properties":{"server_name":{"type":"string"},"tool_calls":{"items":{"$ref":"#/components/schemas/contracts.ToolCallRecord"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.GetServerToolsResponse":{"properties":{"count":{"type":"integer"},"server_name":{"type":"string"},"tools":{"items":{"$ref":"#/components/schemas/contracts.Tool"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.GetServersResponse":{"properties":{"servers":{"items":{"$ref":"#/components/schemas/contracts.Server"},"type":"array","uniqueItems":false},"stats":{"$ref":"#/components/schemas/contracts.ServerStats"}},"type":"object"},"contracts.GetSessionDetailResponse":{"properties":{"session":{"$ref":"#/components/schemas/contracts.MCPSession"}},"type":"object"},"contracts.GetSessionsResponse":{"properties":{"limit":{"type":"integer"},"offset":{"type":"integer"},"sessions":{"items":{"$ref":"#/components/schemas/contracts.MCPSession"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.GetToolCallDetailResponse":{"properties":{"tool_call":{"$ref":"#/components/schemas/contracts.ToolCallRecord"}},"type":"object"},"contracts.GetToolCallsResponse":{"properties":{"limit":{"type":"integer"},"offset":{"type":"integer"},"tool_calls":{"items":{"$ref":"#/components/schemas/contracts.ToolCallRecord"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.HealthStatus":{"description":"Unified health status calculated by the backend","properties":{"action":{"description":"Action is the suggested fix action: \"login\", \"restart\", \"enable\", \"approve\", \"view_logs\", \"set_secret\", \"configure\", or \"\" (none)","type":"string"},"admin_state":{"description":"AdminState indicates the admin state: \"enabled\", \"disabled\", or \"quarantined\"","type":"string"},"detail":{"description":"Detail is an optional longer explanation of the status","type":"string"},"level":{"description":"Level indicates the health level: \"healthy\", \"degraded\", or \"unhealthy\"","type":"string"},"summary":{"description":"Summary is a human-readable status message (e.g., \"Connected (5 tools)\")","type":"string"}},"type":"object"},"contracts.InfoEndpoints":{"description":"Available API endpoints","properties":{"http":{"description":"HTTP endpoint address (e.g., \"127.0.0.1:8080\")","type":"string"},"socket":{"description":"Unix socket path (empty if disabled)","type":"string"}},"type":"object"},"contracts.InfoResponse":{"properties":{"endpoints":{"$ref":"#/components/schemas/contracts.InfoEndpoints"},"listen_addr":{"description":"Listen address (e.g., \"127.0.0.1:8080\")","type":"string"},"update":{"$ref":"#/components/schemas/contracts.UpdateInfo"},"version":{"description":"Current MCPProxy version","type":"string"},"web_ui_url":{"description":"URL to access the web control panel","type":"string"}},"type":"object"},"contracts.IsolationConfig":{"properties":{"cpu_limit":{"type":"string"},"enabled":{"type":"boolean"},"image":{"type":"string"},"memory_limit":{"type":"string"},"timeout":{"type":"string"},"working_dir":{"type":"string"}},"type":"object"},"contracts.LogEntry":{"properties":{"fields":{"type":"object"},"level":{"type":"string"},"message":{"type":"string"},"server":{"type":"string"},"timestamp":{"type":"string"}},"type":"object"},"contracts.MCPSession":{"properties":{"client_name":{"type":"string"},"client_version":{"type":"string"},"end_time":{"type":"string"},"experimental":{"items":{"type":"string"},"type":"array","uniqueItems":false},"has_roots":{"description":"MCP Client Capabilities","type":"boolean"},"has_sampling":{"type":"boolean"},"id":{"type":"string"},"last_activity":{"type":"string"},"start_time":{"type":"string"},"status":{"type":"string"},"tool_call_count":{"type":"integer"},"total_tokens":{"type":"integer"}},"type":"object"},"contracts.MetadataStatus":{"properties":{"authorization_servers":{"items":{"type":"string"},"type":"array","uniqueItems":false},"error":{"type":"string"},"found":{"type":"boolean"},"url_checked":{"type":"string"}},"type":"object"},"contracts.MissingSecretInfo":{"properties":{"secret_name":{"type":"string"},"used_by":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.NPMPackageInfo":{"properties":{"exists":{"type":"boolean"},"install_cmd":{"type":"string"}},"type":"object"},"contracts.OAuthConfig":{"properties":{"auth_url":{"type":"string"},"client_id":{"type":"string"},"extra_params":{"additionalProperties":{"type":"string"},"type":"object"},"pkce_enabled":{"type":"boolean"},"redirect_port":{"type":"integer"},"scopes":{"items":{"type":"string"},"type":"array","uniqueItems":false},"token_expires_at":{"description":"When the OAuth token expires","type":"string"},"token_url":{"type":"string"},"token_valid":{"description":"Whether token is currently valid","type":"boolean"}},"type":"object"},"contracts.OAuthErrorDetails":{"description":"Structured discovery/failure details","properties":{"authorization_server_metadata":{"$ref":"#/components/schemas/contracts.MetadataStatus"},"dcr_status":{"$ref":"#/components/schemas/contracts.DCRStatus"},"protected_resource_metadata":{"$ref":"#/components/schemas/contracts.MetadataStatus"},"server_url":{"type":"string"}},"type":"object"},"contracts.OAuthFlowError":{"properties":{"correlation_id":{"description":"Flow tracking ID for log correlation","type":"string"},"debug_hint":{"description":"CLI command for log lookup","type":"string"},"details":{"$ref":"#/components/schemas/contracts.OAuthErrorDetails"},"error_code":{"description":"Machine-readable error code (e.g., OAUTH_NO_METADATA)","type":"string"},"error_type":{"description":"Category of OAuth runtime failure","type":"string"},"message":{"description":"Human-readable error description","type":"string"},"request_id":{"description":"HTTP request ID (from PR #237)","type":"string"},"server_name":{"description":"Server that failed OAuth","type":"string"},"success":{"description":"Always false","type":"boolean"},"suggestion":{"description":"Actionable remediation hint","type":"string"}},"type":"object"},"contracts.OAuthIssue":{"properties":{"documentation_url":{"type":"string"},"error":{"type":"string"},"issue":{"type":"string"},"missing_params":{"items":{"type":"string"},"type":"array","uniqueItems":false},"resolution":{"type":"string"},"server_name":{"type":"string"}},"type":"object"},"contracts.OAuthRequirement":{"properties":{"expires_at":{"type":"string"},"message":{"type":"string"},"server_name":{"type":"string"},"state":{"type":"string"}},"type":"object"},"contracts.OAuthStartResponse":{"properties":{"auth_url":{"description":"Authorization URL (always included for manual use)","type":"string"},"browser_error":{"description":"Error message if browser launch failed","type":"string"},"browser_opened":{"description":"Whether browser launch succeeded","type":"boolean"},"correlation_id":{"description":"UUID for tracking this flow","type":"string"},"message":{"description":"Human-readable status message","type":"string"},"server_name":{"description":"Name of the server being authenticated","type":"string"},"success":{"description":"Always true for successful start","type":"boolean"}},"type":"object"},"contracts.Registry":{"properties":{"count":{"description":"number or string","type":"string"},"description":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"protocol":{"type":"string"},"servers_url":{"type":"string"},"tags":{"items":{"type":"string"},"type":"array","uniqueItems":false},"url":{"type":"string"}},"type":"object"},"contracts.ReplayToolCallRequest":{"properties":{"arguments":{"description":"Modified arguments for replay","type":"object"}},"type":"object"},"contracts.ReplayToolCallResponse":{"properties":{"error":{"description":"Error if replay failed","type":"string"},"new_call_id":{"description":"ID of the newly created call","type":"string"},"new_tool_call":{"$ref":"#/components/schemas/contracts.ToolCallRecord"},"replayed_from":{"description":"Original call ID","type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.RepositoryInfo":{"description":"Detected package info","properties":{"npm":{"$ref":"#/components/schemas/contracts.NPMPackageInfo"}},"type":"object"},"contracts.RepositoryServer":{"properties":{"connect_url":{"description":"Alternative connection URL","type":"string"},"created_at":{"type":"string"},"description":{"type":"string"},"id":{"type":"string"},"install_cmd":{"description":"Installation command","type":"string"},"name":{"type":"string"},"registry":{"description":"Which registry this came from","type":"string"},"repository_info":{"$ref":"#/components/schemas/contracts.RepositoryInfo"},"source_code_url":{"description":"Source repository URL","type":"string"},"updated_at":{"type":"string"},"url":{"description":"MCP endpoint for remote servers only","type":"string"}},"type":"object"},"contracts.SearchRegistryServersResponse":{"properties":{"query":{"type":"string"},"registry_id":{"type":"string"},"servers":{"items":{"$ref":"#/components/schemas/contracts.RepositoryServer"},"type":"array","uniqueItems":false},"tag":{"type":"string"},"total":{"type":"integer"}},"type":"object"},"contracts.SearchResult":{"properties":{"matches":{"type":"integer"},"score":{"type":"number"},"snippet":{"type":"string"},"tool":{"$ref":"#/components/schemas/contracts.Tool"}},"type":"object"},"contracts.SearchToolsResponse":{"properties":{"query":{"type":"string"},"results":{"items":{"$ref":"#/components/schemas/contracts.SearchResult"},"type":"array","uniqueItems":false},"took":{"type":"string"},"total":{"type":"integer"}},"type":"object"},"contracts.Server":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"authenticated":{"description":"OAuth authentication status","type":"boolean"},"command":{"type":"string"},"connected":{"type":"boolean"},"connected_at":{"type":"string"},"connecting":{"type":"boolean"},"created":{"type":"string"},"enabled":{"type":"boolean"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"headers":{"additionalProperties":{"type":"string"},"type":"object"},"health":{"$ref":"#/components/schemas/contracts.HealthStatus"},"id":{"type":"string"},"isolation":{"$ref":"#/components/schemas/contracts.IsolationConfig"},"last_error":{"type":"string"},"last_reconnect_at":{"type":"string"},"last_retry_time":{"type":"string"},"name":{"type":"string"},"oauth":{"$ref":"#/components/schemas/contracts.OAuthConfig"},"oauth_status":{"description":"OAuth status: \"authenticated\", \"expired\", \"error\", \"none\"","type":"string"},"protocol":{"type":"string"},"quarantined":{"type":"boolean"},"reconnect_count":{"type":"integer"},"retry_count":{"type":"integer"},"should_retry":{"type":"boolean"},"status":{"type":"string"},"token_expires_at":{"description":"When the OAuth token expires (ISO 8601)","type":"string"},"tool_count":{"type":"integer"},"tool_list_token_size":{"description":"Token size for this server's tools","type":"integer"},"updated":{"type":"string"},"url":{"type":"string"},"user_logged_out":{"description":"True if user explicitly logged out (prevents auto-reconnection)","type":"boolean"},"working_dir":{"type":"string"}},"type":"object"},"contracts.ServerActionResponse":{"properties":{"action":{"type":"string"},"async":{"type":"boolean"},"server":{"type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.ServerStats":{"properties":{"connected_servers":{"type":"integer"},"docker_containers":{"type":"integer"},"quarantined_servers":{"type":"integer"},"token_metrics":{"$ref":"#/components/schemas/contracts.ServerTokenMetrics"},"total_servers":{"type":"integer"},"total_tools":{"type":"integer"}},"type":"object"},"contracts.ServerTokenMetrics":{"properties":{"average_query_result_size":{"description":"Typical retrieve_tools output (tokens)","type":"integer"},"per_server_tool_list_sizes":{"additionalProperties":{"type":"integer"},"description":"Token size per server","type":"object"},"saved_tokens":{"description":"Difference","type":"integer"},"saved_tokens_percentage":{"description":"Percentage saved","type":"number"},"total_server_tool_list_size":{"description":"All upstream tools combined (tokens)","type":"integer"}},"type":"object"},"contracts.SuccessResponse":{"properties":{"data":{"type":"object"},"success":{"type":"boolean"}},"type":"object"},"contracts.TokenMetrics":{"description":"Token usage metrics (nil for older records)","properties":{"encoding":{"description":"Encoding used (e.g., cl100k_base)","type":"string"},"estimated_cost":{"description":"Optional cost estimate","type":"number"},"input_tokens":{"description":"Tokens in the request","type":"integer"},"model":{"description":"Model used for tokenization","type":"string"},"output_tokens":{"description":"Tokens in the response","type":"integer"},"total_tokens":{"description":"Total tokens (input + output)","type":"integer"},"truncated_tokens":{"description":"Tokens removed by truncation","type":"integer"},"was_truncated":{"description":"Whether response was truncated","type":"boolean"}},"type":"object"},"contracts.Tool":{"properties":{"annotations":{"$ref":"#/components/schemas/contracts.ToolAnnotation"},"description":{"type":"string"},"last_used":{"type":"string"},"name":{"type":"string"},"schema":{"type":"object"},"server_name":{"type":"string"},"usage":{"type":"integer"}},"type":"object"},"contracts.ToolAnnotation":{"description":"Tool behavior hints snapshot","properties":{"destructiveHint":{"type":"boolean"},"idempotentHint":{"type":"boolean"},"openWorldHint":{"type":"boolean"},"readOnlyHint":{"type":"boolean"},"title":{"type":"string"}},"type":"object"},"contracts.ToolCallRecord":{"description":"The new tool call record","properties":{"annotations":{"$ref":"#/components/schemas/contracts.ToolAnnotation"},"arguments":{"description":"Tool arguments","type":"object"},"config_path":{"description":"Active config file path","type":"string"},"duration":{"description":"Duration in nanoseconds","type":"integer"},"error":{"description":"Error message (failure only)","type":"string"},"execution_type":{"description":"\"direct\" or \"code_execution\"","type":"string"},"id":{"description":"Unique identifier","type":"string"},"mcp_client_name":{"description":"MCP client name from InitializeRequest","type":"string"},"mcp_client_version":{"description":"MCP client version","type":"string"},"mcp_session_id":{"description":"MCP session identifier","type":"string"},"metrics":{"$ref":"#/components/schemas/contracts.TokenMetrics"},"parent_call_id":{"description":"Links nested calls to parent code_execution","type":"string"},"request_id":{"description":"Request correlation ID","type":"string"},"response":{"description":"Tool response (success only)","type":"object"},"server_id":{"description":"Server identity hash","type":"string"},"server_name":{"description":"Human-readable server name","type":"string"},"timestamp":{"description":"When the call was made","type":"string"},"tool_name":{"description":"Tool name (without server prefix)","type":"string"}},"type":"object"},"contracts.UpdateInfo":{"description":"Update information (if available)","properties":{"available":{"description":"Whether an update is available","type":"boolean"},"check_error":{"description":"Error message if update check failed","type":"string"},"checked_at":{"description":"When the update check was performed","type":"string"},"is_prerelease":{"description":"Whether the latest version is a prerelease","type":"boolean"},"latest_version":{"description":"Latest version available (e.g., \"v1.2.3\")","type":"string"},"release_url":{"description":"URL to the release page","type":"string"}},"type":"object"},"contracts.UpstreamError":{"properties":{"error_message":{"type":"string"},"server_name":{"type":"string"},"timestamp":{"type":"string"}},"type":"object"},"contracts.ValidateConfigResponse":{"properties":{"errors":{"items":{"$ref":"#/components/schemas/contracts.ValidationError"},"type":"array","uniqueItems":false},"valid":{"type":"boolean"}},"type":"object"},"contracts.ValidationError":{"properties":{"field":{"type":"string"},"message":{"type":"string"}},"type":"object"},"data":{"properties":{"data":{"$ref":"#/components/schemas/contracts.InfoResponse"}},"type":"object"},"httpapi.AddServerRequest":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"command":{"type":"string"},"enabled":{"type":"boolean"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"headers":{"additionalProperties":{"type":"string"},"type":"object"},"name":{"type":"string"},"protocol":{"type":"string"},"quarantined":{"type":"boolean"},"url":{"type":"string"},"working_dir":{"type":"string"}},"type":"object"},"httpapi.CanonicalConfigPath":{"properties":{"description":{"description":"Brief description","type":"string"},"exists":{"description":"Whether the file exists","type":"boolean"},"format":{"description":"Format identifier (e.g., \"claude_desktop\")","type":"string"},"name":{"description":"Display name (e.g., \"Claude Desktop\")","type":"string"},"os":{"description":"Operating system (darwin, windows, linux)","type":"string"},"path":{"description":"Full path to the config file","type":"string"}},"type":"object"},"httpapi.CanonicalConfigPathsResponse":{"properties":{"os":{"description":"Current operating system","type":"string"},"paths":{"description":"List of canonical config paths","items":{"$ref":"#/components/schemas/httpapi.CanonicalConfigPath"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportFromPathRequest":{"properties":{"format":{"description":"Optional format hint","type":"string"},"path":{"description":"File path to import from","type":"string"},"server_names":{"description":"Optional: import only these servers","items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportRequest":{"properties":{"content":{"description":"Raw JSON or TOML content","type":"string"},"format":{"description":"Optional format hint","type":"string"},"server_names":{"description":"Optional: import only these servers","items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportResponse":{"properties":{"failed":{"items":{"$ref":"#/components/schemas/configimport.FailedServer"},"type":"array","uniqueItems":false},"format":{"type":"string"},"format_name":{"type":"string"},"imported":{"items":{"$ref":"#/components/schemas/httpapi.ImportedServerResponse"},"type":"array","uniqueItems":false},"skipped":{"items":{"$ref":"#/components/schemas/configimport.SkippedServer"},"type":"array","uniqueItems":false},"summary":{"$ref":"#/components/schemas/configimport.ImportSummary"},"warnings":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportedServerResponse":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"command":{"type":"string"},"fields_skipped":{"items":{"type":"string"},"type":"array","uniqueItems":false},"name":{"type":"string"},"original_name":{"type":"string"},"protocol":{"type":"string"},"source_format":{"type":"string"},"url":{"type":"string"},"warnings":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"management.BulkOperationResult":{"properties":{"errors":{"additionalProperties":{"type":"string"},"description":"Map of server name to error message","type":"object"},"failed":{"description":"Number of failed operations","type":"integer"},"successful":{"description":"Number of successful operations","type":"integer"},"total":{"description":"Total servers processed","type":"integer"}},"type":"object"},"observability.HealthResponse":{"properties":{"components":{"items":{"$ref":"#/components/schemas/observability.HealthStatus"},"type":"array","uniqueItems":false},"status":{"description":"\"healthy\" or \"unhealthy\"","type":"string"},"timestamp":{"type":"string"}},"type":"object"},"observability.HealthStatus":{"properties":{"error":{"type":"string"},"latency":{"type":"string"},"name":{"type":"string"},"status":{"description":"\"healthy\" or \"unhealthy\"","type":"string"}},"type":"object"},"observability.ReadinessResponse":{"properties":{"components":{"items":{"$ref":"#/components/schemas/observability.HealthStatus"},"type":"array","uniqueItems":false},"status":{"description":"\"ready\" or \"not_ready\"","type":"string"},"timestamp":{"type":"string"}},"type":"object"},"secureenv.EnvConfig":{"description":"Environment configuration for secure variable filtering","properties":{"allowed_system_vars":{"items":{"type":"string"},"type":"array","uniqueItems":false},"custom_vars":{"additionalProperties":{"type":"string"},"type":"object"},"enhance_path":{"description":"Enable PATH enhancement for Launchd scenarios","type":"boolean"},"inherit_system_safe":{"type":"boolean"}},"type":"object"}},"securitySchemes":{"ApiKeyAuth":{"description":"API key authentication via query parameter. Use ?apikey=your-key","in":"query","name":"apikey","type":"apiKey"}}},
+ "components": {"schemas":{"config.Config":{"properties":{"activity_cleanup_interval_min":{"description":"Background cleanup interval in minutes (default: 60)","type":"integer"},"activity_max_records":{"description":"Max records before pruning (default: 100000)","type":"integer"},"activity_max_response_size":{"description":"Response truncation limit in bytes (default: 65536)","type":"integer"},"activity_retention_days":{"description":"Activity logging settings (RFC-003)","type":"integer"},"allow_server_add":{"type":"boolean"},"allow_server_remove":{"type":"boolean"},"api_key":{"description":"Security settings","type":"string"},"call_tool_timeout":{"type":"string"},"check_server_repo":{"description":"Repository detection settings","type":"boolean"},"code_execution_max_tool_calls":{"description":"Max tool calls per execution (0 = unlimited, default: 0)","type":"integer"},"code_execution_pool_size":{"description":"JavaScript runtime pool size (default: 10)","type":"integer"},"code_execution_timeout_ms":{"description":"Timeout in milliseconds (default: 120000, max: 600000)","type":"integer"},"data_dir":{"type":"string"},"debug_search":{"type":"boolean"},"disable_management":{"type":"boolean"},"docker_isolation":{"$ref":"#/components/schemas/config.DockerIsolationConfig"},"docker_recovery":{"$ref":"#/components/schemas/config.DockerRecoveryConfig"},"enable_code_execution":{"description":"Code execution settings","type":"boolean"},"enable_prompts":{"description":"Prompts settings","type":"boolean"},"enable_socket":{"description":"Enable Unix socket/named pipe for local IPC (default: true)","type":"boolean"},"enable_tray":{"description":"Deprecated: EnableTray is unused and has no runtime effect. Kept for backward compatibility.","type":"boolean"},"environment":{"$ref":"#/components/schemas/secureenv.EnvConfig"},"features":{"$ref":"#/components/schemas/config.FeatureFlags"},"intent_declaration":{"$ref":"#/components/schemas/config.IntentDeclarationConfig"},"listen":{"type":"string"},"logging":{"$ref":"#/components/schemas/config.LogConfig"},"mcpServers":{"items":{"$ref":"#/components/schemas/config.ServerConfig"},"type":"array","uniqueItems":false},"oauth_expiry_warning_hours":{"description":"Health status settings","type":"number"},"quarantine_enabled":{"description":"Tool-level quarantine settings (Spec 032)\nQuarantineEnabled controls whether tool-level quarantine is active.\nWhen nil (default), quarantine is enabled (secure by default).\nSet to explicit false to disable tool-level quarantine.","type":"boolean"},"read_only_mode":{"type":"boolean"},"registries":{"description":"Registries configuration for MCP server discovery","items":{"$ref":"#/components/schemas/config.RegistryEntry"},"type":"array","uniqueItems":false},"require_mcp_auth":{"description":"Require authentication on /mcp endpoint (default: false)","type":"boolean"},"routing_mode":{"description":"Routing mode (Spec 031): how MCP tools are exposed to clients\nValid values: \"retrieve_tools\" (default), \"direct\", \"code_execution\"","type":"string"},"sensitive_data_detection":{"$ref":"#/components/schemas/config.SensitiveDataDetectionConfig"},"tls":{"$ref":"#/components/schemas/config.TLSConfig"},"tokenizer":{"$ref":"#/components/schemas/config.TokenizerConfig"},"tool_response_limit":{"type":"integer"},"tools_limit":{"type":"integer"},"top_k":{"description":"Deprecated: TopK is superseded by ToolsLimit and has no runtime effect. Kept for backward compatibility.","type":"integer"},"tray_endpoint":{"description":"Tray endpoint override (unix:// or npipe://)","type":"string"}},"type":"object"},"config.CustomPattern":{"properties":{"category":{"description":"Category (defaults to \"custom\")","type":"string"},"keywords":{"description":"Keywords to match (mutually exclusive with Regex)","items":{"type":"string"},"type":"array","uniqueItems":false},"name":{"description":"Unique identifier for this pattern","type":"string"},"regex":{"description":"Regex pattern (mutually exclusive with Keywords)","type":"string"},"severity":{"description":"Risk level: critical, high, medium, low","type":"string"}},"type":"object"},"config.DockerIsolationConfig":{"description":"Docker isolation settings","properties":{"cpu_limit":{"description":"CPU limit for containers","type":"string"},"default_images":{"additionalProperties":{"type":"string"},"description":"Map of runtime type to Docker image","type":"object"},"enabled":{"description":"Global enable/disable for Docker isolation","type":"boolean"},"extra_args":{"description":"Additional docker run arguments","items":{"type":"string"},"type":"array","uniqueItems":false},"log_driver":{"description":"Docker log driver (default: json-file)","type":"string"},"log_max_files":{"description":"Maximum number of log files (default: 3)","type":"string"},"log_max_size":{"description":"Maximum size of log files (default: 100m)","type":"string"},"memory_limit":{"description":"Memory limit for containers","type":"string"},"network_mode":{"description":"Docker network mode (default: bridge)","type":"string"},"registry":{"description":"Custom registry (defaults to docker.io)","type":"string"},"timeout":{"description":"Container startup timeout","type":"string"}},"type":"object"},"config.DockerRecoveryConfig":{"description":"Docker recovery settings","properties":{"enabled":{"description":"Enable Docker recovery monitoring (default: true)","type":"boolean"},"max_retries":{"description":"Maximum retry attempts (0 = unlimited)","type":"integer"},"notify_on_failure":{"description":"Show notification on recovery failure (default: true)","type":"boolean"},"notify_on_retry":{"description":"Show notification on each retry (default: false)","type":"boolean"},"notify_on_start":{"description":"Show notification when recovery starts (default: true)","type":"boolean"},"notify_on_success":{"description":"Show notification on successful recovery (default: true)","type":"boolean"},"persistent_state":{"description":"Save recovery state across restarts (default: true)","type":"boolean"}},"type":"object"},"config.FeatureFlags":{"description":"Deprecated: Features flags are unused and have no runtime effect. Kept for backward compatibility.","properties":{"enable_async_storage":{"type":"boolean"},"enable_caching":{"type":"boolean"},"enable_contract_tests":{"type":"boolean"},"enable_debug_logging":{"description":"Development features","type":"boolean"},"enable_docker_isolation":{"type":"boolean"},"enable_event_bus":{"type":"boolean"},"enable_health_checks":{"type":"boolean"},"enable_metrics":{"type":"boolean"},"enable_oauth":{"description":"Security features","type":"boolean"},"enable_observability":{"description":"Observability features","type":"boolean"},"enable_quarantine":{"type":"boolean"},"enable_runtime":{"description":"Runtime features","type":"boolean"},"enable_search":{"description":"Storage features","type":"boolean"},"enable_sse":{"type":"boolean"},"enable_tracing":{"type":"boolean"},"enable_tray":{"type":"boolean"},"enable_web_ui":{"description":"UI features","type":"boolean"}},"type":"object"},"config.IntentDeclarationConfig":{"description":"Intent declaration settings (Spec 018)","properties":{"strict_server_validation":{"description":"StrictServerValidation controls whether server annotation mismatches\ncause rejection (true) or just warnings (false).\nDefault: true (reject mismatches)","type":"boolean"}},"type":"object"},"config.IsolationConfig":{"description":"Per-server isolation settings","properties":{"enabled":{"description":"Enable Docker isolation for this server (nil = inherit global)","type":"boolean"},"extra_args":{"description":"Additional docker run arguments for this server","items":{"type":"string"},"type":"array","uniqueItems":false},"image":{"description":"Custom Docker image (overrides default)","type":"string"},"log_driver":{"description":"Docker log driver override for this server","type":"string"},"log_max_files":{"description":"Maximum number of log files override","type":"string"},"log_max_size":{"description":"Maximum size of log files override","type":"string"},"network_mode":{"description":"Custom network mode for this server","type":"string"},"working_dir":{"description":"Custom working directory in container","type":"string"}},"type":"object"},"config.LogConfig":{"description":"Logging configuration","properties":{"compress":{"type":"boolean"},"enable_console":{"type":"boolean"},"enable_file":{"type":"boolean"},"filename":{"type":"string"},"json_format":{"type":"boolean"},"level":{"type":"string"},"log_dir":{"description":"Custom log directory","type":"string"},"max_age":{"description":"days","type":"integer"},"max_backups":{"description":"number of backup files","type":"integer"},"max_size":{"description":"MB","type":"integer"}},"type":"object"},"config.OAuthConfig":{"description":"OAuth configuration (keep even when empty to signal OAuth requirement)","properties":{"client_id":{"type":"string"},"client_secret":{"type":"string"},"extra_params":{"additionalProperties":{"type":"string"},"description":"Additional OAuth parameters (e.g., RFC 8707 resource)","type":"object"},"pkce_enabled":{"type":"boolean"},"redirect_uri":{"type":"string"},"scopes":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"config.RegistryEntry":{"properties":{"count":{"description":"number or string","type":"string"},"description":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"protocol":{"type":"string"},"servers_url":{"type":"string"},"tags":{"items":{"type":"string"},"type":"array","uniqueItems":false},"url":{"type":"string"}},"type":"object"},"config.SensitiveDataDetectionConfig":{"description":"Sensitive data detection settings (Spec 026)","properties":{"categories":{"additionalProperties":{"type":"boolean"},"description":"Enable/disable specific detection categories","type":"object"},"custom_patterns":{"description":"User-defined detection patterns","items":{"$ref":"#/components/schemas/config.CustomPattern"},"type":"array","uniqueItems":false},"enabled":{"description":"Enable sensitive data detection (default: true)","type":"boolean"},"entropy_threshold":{"description":"Shannon entropy threshold for high-entropy detection (default: 4.5)","type":"number"},"max_payload_size_kb":{"description":"Max size to scan before truncating (default: 1024)","type":"integer"},"scan_requests":{"description":"Scan tool call arguments (default: true)","type":"boolean"},"scan_responses":{"description":"Scan tool responses (default: true)","type":"boolean"},"sensitive_keywords":{"description":"Keywords to flag","items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"config.ServerConfig":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"command":{"type":"string"},"created":{"type":"string"},"enabled":{"type":"boolean"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"headers":{"additionalProperties":{"type":"string"},"description":"For HTTP servers","type":"object"},"isolation":{"$ref":"#/components/schemas/config.IsolationConfig"},"name":{"type":"string"},"oauth":{"$ref":"#/components/schemas/config.OAuthConfig"},"protocol":{"description":"stdio, http, sse, streamable-http, auto","type":"string"},"quarantined":{"description":"Security quarantine status","type":"boolean"},"shared":{"description":"Server edition: shared with all users","type":"boolean"},"skip_quarantine":{"description":"Skip tool-level quarantine for this server","type":"boolean"},"updated":{"type":"string"},"url":{"type":"string"},"working_dir":{"description":"Working directory for stdio servers","type":"string"}},"type":"object"},"config.TLSConfig":{"description":"TLS configuration","properties":{"certs_dir":{"description":"Directory for certificates","type":"string"},"enabled":{"description":"Enable HTTPS","type":"boolean"},"hsts":{"description":"Enable HTTP Strict Transport Security","type":"boolean"},"require_client_cert":{"description":"Enable mTLS","type":"boolean"}},"type":"object"},"config.TokenizerConfig":{"description":"Tokenizer configuration for token counting","properties":{"default_model":{"description":"Default model for tokenization (e.g., \"gpt-4\")","type":"string"},"enabled":{"description":"Enable token counting","type":"boolean"},"encoding":{"description":"Default encoding (e.g., \"cl100k_base\")","type":"string"}},"type":"object"},"configimport.FailedServer":{"properties":{"details":{"type":"string"},"error":{"type":"string"},"name":{"type":"string"}},"type":"object"},"configimport.ImportSummary":{"properties":{"failed":{"type":"integer"},"imported":{"type":"integer"},"skipped":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"configimport.SkippedServer":{"properties":{"name":{"type":"string"},"reason":{"description":"\"already_exists\", \"filtered_out\", \"invalid_name\"","type":"string"}},"type":"object"},"contracts.APIResponse":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.ActivityDetailResponse":{"properties":{"activity":{"$ref":"#/components/schemas/contracts.ActivityRecord"}},"type":"object"},"contracts.ActivityListResponse":{"properties":{"activities":{"items":{"$ref":"#/components/schemas/contracts.ActivityRecord"},"type":"array","uniqueItems":false},"limit":{"type":"integer"},"offset":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"contracts.ActivityRecord":{"properties":{"arguments":{"description":"Tool call arguments","type":"object"},"detection_types":{"description":"List of detection types found","items":{"type":"string"},"type":"array","uniqueItems":false},"duration_ms":{"description":"Execution duration in milliseconds","type":"integer"},"error_message":{"description":"Error details if status is \"error\"","type":"string"},"has_sensitive_data":{"description":"Sensitive data detection fields (Spec 026)","type":"boolean"},"id":{"description":"Unique identifier (ULID format)","type":"string"},"max_severity":{"description":"Highest severity level detected (critical, high, medium, low)","type":"string"},"metadata":{"description":"Additional context-specific data","type":"object"},"request_id":{"description":"HTTP request ID for correlation","type":"string"},"response":{"description":"Tool response (potentially truncated)","type":"string"},"response_truncated":{"description":"True if response was truncated","type":"boolean"},"server_name":{"description":"Name of upstream MCP server","type":"string"},"session_id":{"description":"MCP session ID for correlation","type":"string"},"source":{"$ref":"#/components/schemas/contracts.ActivitySource"},"status":{"description":"Result status: \"success\", \"error\", \"blocked\"","type":"string"},"timestamp":{"description":"When activity occurred","type":"string"},"tool_name":{"description":"Name of tool called","type":"string"},"type":{"$ref":"#/components/schemas/contracts.ActivityType"}},"type":"object"},"contracts.ActivitySource":{"description":"How activity was triggered: \"mcp\", \"cli\", \"api\"","type":"string","x-enum-varnames":["ActivitySourceMCP","ActivitySourceCLI","ActivitySourceAPI"]},"contracts.ActivitySummaryResponse":{"properties":{"blocked_count":{"description":"Count of blocked activities","type":"integer"},"end_time":{"description":"End of the period (RFC3339)","type":"string"},"error_count":{"description":"Count of error activities","type":"integer"},"period":{"description":"Time period (1h, 24h, 7d, 30d)","type":"string"},"start_time":{"description":"Start of the period (RFC3339)","type":"string"},"success_count":{"description":"Count of successful activities","type":"integer"},"top_servers":{"description":"Top servers by activity count","items":{"$ref":"#/components/schemas/contracts.ActivityTopServer"},"type":"array","uniqueItems":false},"top_tools":{"description":"Top tools by activity count","items":{"$ref":"#/components/schemas/contracts.ActivityTopTool"},"type":"array","uniqueItems":false},"total_count":{"description":"Total activity count","type":"integer"}},"type":"object"},"contracts.ActivityTopServer":{"properties":{"count":{"description":"Activity count","type":"integer"},"name":{"description":"Server name","type":"string"}},"type":"object"},"contracts.ActivityTopTool":{"properties":{"count":{"description":"Activity count","type":"integer"},"server":{"description":"Server name","type":"string"},"tool":{"description":"Tool name","type":"string"}},"type":"object"},"contracts.ActivityType":{"description":"Type of activity","type":"string","x-enum-varnames":["ActivityTypeToolCall","ActivityTypePolicyDecision","ActivityTypeQuarantineChange","ActivityTypeServerChange"]},"contracts.ConfigApplyResult":{"properties":{"applied_immediately":{"type":"boolean"},"changed_fields":{"items":{"type":"string"},"type":"array","uniqueItems":false},"requires_restart":{"type":"boolean"},"restart_reason":{"type":"string"},"success":{"type":"boolean"},"validation_errors":{"items":{"$ref":"#/components/schemas/contracts.ValidationError"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.DCRStatus":{"properties":{"attempted":{"type":"boolean"},"error":{"type":"string"},"status_code":{"type":"integer"},"success":{"type":"boolean"}},"type":"object"},"contracts.DeprecatedConfigWarning":{"properties":{"field":{"type":"string"},"message":{"type":"string"},"replacement":{"type":"string"}},"type":"object"},"contracts.Diagnostics":{"properties":{"deprecated_configs":{"description":"Deprecated config fields found","items":{"$ref":"#/components/schemas/contracts.DeprecatedConfigWarning"},"type":"array","uniqueItems":false},"docker_status":{"$ref":"#/components/schemas/contracts.DockerStatus"},"missing_secrets":{"description":"Renamed to avoid conflict","items":{"$ref":"#/components/schemas/contracts.MissingSecretInfo"},"type":"array","uniqueItems":false},"oauth_issues":{"description":"OAuth parameter mismatches","items":{"$ref":"#/components/schemas/contracts.OAuthIssue"},"type":"array","uniqueItems":false},"oauth_required":{"items":{"$ref":"#/components/schemas/contracts.OAuthRequirement"},"type":"array","uniqueItems":false},"runtime_warnings":{"items":{"type":"string"},"type":"array","uniqueItems":false},"timestamp":{"type":"string"},"total_issues":{"type":"integer"},"upstream_errors":{"items":{"$ref":"#/components/schemas/contracts.UpstreamError"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.DockerStatus":{"properties":{"available":{"type":"boolean"},"error":{"type":"string"},"version":{"type":"string"}},"type":"object"},"contracts.ErrorResponse":{"properties":{"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.GetConfigResponse":{"properties":{"config":{"description":"The configuration object","type":"object"},"config_path":{"description":"Path to config file","type":"string"}},"type":"object"},"contracts.GetRegistriesResponse":{"properties":{"registries":{"items":{"$ref":"#/components/schemas/contracts.Registry"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.GetServerLogsResponse":{"properties":{"count":{"type":"integer"},"logs":{"items":{"$ref":"#/components/schemas/contracts.LogEntry"},"type":"array","uniqueItems":false},"server_name":{"type":"string"}},"type":"object"},"contracts.GetServerToolCallsResponse":{"properties":{"server_name":{"type":"string"},"tool_calls":{"items":{"$ref":"#/components/schemas/contracts.ToolCallRecord"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.GetServerToolsResponse":{"properties":{"count":{"type":"integer"},"server_name":{"type":"string"},"tools":{"items":{"$ref":"#/components/schemas/contracts.Tool"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.GetServersResponse":{"properties":{"servers":{"items":{"$ref":"#/components/schemas/contracts.Server"},"type":"array","uniqueItems":false},"stats":{"$ref":"#/components/schemas/contracts.ServerStats"}},"type":"object"},"contracts.GetSessionDetailResponse":{"properties":{"session":{"$ref":"#/components/schemas/contracts.MCPSession"}},"type":"object"},"contracts.GetSessionsResponse":{"properties":{"limit":{"type":"integer"},"offset":{"type":"integer"},"sessions":{"items":{"$ref":"#/components/schemas/contracts.MCPSession"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.GetToolCallDetailResponse":{"properties":{"tool_call":{"$ref":"#/components/schemas/contracts.ToolCallRecord"}},"type":"object"},"contracts.GetToolCallsResponse":{"properties":{"limit":{"type":"integer"},"offset":{"type":"integer"},"tool_calls":{"items":{"$ref":"#/components/schemas/contracts.ToolCallRecord"},"type":"array","uniqueItems":false},"total":{"type":"integer"}},"type":"object"},"contracts.HealthStatus":{"description":"Unified health status calculated by the backend","properties":{"action":{"description":"Action is the suggested fix action: \"login\", \"restart\", \"enable\", \"approve\", \"view_logs\", \"set_secret\", \"configure\", or \"\" (none)","type":"string"},"admin_state":{"description":"AdminState indicates the admin state: \"enabled\", \"disabled\", or \"quarantined\"","type":"string"},"detail":{"description":"Detail is an optional longer explanation of the status","type":"string"},"level":{"description":"Level indicates the health level: \"healthy\", \"degraded\", or \"unhealthy\"","type":"string"},"summary":{"description":"Summary is a human-readable status message (e.g., \"Connected (5 tools)\")","type":"string"}},"type":"object"},"contracts.InfoEndpoints":{"description":"Available API endpoints","properties":{"http":{"description":"HTTP endpoint address (e.g., \"127.0.0.1:8080\")","type":"string"},"socket":{"description":"Unix socket path (empty if disabled)","type":"string"}},"type":"object"},"contracts.InfoResponse":{"properties":{"endpoints":{"$ref":"#/components/schemas/contracts.InfoEndpoints"},"listen_addr":{"description":"Listen address (e.g., \"127.0.0.1:8080\")","type":"string"},"update":{"$ref":"#/components/schemas/contracts.UpdateInfo"},"version":{"description":"Current MCPProxy version","type":"string"},"web_ui_url":{"description":"URL to access the web control panel","type":"string"}},"type":"object"},"contracts.IsolationConfig":{"properties":{"cpu_limit":{"type":"string"},"enabled":{"type":"boolean"},"image":{"type":"string"},"memory_limit":{"type":"string"},"timeout":{"type":"string"},"working_dir":{"type":"string"}},"type":"object"},"contracts.LogEntry":{"properties":{"fields":{"type":"object"},"level":{"type":"string"},"message":{"type":"string"},"server":{"type":"string"},"timestamp":{"type":"string"}},"type":"object"},"contracts.MCPSession":{"properties":{"client_name":{"type":"string"},"client_version":{"type":"string"},"end_time":{"type":"string"},"experimental":{"items":{"type":"string"},"type":"array","uniqueItems":false},"has_roots":{"description":"MCP Client Capabilities","type":"boolean"},"has_sampling":{"type":"boolean"},"id":{"type":"string"},"last_activity":{"type":"string"},"start_time":{"type":"string"},"status":{"type":"string"},"tool_call_count":{"type":"integer"},"total_tokens":{"type":"integer"}},"type":"object"},"contracts.MetadataStatus":{"properties":{"authorization_servers":{"items":{"type":"string"},"type":"array","uniqueItems":false},"error":{"type":"string"},"found":{"type":"boolean"},"url_checked":{"type":"string"}},"type":"object"},"contracts.MissingSecretInfo":{"properties":{"secret_name":{"type":"string"},"used_by":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"contracts.NPMPackageInfo":{"properties":{"exists":{"type":"boolean"},"install_cmd":{"type":"string"}},"type":"object"},"contracts.OAuthConfig":{"properties":{"auth_url":{"type":"string"},"client_id":{"type":"string"},"extra_params":{"additionalProperties":{"type":"string"},"type":"object"},"pkce_enabled":{"type":"boolean"},"redirect_port":{"type":"integer"},"scopes":{"items":{"type":"string"},"type":"array","uniqueItems":false},"token_expires_at":{"description":"When the OAuth token expires","type":"string"},"token_url":{"type":"string"},"token_valid":{"description":"Whether token is currently valid","type":"boolean"}},"type":"object"},"contracts.OAuthErrorDetails":{"description":"Structured discovery/failure details","properties":{"authorization_server_metadata":{"$ref":"#/components/schemas/contracts.MetadataStatus"},"dcr_status":{"$ref":"#/components/schemas/contracts.DCRStatus"},"protected_resource_metadata":{"$ref":"#/components/schemas/contracts.MetadataStatus"},"server_url":{"type":"string"}},"type":"object"},"contracts.OAuthFlowError":{"properties":{"correlation_id":{"description":"Flow tracking ID for log correlation","type":"string"},"debug_hint":{"description":"CLI command for log lookup","type":"string"},"details":{"$ref":"#/components/schemas/contracts.OAuthErrorDetails"},"error_code":{"description":"Machine-readable error code (e.g., OAUTH_NO_METADATA)","type":"string"},"error_type":{"description":"Category of OAuth runtime failure","type":"string"},"message":{"description":"Human-readable error description","type":"string"},"request_id":{"description":"HTTP request ID (from PR #237)","type":"string"},"server_name":{"description":"Server that failed OAuth","type":"string"},"success":{"description":"Always false","type":"boolean"},"suggestion":{"description":"Actionable remediation hint","type":"string"}},"type":"object"},"contracts.OAuthIssue":{"properties":{"documentation_url":{"type":"string"},"error":{"type":"string"},"issue":{"type":"string"},"missing_params":{"items":{"type":"string"},"type":"array","uniqueItems":false},"resolution":{"type":"string"},"server_name":{"type":"string"}},"type":"object"},"contracts.OAuthRequirement":{"properties":{"expires_at":{"type":"string"},"message":{"type":"string"},"server_name":{"type":"string"},"state":{"type":"string"}},"type":"object"},"contracts.OAuthStartResponse":{"properties":{"auth_url":{"description":"Authorization URL (always included for manual use)","type":"string"},"browser_error":{"description":"Error message if browser launch failed","type":"string"},"browser_opened":{"description":"Whether browser launch succeeded","type":"boolean"},"correlation_id":{"description":"UUID for tracking this flow","type":"string"},"message":{"description":"Human-readable status message","type":"string"},"server_name":{"description":"Name of the server being authenticated","type":"string"},"success":{"description":"Always true for successful start","type":"boolean"}},"type":"object"},"contracts.Registry":{"properties":{"count":{"description":"number or string","type":"string"},"description":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"protocol":{"type":"string"},"servers_url":{"type":"string"},"tags":{"items":{"type":"string"},"type":"array","uniqueItems":false},"url":{"type":"string"}},"type":"object"},"contracts.ReplayToolCallRequest":{"properties":{"arguments":{"description":"Modified arguments for replay","type":"object"}},"type":"object"},"contracts.ReplayToolCallResponse":{"properties":{"error":{"description":"Error if replay failed","type":"string"},"new_call_id":{"description":"ID of the newly created call","type":"string"},"new_tool_call":{"$ref":"#/components/schemas/contracts.ToolCallRecord"},"replayed_from":{"description":"Original call ID","type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.RepositoryInfo":{"description":"Detected package info","properties":{"npm":{"$ref":"#/components/schemas/contracts.NPMPackageInfo"}},"type":"object"},"contracts.RepositoryServer":{"properties":{"connect_url":{"description":"Alternative connection URL","type":"string"},"created_at":{"type":"string"},"description":{"type":"string"},"id":{"type":"string"},"install_cmd":{"description":"Installation command","type":"string"},"name":{"type":"string"},"registry":{"description":"Which registry this came from","type":"string"},"repository_info":{"$ref":"#/components/schemas/contracts.RepositoryInfo"},"source_code_url":{"description":"Source repository URL","type":"string"},"updated_at":{"type":"string"},"url":{"description":"MCP endpoint for remote servers only","type":"string"}},"type":"object"},"contracts.SearchRegistryServersResponse":{"properties":{"query":{"type":"string"},"registry_id":{"type":"string"},"servers":{"items":{"$ref":"#/components/schemas/contracts.RepositoryServer"},"type":"array","uniqueItems":false},"tag":{"type":"string"},"total":{"type":"integer"}},"type":"object"},"contracts.SearchResult":{"properties":{"matches":{"type":"integer"},"score":{"type":"number"},"snippet":{"type":"string"},"tool":{"$ref":"#/components/schemas/contracts.Tool"}},"type":"object"},"contracts.SearchToolsResponse":{"properties":{"query":{"type":"string"},"results":{"items":{"$ref":"#/components/schemas/contracts.SearchResult"},"type":"array","uniqueItems":false},"took":{"type":"string"},"total":{"type":"integer"}},"type":"object"},"contracts.Server":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"authenticated":{"description":"OAuth authentication status","type":"boolean"},"command":{"type":"string"},"connected":{"type":"boolean"},"connected_at":{"type":"string"},"connecting":{"type":"boolean"},"created":{"type":"string"},"enabled":{"type":"boolean"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"headers":{"additionalProperties":{"type":"string"},"type":"object"},"health":{"$ref":"#/components/schemas/contracts.HealthStatus"},"id":{"type":"string"},"isolation":{"$ref":"#/components/schemas/contracts.IsolationConfig"},"last_error":{"type":"string"},"last_reconnect_at":{"type":"string"},"last_retry_time":{"type":"string"},"name":{"type":"string"},"oauth":{"$ref":"#/components/schemas/contracts.OAuthConfig"},"oauth_status":{"description":"OAuth status: \"authenticated\", \"expired\", \"error\", \"none\"","type":"string"},"protocol":{"type":"string"},"quarantined":{"type":"boolean"},"reconnect_count":{"type":"integer"},"retry_count":{"type":"integer"},"should_retry":{"type":"boolean"},"status":{"type":"string"},"token_expires_at":{"description":"When the OAuth token expires (ISO 8601)","type":"string"},"tool_count":{"type":"integer"},"tool_list_token_size":{"description":"Token size for this server's tools","type":"integer"},"updated":{"type":"string"},"url":{"type":"string"},"user_logged_out":{"description":"True if user explicitly logged out (prevents auto-reconnection)","type":"boolean"},"working_dir":{"type":"string"}},"type":"object"},"contracts.ServerActionResponse":{"properties":{"action":{"type":"string"},"async":{"type":"boolean"},"server":{"type":"string"},"success":{"type":"boolean"}},"type":"object"},"contracts.ServerStats":{"properties":{"connected_servers":{"type":"integer"},"docker_containers":{"type":"integer"},"quarantined_servers":{"type":"integer"},"token_metrics":{"$ref":"#/components/schemas/contracts.ServerTokenMetrics"},"total_servers":{"type":"integer"},"total_tools":{"type":"integer"}},"type":"object"},"contracts.ServerTokenMetrics":{"properties":{"average_query_result_size":{"description":"Typical retrieve_tools output (tokens)","type":"integer"},"per_server_tool_list_sizes":{"additionalProperties":{"type":"integer"},"description":"Token size per server","type":"object"},"saved_tokens":{"description":"Difference","type":"integer"},"saved_tokens_percentage":{"description":"Percentage saved","type":"number"},"total_server_tool_list_size":{"description":"All upstream tools combined (tokens)","type":"integer"}},"type":"object"},"contracts.SuccessResponse":{"properties":{"data":{"type":"object"},"success":{"type":"boolean"}},"type":"object"},"contracts.TokenMetrics":{"description":"Token usage metrics (nil for older records)","properties":{"encoding":{"description":"Encoding used (e.g., cl100k_base)","type":"string"},"estimated_cost":{"description":"Optional cost estimate","type":"number"},"input_tokens":{"description":"Tokens in the request","type":"integer"},"model":{"description":"Model used for tokenization","type":"string"},"output_tokens":{"description":"Tokens in the response","type":"integer"},"total_tokens":{"description":"Total tokens (input + output)","type":"integer"},"truncated_tokens":{"description":"Tokens removed by truncation","type":"integer"},"was_truncated":{"description":"Whether response was truncated","type":"boolean"}},"type":"object"},"contracts.Tool":{"properties":{"annotations":{"$ref":"#/components/schemas/contracts.ToolAnnotation"},"description":{"type":"string"},"last_used":{"type":"string"},"name":{"type":"string"},"schema":{"type":"object"},"server_name":{"type":"string"},"usage":{"type":"integer"}},"type":"object"},"contracts.ToolAnnotation":{"description":"Tool behavior hints snapshot","properties":{"destructiveHint":{"type":"boolean"},"idempotentHint":{"type":"boolean"},"openWorldHint":{"type":"boolean"},"readOnlyHint":{"type":"boolean"},"title":{"type":"string"}},"type":"object"},"contracts.ToolCallRecord":{"description":"The new tool call record","properties":{"annotations":{"$ref":"#/components/schemas/contracts.ToolAnnotation"},"arguments":{"description":"Tool arguments","type":"object"},"config_path":{"description":"Active config file path","type":"string"},"duration":{"description":"Duration in nanoseconds","type":"integer"},"error":{"description":"Error message (failure only)","type":"string"},"execution_type":{"description":"\"direct\" or \"code_execution\"","type":"string"},"id":{"description":"Unique identifier","type":"string"},"mcp_client_name":{"description":"MCP client name from InitializeRequest","type":"string"},"mcp_client_version":{"description":"MCP client version","type":"string"},"mcp_session_id":{"description":"MCP session identifier","type":"string"},"metrics":{"$ref":"#/components/schemas/contracts.TokenMetrics"},"parent_call_id":{"description":"Links nested calls to parent code_execution","type":"string"},"request_id":{"description":"Request correlation ID","type":"string"},"response":{"description":"Tool response (success only)","type":"object"},"server_id":{"description":"Server identity hash","type":"string"},"server_name":{"description":"Human-readable server name","type":"string"},"timestamp":{"description":"When the call was made","type":"string"},"tool_name":{"description":"Tool name (without server prefix)","type":"string"}},"type":"object"},"contracts.UpdateInfo":{"description":"Update information (if available)","properties":{"available":{"description":"Whether an update is available","type":"boolean"},"check_error":{"description":"Error message if update check failed","type":"string"},"checked_at":{"description":"When the update check was performed","type":"string"},"is_prerelease":{"description":"Whether the latest version is a prerelease","type":"boolean"},"latest_version":{"description":"Latest version available (e.g., \"v1.2.3\")","type":"string"},"release_url":{"description":"URL to the release page","type":"string"}},"type":"object"},"contracts.UpstreamError":{"properties":{"error_message":{"type":"string"},"server_name":{"type":"string"},"timestamp":{"type":"string"}},"type":"object"},"contracts.ValidateConfigResponse":{"properties":{"errors":{"items":{"$ref":"#/components/schemas/contracts.ValidationError"},"type":"array","uniqueItems":false},"valid":{"type":"boolean"}},"type":"object"},"contracts.ValidationError":{"properties":{"field":{"type":"string"},"message":{"type":"string"}},"type":"object"},"data":{"properties":{"data":{"$ref":"#/components/schemas/contracts.InfoResponse"}},"type":"object"},"httpapi.AddServerRequest":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"command":{"type":"string"},"enabled":{"type":"boolean"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"headers":{"additionalProperties":{"type":"string"},"type":"object"},"name":{"type":"string"},"protocol":{"type":"string"},"quarantined":{"type":"boolean"},"url":{"type":"string"},"working_dir":{"type":"string"}},"type":"object"},"httpapi.CanonicalConfigPath":{"properties":{"description":{"description":"Brief description","type":"string"},"exists":{"description":"Whether the file exists","type":"boolean"},"format":{"description":"Format identifier (e.g., \"claude_desktop\")","type":"string"},"name":{"description":"Display name (e.g., \"Claude Desktop\")","type":"string"},"os":{"description":"Operating system (darwin, windows, linux)","type":"string"},"path":{"description":"Full path to the config file","type":"string"}},"type":"object"},"httpapi.CanonicalConfigPathsResponse":{"properties":{"os":{"description":"Current operating system","type":"string"},"paths":{"description":"List of canonical config paths","items":{"$ref":"#/components/schemas/httpapi.CanonicalConfigPath"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportFromPathRequest":{"properties":{"format":{"description":"Optional format hint","type":"string"},"path":{"description":"File path to import from","type":"string"},"server_names":{"description":"Optional: import only these servers","items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportRequest":{"properties":{"content":{"description":"Raw JSON or TOML content","type":"string"},"format":{"description":"Optional format hint","type":"string"},"server_names":{"description":"Optional: import only these servers","items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportResponse":{"properties":{"failed":{"items":{"$ref":"#/components/schemas/configimport.FailedServer"},"type":"array","uniqueItems":false},"format":{"type":"string"},"format_name":{"type":"string"},"imported":{"items":{"$ref":"#/components/schemas/httpapi.ImportedServerResponse"},"type":"array","uniqueItems":false},"skipped":{"items":{"$ref":"#/components/schemas/configimport.SkippedServer"},"type":"array","uniqueItems":false},"summary":{"$ref":"#/components/schemas/configimport.ImportSummary"},"warnings":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"httpapi.ImportedServerResponse":{"properties":{"args":{"items":{"type":"string"},"type":"array","uniqueItems":false},"command":{"type":"string"},"fields_skipped":{"items":{"type":"string"},"type":"array","uniqueItems":false},"name":{"type":"string"},"original_name":{"type":"string"},"protocol":{"type":"string"},"source_format":{"type":"string"},"url":{"type":"string"},"warnings":{"items":{"type":"string"},"type":"array","uniqueItems":false}},"type":"object"},"management.BulkOperationResult":{"properties":{"errors":{"additionalProperties":{"type":"string"},"description":"Map of server name to error message","type":"object"},"failed":{"description":"Number of failed operations","type":"integer"},"successful":{"description":"Number of successful operations","type":"integer"},"total":{"description":"Total servers processed","type":"integer"}},"type":"object"},"observability.HealthResponse":{"properties":{"components":{"items":{"$ref":"#/components/schemas/observability.HealthStatus"},"type":"array","uniqueItems":false},"status":{"description":"\"healthy\" or \"unhealthy\"","type":"string"},"timestamp":{"type":"string"}},"type":"object"},"observability.HealthStatus":{"properties":{"error":{"type":"string"},"latency":{"type":"string"},"name":{"type":"string"},"status":{"description":"\"healthy\" or \"unhealthy\"","type":"string"}},"type":"object"},"observability.ReadinessResponse":{"properties":{"components":{"items":{"$ref":"#/components/schemas/observability.HealthStatus"},"type":"array","uniqueItems":false},"status":{"description":"\"ready\" or \"not_ready\"","type":"string"},"timestamp":{"type":"string"}},"type":"object"},"secureenv.EnvConfig":{"description":"Environment configuration for secure variable filtering","properties":{"allowed_system_vars":{"items":{"type":"string"},"type":"array","uniqueItems":false},"custom_vars":{"additionalProperties":{"type":"string"},"type":"object"},"enhance_path":{"description":"Enable PATH enhancement for Launchd scenarios","type":"boolean"},"inherit_system_safe":{"type":"boolean"}},"type":"object"}},"securitySchemes":{"ApiKeyAuth":{"description":"API key authentication via query parameter. Use ?apikey=your-key","in":"query","name":"apikey","type":"apiKey"}}},
"info": {"contact":{"name":"MCPProxy Support","url":"https://github.com/smart-mcp-proxy/mcpproxy-go"},"description":"{{escape .Description}}","license":{"name":"MIT","url":"https://opensource.org/licenses/MIT"},"title":"{{.Title}}","version":"{{.Version}}"},
"externalDocs": {"description":"","url":""},
- "paths": {"/api/v1/activity":{"get":{"description":"Returns paginated list of activity records with optional filtering","parameters":[{"description":"Filter by activity type(s), comma-separated for multiple (Spec 024)","in":"query","name":"type","schema":{"enum":["tool_call","policy_decision","quarantine_change","server_change","system_start","system_stop","internal_tool_call","config_change"],"type":"string"}},{"description":"Filter by server name","in":"query","name":"server","schema":{"type":"string"}},{"description":"Filter by tool name","in":"query","name":"tool","schema":{"type":"string"}},{"description":"Filter by MCP session ID","in":"query","name":"session_id","schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"enum":["success","error","blocked"],"type":"string"}},{"description":"Filter by intent operation type (Spec 018)","in":"query","name":"intent_type","schema":{"enum":["read","write","destructive"],"type":"string"}},{"description":"Filter by HTTP request ID for log correlation (Spec 021)","in":"query","name":"request_id","schema":{"type":"string"}},{"description":"Include successful call_tool_* internal tool calls (default: false, excluded to avoid duplicates)","in":"query","name":"include_call_tool","schema":{"type":"boolean"}},{"description":"Filter by sensitive data detection (true=has detections, false=no detections)","in":"query","name":"sensitive_data","schema":{"type":"boolean"}},{"description":"Filter by specific detection type (e.g., 'aws_access_key', 'credit_card')","in":"query","name":"detection_type","schema":{"type":"string"}},{"description":"Filter by severity level","in":"query","name":"severity","schema":{"enum":["critical","high","medium","low"],"type":"string"}},{"description":"Filter by agent token name (Spec 028)","in":"query","name":"agent","schema":{"type":"string"}},{"description":"Filter by auth type (Spec 028)","in":"query","name":"auth_type","schema":{"enum":["admin","agent"],"type":"string"}},{"description":"Filter activities after this time (RFC3339)","in":"query","name":"start_time","schema":{"type":"string"}},{"description":"Filter activities before this time (RFC3339)","in":"query","name":"end_time","schema":{"type":"string"}},{"description":"Maximum records to return (1-100, default 50)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Pagination offset (default 0)","in":"query","name":"offset","schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"List activity records","tags":["Activity"]}},"/api/v1/activity/export":{"get":{"description":"Exports activity records in JSON Lines or CSV format for compliance","parameters":[{"description":"Export format: json (default) or csv","in":"query","name":"format","schema":{"type":"string"}},{"description":"Filter by activity type","in":"query","name":"type","schema":{"type":"string"}},{"description":"Filter by server name","in":"query","name":"server","schema":{"type":"string"}},{"description":"Filter by tool name","in":"query","name":"tool","schema":{"type":"string"}},{"description":"Filter by MCP session ID","in":"query","name":"session_id","schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"type":"string"}},{"description":"Filter activities after this time (RFC3339)","in":"query","name":"start_time","schema":{"type":"string"}},{"description":"Filter activities before this time (RFC3339)","in":"query","name":"end_time","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"string"}},"application/x-ndjson":{"schema":{"type":"string"}},"text/csv":{"schema":{"type":"string"}}},"description":"Streamed activity records"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"Export activity records","tags":["Activity"]}},"/api/v1/activity/summary":{"get":{"description":"Returns aggregated activity statistics for a time period","parameters":[{"description":"Time period: 1h, 24h (default), 7d, 30d","in":"query","name":"period","schema":{"type":"string"}},{"description":"Group by: server, tool (optional)","in":"query","name":"group_by","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"Get activity summary statistics","tags":["Activity"]}},"/api/v1/activity/{id}":{"get":{"description":"Returns full details for a single activity record","parameters":[{"description":"Activity record ID (ULID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"Get activity record details","tags":["Activity"]}},"/api/v1/config":{"get":{"description":"Retrieves the current MCPProxy configuration including all server definitions, global settings, and runtime parameters","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetConfigResponse"}}},"description":"Configuration retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get configuration"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get current configuration","tags":["config"]}},"/api/v1/config/apply":{"post":{"description":"Applies a new MCPProxy configuration. Validates and persists the configuration to disk. Some changes apply immediately, while others may require a restart. Returns detailed information about applied changes and restart requirements.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/config.Config"}}},"description":"Configuration to apply","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ConfigApplyResult"}}},"description":"Configuration applied successfully with change details"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Invalid JSON payload"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to apply configuration"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Apply configuration","tags":["config"]}},"/api/v1/config/validate":{"post":{"description":"Validates a provided MCPProxy configuration without applying it. Checks for syntax errors, invalid server definitions, conflicting settings, and other configuration issues.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/config.Config"}}},"description":"Configuration to validate","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ValidateConfigResponse"}}},"description":"Configuration validation result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Invalid JSON payload"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Validation failed"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Validate configuration","tags":["config"]}},"/api/v1/diagnostics":{"get":{"description":"Get comprehensive health diagnostics including upstream errors, OAuth requirements, missing secrets, and Docker status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.Diagnostics"}}},"description":"Health diagnostics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get health diagnostics","tags":["diagnostics"]}},"/api/v1/docker/status":{"get":{"description":"Retrieve current Docker availability and recovery status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Docker status information"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get Docker status","tags":["docker"]}},"/api/v1/doctor":{"get":{"description":"Get comprehensive health diagnostics including upstream errors, OAuth requirements, missing secrets, and Docker status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.Diagnostics"}}},"description":"Health diagnostics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get health diagnostics","tags":["diagnostics"]}},"/api/v1/index/search":{"get":{"description":"Search across all upstream MCP server tools using BM25 keyword search","parameters":[{"description":"Search query","in":"query","name":"q","required":true,"schema":{"type":"string"}},{"description":"Maximum number of results","in":"query","name":"limit","schema":{"default":10,"maximum":100,"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SearchToolsResponse"}}},"description":"Search results"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing query parameter)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Search for tools","tags":["tools"]}},"/api/v1/info":{"get":{"description":"Get essential server metadata including version, web UI URL, endpoint addresses, and update availability\nThis endpoint is designed for tray-core communication and version checking\nUse refresh=true query parameter to force an immediate update check against GitHub","parameters":[{"description":"Force immediate update check against GitHub","in":"query","name":"refresh","schema":{"type":"boolean"}}],"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"Server information with optional update info"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get server information","tags":["status"]}},"/api/v1/registries":{"get":{"description":"Retrieves list of all MCP server registries that can be browsed for discovering and installing new upstream servers. Includes registry metadata, server counts, and API endpoints.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetRegistriesResponse"}}},"description":"Registries retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to list registries"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"List available MCP server registries","tags":["registries"]}},"/api/v1/registries/{id}/servers":{"get":{"description":"Searches for MCP servers within a specific registry by keyword or tag. Returns server metadata including installation commands, source code URLs, and npm package information for easy discovery and installation.","parameters":[{"description":"Registry ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Search query keyword","in":"query","name":"q","schema":{"type":"string"}},{"description":"Filter by tag","in":"query","name":"tag","schema":{"type":"string"}},{"description":"Maximum number of results (default 10)","in":"query","name":"limit","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SearchRegistryServersResponse"}}},"description":"Servers retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Registry ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to search servers"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Search MCP servers in a registry","tags":["registries"]}},"/api/v1/secrets":{"post":{"description":"Stores a secret value in the operating system's secure keyring. The secret can then be referenced in configuration using ${keyring:secret-name} syntax. Automatically notifies runtime to restart affected servers.","requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{},"type":"object"}}},"description":"Secret stored successfully with reference syntax"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Invalid JSON payload, missing name/value, or unsupported type"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Secret resolver not available or failed to store secret"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Store a secret in OS keyring","tags":["secrets"]}},"/api/v1/secrets/{name}":{"delete":{"description":"Deletes a secret from the operating system's secure keyring. Automatically notifies runtime to restart affected servers. Only keyring type is supported for security.","parameters":[{"description":"Name of the secret to delete","in":"path","name":"name","required":true,"schema":{"type":"string"}},{"description":"Secret type (only 'keyring' supported, defaults to 'keyring')","in":"query","name":"type","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{},"type":"object"}}},"description":"Secret deleted successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Missing secret name or unsupported type"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Secret resolver not available or failed to delete secret"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Delete a secret from OS keyring","tags":["secrets"]}},"/api/v1/servers":{"get":{"description":"Get a list of all configured upstream MCP servers with their connection status and statistics","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServersResponse"}}},"description":"Server list with statistics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"List all upstream MCP servers","tags":["servers"]},"post":{"description":"Add a new MCP upstream server to the configuration. New servers are quarantined by default for security.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.AddServerRequest"}}},"description":"Server configuration","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server added successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid configuration"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Conflict - server with this name already exists"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Add a new upstream server","tags":["servers"]}},"/api/v1/servers/disable_all":{"post":{"description":"Disable all configured upstream MCP servers with partial failure handling","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/management.BulkOperationResult"}}},"description":"Bulk disable results with success/failure counts"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Disable all servers","tags":["servers"]}},"/api/v1/servers/enable_all":{"post":{"description":"Enable all configured upstream MCP servers with partial failure handling","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/management.BulkOperationResult"}}},"description":"Bulk enable results with success/failure counts"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Enable all servers","tags":["servers"]}},"/api/v1/servers/import":{"post":{"description":"Import MCP server configurations from a Claude Desktop, Claude Code, Cursor IDE, Codex CLI, or Gemini CLI configuration file","parameters":[{"description":"If true, return preview without importing","in":"query","name":"preview","schema":{"type":"boolean"}},{"description":"Force format (claude-desktop, claude-code, cursor, codex, gemini)","in":"query","name":"format","schema":{"type":"string"}},{"description":"Comma-separated list of server names to import","in":"query","name":"server_names","schema":{"type":"string"}}],"requestBody":{"content":{"multipart/form-data":{"schema":{"type":"file"}}},"description":"Configuration file to import","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportResponse"}}},"description":"Import result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid file or format"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Import servers from uploaded configuration file","tags":["servers"]}},"/api/v1/servers/import/json":{"post":{"description":"Import MCP server configurations from raw JSON or TOML content (useful for pasting configurations)","parameters":[{"description":"If true, return preview without importing","in":"query","name":"preview","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportRequest"}}},"description":"Import request with content","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportResponse"}}},"description":"Import result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid content or format"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Import servers from JSON/TOML content","tags":["servers"]}},"/api/v1/servers/import/path":{"post":{"description":"Import MCP server configurations by reading a file from the server's filesystem","parameters":[{"description":"If true, return preview without importing","in":"query","name":"preview","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportFromPathRequest"}}},"description":"Import request with file path","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportResponse"}}},"description":"Import result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid path or format"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"File not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Import servers from a file path","tags":["servers"]}},"/api/v1/servers/import/paths":{"get":{"description":"Returns well-known configuration file paths for supported formats with existence check","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.CanonicalConfigPathsResponse"}}},"description":"Canonical config paths"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get canonical config file paths","tags":["servers"]}},"/api/v1/servers/reconnect":{"post":{"description":"Force reconnection to all upstream MCP servers","parameters":[{"description":"Reason for reconnection","in":"query","name":"reason","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"All servers reconnected successfully"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Reconnect all servers","tags":["servers"]}},"/api/v1/servers/restart_all":{"post":{"description":"Restart all configured upstream MCP servers sequentially with partial failure handling","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/management.BulkOperationResult"}}},"description":"Bulk restart results with success/failure counts"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Restart all servers","tags":["servers"]}},"/api/v1/servers/{id}":{"delete":{"description":"Remove an MCP upstream server from the configuration. This stops the server if running and removes it from config.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server removed successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Remove an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/disable":{"post":{"description":"Disable a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server disabled successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Disable an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/discover-tools":{"post":{"description":"Manually trigger tool discovery and indexing for a specific upstream MCP server. This forces an immediate refresh of the server's tool cache.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Tool discovery triggered successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to discover tools"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Discover tools for a specific server","tags":["servers"]}},"/api/v1/servers/{id}/enable":{"post":{"description":"Enable a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server enabled successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Enable an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/login":{"post":{"description":"Initiate OAuth authentication flow for a specific upstream MCP server. Returns structured OAuth start response with correlation ID for tracking.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.OAuthStartResponse"}}},"description":"OAuth login initiated successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.OAuthFlowError"}}},"description":"OAuth error (client_id required, DCR failed, etc.)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Trigger OAuth login for server","tags":["servers"]}},"/api/v1/servers/{id}/logout":{"post":{"description":"Clear OAuth authentication token and disconnect a specific upstream MCP server. The server will need to re-authenticate before tools can be used again.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"OAuth logout completed successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled or read-only mode)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Clear OAuth token and disconnect server","tags":["servers"]}},"/api/v1/servers/{id}/logs":{"get":{"description":"Retrieve log entries for a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Number of log lines to retrieve","in":"query","name":"tail","schema":{"default":100,"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServerLogsResponse"}}},"description":"Server logs retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get server logs","tags":["servers"]}},"/api/v1/servers/{id}/quarantine":{"post":{"description":"Place a specific upstream MCP server in quarantine to prevent tool execution","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server quarantined successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Quarantine a server","tags":["servers"]}},"/api/v1/servers/{id}/restart":{"post":{"description":"Restart the connection to a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server restarted successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Restart an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/tool-calls":{"get":{"description":"Retrieves tool call history filtered by upstream server ID. Returns recent tool executions for the specified server including timestamps, arguments, results, and errors. Useful for server-specific debugging and monitoring.","parameters":[{"description":"Upstream server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Maximum number of records to return (1-100, default 50)","in":"query","name":"limit","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServerToolCallsResponse"}}},"description":"Server tool calls retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get server tool calls"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tool call history for specific server","tags":["tool-calls"]}},"/api/v1/servers/{id}/tools":{"get":{"description":"Retrieve all available tools for a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServerToolsResponse"}}},"description":"Server tools retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tools for a server","tags":["servers"]}},"/api/v1/servers/{id}/unquarantine":{"post":{"description":"Remove a specific upstream MCP server from quarantine to allow tool execution","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server unquarantined successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Unquarantine a server","tags":["servers"]}},"/api/v1/sessions":{"get":{"description":"Retrieves paginated list of active and recent MCP client sessions. Each session represents a connection from an MCP client to MCPProxy, tracking initialization time, tool calls, and connection status.","parameters":[{"description":"Maximum number of sessions to return (1-100, default 10)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of sessions to skip for pagination (default 0)","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetSessionsResponse"}}},"description":"Sessions retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get sessions"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get active MCP sessions","tags":["sessions"]}},"/api/v1/sessions/{id}":{"get":{"description":"Retrieves detailed information about a specific MCP client session including initialization parameters, connection status, tool call count, and activity timestamps.","parameters":[{"description":"Session ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetSessionDetailResponse"}}},"description":"Session details retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Session ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Session not found"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get MCP session details by ID","tags":["sessions"]}},"/api/v1/stats/tokens":{"get":{"description":"Retrieve token savings statistics across all servers and sessions","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Token statistics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get token savings statistics","tags":["stats"]}},"/api/v1/status":{"get":{"description":"Get comprehensive server status including running state, listen address, upstream statistics, and timestamp","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Server status information"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get server status","tags":["status"]}},"/api/v1/tool-calls":{"get":{"description":"Retrieves paginated tool call history across all upstream servers or filtered by session ID. Includes execution timestamps, arguments, results, and error information for debugging and auditing.","parameters":[{"description":"Maximum number of records to return (1-100, default 50)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of records to skip for pagination (default 0)","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Filter tool calls by MCP session ID","in":"query","name":"session_id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetToolCallsResponse"}}},"description":"Tool calls retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get tool calls"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tool call history","tags":["tool-calls"]}},"/api/v1/tool-calls/{id}":{"get":{"description":"Retrieves detailed information about a specific tool call execution including full request arguments, response data, execution time, and any errors encountered.","parameters":[{"description":"Tool call ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetToolCallDetailResponse"}}},"description":"Tool call details retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Tool call ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Tool call not found"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tool call details by ID","tags":["tool-calls"]}},"/api/v1/tool-calls/{id}/replay":{"post":{"description":"Re-executes a previous tool call with optional modified arguments. Useful for debugging and testing tool behavior with different inputs. Creates a new tool call record linked to the original.","parameters":[{"description":"Original tool call ID to replay","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ReplayToolCallRequest"}}},"description":"Optional modified arguments for replay"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ReplayToolCallResponse"}}},"description":"Tool call replayed successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Tool call ID required or invalid JSON payload"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to replay tool call"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Replay a tool call","tags":["tool-calls"]}},"/api/v1/tools/call":{"post":{"description":"Execute a tool on an upstream MCP server (wrapper around MCP tool calls)","requestBody":{"content":{"application/json":{"schema":{"properties":{"arguments":{"type":"object"},"tool_name":{"type":"string"}},"type":"object"}}},"description":"Tool call request with tool name and arguments","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Tool call result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (invalid payload or missing tool name)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error or tool execution failure"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Call a tool","tags":["tools"]}},"/healthz":{"get":{"description":"Get comprehensive health status including all component health (Kubernetes-compatible liveness probe)","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.HealthResponse"}}},"description":"Service is healthy"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.HealthResponse"}}},"description":"Service is unhealthy"}},"summary":"Get health status","tags":["health"]}},"/readyz":{"get":{"description":"Get readiness status including all component readiness checks (Kubernetes-compatible readiness probe)","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.ReadinessResponse"}}},"description":"Service is ready"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.ReadinessResponse"}}},"description":"Service is not ready"}},"summary":"Get readiness status","tags":["health"]}}},
+ "paths": {"/api/v1/activity":{"get":{"description":"Returns paginated list of activity records with optional filtering","parameters":[{"description":"Filter by activity type(s), comma-separated for multiple (Spec 024)","in":"query","name":"type","schema":{"enum":["tool_call","policy_decision","quarantine_change","server_change","system_start","system_stop","internal_tool_call","config_change"],"type":"string"}},{"description":"Filter by server name","in":"query","name":"server","schema":{"type":"string"}},{"description":"Filter by tool name","in":"query","name":"tool","schema":{"type":"string"}},{"description":"Filter by MCP session ID","in":"query","name":"session_id","schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"enum":["success","error","blocked"],"type":"string"}},{"description":"Filter by intent operation type (Spec 018)","in":"query","name":"intent_type","schema":{"enum":["read","write","destructive"],"type":"string"}},{"description":"Filter by HTTP request ID for log correlation (Spec 021)","in":"query","name":"request_id","schema":{"type":"string"}},{"description":"Include successful call_tool_* internal tool calls (default: false, excluded to avoid duplicates)","in":"query","name":"include_call_tool","schema":{"type":"boolean"}},{"description":"Filter by sensitive data detection (true=has detections, false=no detections)","in":"query","name":"sensitive_data","schema":{"type":"boolean"}},{"description":"Filter by specific detection type (e.g., 'aws_access_key', 'credit_card')","in":"query","name":"detection_type","schema":{"type":"string"}},{"description":"Filter by severity level","in":"query","name":"severity","schema":{"enum":["critical","high","medium","low"],"type":"string"}},{"description":"Filter by agent token name (Spec 028)","in":"query","name":"agent","schema":{"type":"string"}},{"description":"Filter by auth type (Spec 028)","in":"query","name":"auth_type","schema":{"enum":["admin","agent"],"type":"string"}},{"description":"Filter activities after this time (RFC3339)","in":"query","name":"start_time","schema":{"type":"string"}},{"description":"Filter activities before this time (RFC3339)","in":"query","name":"end_time","schema":{"type":"string"}},{"description":"Maximum records to return (1-100, default 50)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Pagination offset (default 0)","in":"query","name":"offset","schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"List activity records","tags":["Activity"]}},"/api/v1/activity/export":{"get":{"description":"Exports activity records in JSON Lines or CSV format for compliance","parameters":[{"description":"Export format: json (default) or csv","in":"query","name":"format","schema":{"type":"string"}},{"description":"Filter by activity type","in":"query","name":"type","schema":{"type":"string"}},{"description":"Filter by server name","in":"query","name":"server","schema":{"type":"string"}},{"description":"Filter by tool name","in":"query","name":"tool","schema":{"type":"string"}},{"description":"Filter by MCP session ID","in":"query","name":"session_id","schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"type":"string"}},{"description":"Filter activities after this time (RFC3339)","in":"query","name":"start_time","schema":{"type":"string"}},{"description":"Filter activities before this time (RFC3339)","in":"query","name":"end_time","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"string"}},"application/x-ndjson":{"schema":{"type":"string"}},"text/csv":{"schema":{"type":"string"}}},"description":"Streamed activity records"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"Export activity records","tags":["Activity"]}},"/api/v1/activity/summary":{"get":{"description":"Returns aggregated activity statistics for a time period","parameters":[{"description":"Time period: 1h, 24h (default), 7d, 30d","in":"query","name":"period","schema":{"type":"string"}},{"description":"Group by: server, tool (optional)","in":"query","name":"group_by","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"Get activity summary statistics","tags":["Activity"]}},"/api/v1/activity/{id}":{"get":{"description":"Returns full details for a single activity record","parameters":[{"description":"Activity record ID (ULID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.APIResponse"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"summary":"Get activity record details","tags":["Activity"]}},"/api/v1/config":{"get":{"description":"Retrieves the current MCPProxy configuration including all server definitions, global settings, and runtime parameters","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetConfigResponse"}}},"description":"Configuration retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get configuration"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get current configuration","tags":["config"]}},"/api/v1/config/apply":{"post":{"description":"Applies a new MCPProxy configuration. Validates and persists the configuration to disk. Some changes apply immediately, while others may require a restart. Returns detailed information about applied changes and restart requirements.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/config.Config"}}},"description":"Configuration to apply","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ConfigApplyResult"}}},"description":"Configuration applied successfully with change details"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Invalid JSON payload"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to apply configuration"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Apply configuration","tags":["config"]}},"/api/v1/config/validate":{"post":{"description":"Validates a provided MCPProxy configuration without applying it. Checks for syntax errors, invalid server definitions, conflicting settings, and other configuration issues.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/config.Config"}}},"description":"Configuration to validate","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ValidateConfigResponse"}}},"description":"Configuration validation result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Invalid JSON payload"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Validation failed"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Validate configuration","tags":["config"]}},"/api/v1/diagnostics":{"get":{"description":"Get comprehensive health diagnostics including upstream errors, OAuth requirements, missing secrets, and Docker status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.Diagnostics"}}},"description":"Health diagnostics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get health diagnostics","tags":["diagnostics"]}},"/api/v1/docker/status":{"get":{"description":"Retrieve current Docker availability and recovery status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Docker status information"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get Docker status","tags":["docker"]}},"/api/v1/doctor":{"get":{"description":"Get comprehensive health diagnostics including upstream errors, OAuth requirements, missing secrets, and Docker status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.Diagnostics"}}},"description":"Health diagnostics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get health diagnostics","tags":["diagnostics"]}},"/api/v1/index/search":{"get":{"description":"Search across all upstream MCP server tools using BM25 keyword search","parameters":[{"description":"Search query","in":"query","name":"q","required":true,"schema":{"type":"string"}},{"description":"Maximum number of results","in":"query","name":"limit","schema":{"default":10,"maximum":100,"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SearchToolsResponse"}}},"description":"Search results"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing query parameter)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Search for tools","tags":["tools"]}},"/api/v1/info":{"get":{"description":"Get essential server metadata including version, web UI URL, endpoint addresses, and update availability\nThis endpoint is designed for tray-core communication and version checking\nUse refresh=true query parameter to force an immediate update check against GitHub","parameters":[{"description":"Force immediate update check against GitHub","in":"query","name":"refresh","schema":{"type":"boolean"}}],"responses":{"200":{"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/data"}],"properties":{"data":{"type":"object"},"error":{"type":"string"},"request_id":{"type":"string"},"success":{"type":"boolean"}},"type":"object"}}},"description":"Server information with optional update info"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get server information","tags":["status"]}},"/api/v1/registries":{"get":{"description":"Retrieves list of all MCP server registries that can be browsed for discovering and installing new upstream servers. Includes registry metadata, server counts, and API endpoints.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetRegistriesResponse"}}},"description":"Registries retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to list registries"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"List available MCP server registries","tags":["registries"]}},"/api/v1/registries/{id}/servers":{"get":{"description":"Searches for MCP servers within a specific registry by keyword or tag. Returns server metadata including installation commands, source code URLs, and npm package information for easy discovery and installation.","parameters":[{"description":"Registry ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Search query keyword","in":"query","name":"q","schema":{"type":"string"}},{"description":"Filter by tag","in":"query","name":"tag","schema":{"type":"string"}},{"description":"Maximum number of results (default 10)","in":"query","name":"limit","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SearchRegistryServersResponse"}}},"description":"Servers retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Registry ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to search servers"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Search MCP servers in a registry","tags":["registries"]}},"/api/v1/routing":{"get":{"description":"Get the current routing mode and available MCP endpoints","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Routing mode information"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get routing mode information","tags":["status"]}},"/api/v1/secrets":{"post":{"description":"Stores a secret value in the operating system's secure keyring. The secret can then be referenced in configuration using ${keyring:secret-name} syntax. Automatically notifies runtime to restart affected servers.","requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{},"type":"object"}}},"description":"Secret stored successfully with reference syntax"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Invalid JSON payload, missing name/value, or unsupported type"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Secret resolver not available or failed to store secret"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Store a secret in OS keyring","tags":["secrets"]}},"/api/v1/secrets/{name}":{"delete":{"description":"Deletes a secret from the operating system's secure keyring. Automatically notifies runtime to restart affected servers. Only keyring type is supported for security.","parameters":[{"description":"Name of the secret to delete","in":"path","name":"name","required":true,"schema":{"type":"string"}},{"description":"Secret type (only 'keyring' supported, defaults to 'keyring')","in":"query","name":"type","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{},"type":"object"}}},"description":"Secret deleted successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Missing secret name or unsupported type"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Secret resolver not available or failed to delete secret"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Delete a secret from OS keyring","tags":["secrets"]}},"/api/v1/servers":{"get":{"description":"Get a list of all configured upstream MCP servers with their connection status and statistics","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServersResponse"}}},"description":"Server list with statistics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"List all upstream MCP servers","tags":["servers"]},"post":{"description":"Add a new MCP upstream server to the configuration. New servers are quarantined by default for security.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.AddServerRequest"}}},"description":"Server configuration","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server added successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid configuration"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Conflict - server with this name already exists"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Add a new upstream server","tags":["servers"]}},"/api/v1/servers/disable_all":{"post":{"description":"Disable all configured upstream MCP servers with partial failure handling","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/management.BulkOperationResult"}}},"description":"Bulk disable results with success/failure counts"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Disable all servers","tags":["servers"]}},"/api/v1/servers/enable_all":{"post":{"description":"Enable all configured upstream MCP servers with partial failure handling","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/management.BulkOperationResult"}}},"description":"Bulk enable results with success/failure counts"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Enable all servers","tags":["servers"]}},"/api/v1/servers/import":{"post":{"description":"Import MCP server configurations from a Claude Desktop, Claude Code, Cursor IDE, Codex CLI, or Gemini CLI configuration file","parameters":[{"description":"If true, return preview without importing","in":"query","name":"preview","schema":{"type":"boolean"}},{"description":"Force format (claude-desktop, claude-code, cursor, codex, gemini)","in":"query","name":"format","schema":{"type":"string"}},{"description":"Comma-separated list of server names to import","in":"query","name":"server_names","schema":{"type":"string"}}],"requestBody":{"content":{"multipart/form-data":{"schema":{"type":"file"}}},"description":"Configuration file to import","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportResponse"}}},"description":"Import result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid file or format"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Import servers from uploaded configuration file","tags":["servers"]}},"/api/v1/servers/import/json":{"post":{"description":"Import MCP server configurations from raw JSON or TOML content (useful for pasting configurations)","parameters":[{"description":"If true, return preview without importing","in":"query","name":"preview","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportRequest"}}},"description":"Import request with content","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportResponse"}}},"description":"Import result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid content or format"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Import servers from JSON/TOML content","tags":["servers"]}},"/api/v1/servers/import/path":{"post":{"description":"Import MCP server configurations by reading a file from the server's filesystem","parameters":[{"description":"If true, return preview without importing","in":"query","name":"preview","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportFromPathRequest"}}},"description":"Import request with file path","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.ImportResponse"}}},"description":"Import result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request - invalid path or format"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"File not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Import servers from a file path","tags":["servers"]}},"/api/v1/servers/import/paths":{"get":{"description":"Returns well-known configuration file paths for supported formats with existence check","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/httpapi.CanonicalConfigPathsResponse"}}},"description":"Canonical config paths"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get canonical config file paths","tags":["servers"]}},"/api/v1/servers/reconnect":{"post":{"description":"Force reconnection to all upstream MCP servers","parameters":[{"description":"Reason for reconnection","in":"query","name":"reason","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"All servers reconnected successfully"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Reconnect all servers","tags":["servers"]}},"/api/v1/servers/restart_all":{"post":{"description":"Restart all configured upstream MCP servers sequentially with partial failure handling","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/management.BulkOperationResult"}}},"description":"Bulk restart results with success/failure counts"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Restart all servers","tags":["servers"]}},"/api/v1/servers/{id}":{"delete":{"description":"Remove an MCP upstream server from the configuration. This stops the server if running and removes it from config.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server removed successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Remove an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/disable":{"post":{"description":"Disable a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server disabled successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Disable an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/discover-tools":{"post":{"description":"Manually trigger tool discovery and indexing for a specific upstream MCP server. This forces an immediate refresh of the server's tool cache.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Tool discovery triggered successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to discover tools"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Discover tools for a specific server","tags":["servers"]}},"/api/v1/servers/{id}/enable":{"post":{"description":"Enable a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server enabled successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Enable an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/login":{"post":{"description":"Initiate OAuth authentication flow for a specific upstream MCP server. Returns structured OAuth start response with correlation ID for tracking.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.OAuthStartResponse"}}},"description":"OAuth login initiated successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.OAuthFlowError"}}},"description":"OAuth error (client_id required, DCR failed, etc.)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Trigger OAuth login for server","tags":["servers"]}},"/api/v1/servers/{id}/logout":{"post":{"description":"Clear OAuth authentication token and disconnect a specific upstream MCP server. The server will need to re-authenticate before tools can be used again.","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"OAuth logout completed successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Forbidden (management disabled or read-only mode)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Clear OAuth token and disconnect server","tags":["servers"]}},"/api/v1/servers/{id}/logs":{"get":{"description":"Retrieve log entries for a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Number of log lines to retrieve","in":"query","name":"tail","schema":{"default":100,"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServerLogsResponse"}}},"description":"Server logs retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get server logs","tags":["servers"]}},"/api/v1/servers/{id}/quarantine":{"post":{"description":"Place a specific upstream MCP server in quarantine to prevent tool execution","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server quarantined successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Quarantine a server","tags":["servers"]}},"/api/v1/servers/{id}/restart":{"post":{"description":"Restart the connection to a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server restarted successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Restart an upstream server","tags":["servers"]}},"/api/v1/servers/{id}/tool-calls":{"get":{"description":"Retrieves tool call history filtered by upstream server ID. Returns recent tool executions for the specified server including timestamps, arguments, results, and errors. Useful for server-specific debugging and monitoring.","parameters":[{"description":"Upstream server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Maximum number of records to return (1-100, default 50)","in":"query","name":"limit","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServerToolCallsResponse"}}},"description":"Server tool calls retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get server tool calls"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tool call history for specific server","tags":["tool-calls"]}},"/api/v1/servers/{id}/tools":{"get":{"description":"Retrieve all available tools for a specific upstream MCP server","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetServerToolsResponse"}}},"description":"Server tools retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tools for a server","tags":["servers"]}},"/api/v1/servers/{id}/unquarantine":{"post":{"description":"Remove a specific upstream MCP server from quarantine to allow tool execution","parameters":[{"description":"Server ID or name","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ServerActionResponse"}}},"description":"Server unquarantined successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (missing server ID)"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Server not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Unquarantine a server","tags":["servers"]}},"/api/v1/sessions":{"get":{"description":"Retrieves paginated list of active and recent MCP client sessions. Each session represents a connection from an MCP client to MCPProxy, tracking initialization time, tool calls, and connection status.","parameters":[{"description":"Maximum number of sessions to return (1-100, default 10)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of sessions to skip for pagination (default 0)","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetSessionsResponse"}}},"description":"Sessions retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get sessions"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get active MCP sessions","tags":["sessions"]}},"/api/v1/sessions/{id}":{"get":{"description":"Retrieves detailed information about a specific MCP client session including initialization parameters, connection status, tool call count, and activity timestamps.","parameters":[{"description":"Session ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetSessionDetailResponse"}}},"description":"Session details retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Session ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Session not found"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get MCP session details by ID","tags":["sessions"]}},"/api/v1/stats/tokens":{"get":{"description":"Retrieve token savings statistics across all servers and sessions","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Token statistics"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get token savings statistics","tags":["stats"]}},"/api/v1/status":{"get":{"description":"Get comprehensive server status including running state, listen address, upstream statistics, and timestamp","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Server status information"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get server status","tags":["status"]}},"/api/v1/tool-calls":{"get":{"description":"Retrieves paginated tool call history across all upstream servers or filtered by session ID. Includes execution timestamps, arguments, results, and error information for debugging and auditing.","parameters":[{"description":"Maximum number of records to return (1-100, default 50)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of records to skip for pagination (default 0)","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Filter tool calls by MCP session ID","in":"query","name":"session_id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetToolCallsResponse"}}},"description":"Tool calls retrieved successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to get tool calls"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tool call history","tags":["tool-calls"]}},"/api/v1/tool-calls/{id}":{"get":{"description":"Retrieves detailed information about a specific tool call execution including full request arguments, response data, execution time, and any errors encountered.","parameters":[{"description":"Tool call ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.GetToolCallDetailResponse"}}},"description":"Tool call details retrieved successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Tool call ID required"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Tool call not found"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Get tool call details by ID","tags":["tool-calls"]}},"/api/v1/tool-calls/{id}/replay":{"post":{"description":"Re-executes a previous tool call with optional modified arguments. Useful for debugging and testing tool behavior with different inputs. Creates a new tool call record linked to the original.","parameters":[{"description":"Original tool call ID to replay","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ReplayToolCallRequest"}}},"description":"Optional modified arguments for replay"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ReplayToolCallResponse"}}},"description":"Tool call replayed successfully"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Tool call ID required or invalid JSON payload"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Unauthorized - missing or invalid API key"},"405":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Method not allowed"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Failed to replay tool call"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Replay a tool call","tags":["tool-calls"]}},"/api/v1/tools/call":{"post":{"description":"Execute a tool on an upstream MCP server (wrapper around MCP tool calls)","requestBody":{"content":{"application/json":{"schema":{"properties":{"arguments":{"type":"object"},"tool_name":{"type":"string"}},"type":"object"}}},"description":"Tool call request with tool name and arguments","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.SuccessResponse"}}},"description":"Tool call result"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Bad request (invalid payload or missing tool name)"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/contracts.ErrorResponse"}}},"description":"Internal server error or tool execution failure"}},"security":[{"ApiKeyAuth":[]},{"ApiKeyQuery":[]}],"summary":"Call a tool","tags":["tools"]}},"/healthz":{"get":{"description":"Get comprehensive health status including all component health (Kubernetes-compatible liveness probe)","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.HealthResponse"}}},"description":"Service is healthy"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.HealthResponse"}}},"description":"Service is unhealthy"}},"summary":"Get health status","tags":["health"]}},"/readyz":{"get":{"description":"Get readiness status including all component readiness checks (Kubernetes-compatible readiness probe)","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.ReadinessResponse"}}},"description":"Service is ready"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/observability.ReadinessResponse"}}},"description":"Service is not ready"}},"summary":"Get readiness status","tags":["health"]}}},
"openapi": "3.1.0"
}`
diff --git a/oas/swagger.yaml b/oas/swagger.yaml
index 9b729e85..74c13dc4 100644
--- a/oas/swagger.yaml
+++ b/oas/swagger.yaml
@@ -94,6 +94,11 @@ components:
require_mcp_auth:
description: 'Require authentication on /mcp endpoint (default: false)'
type: boolean
+ routing_mode:
+ description: |-
+ Routing mode (Spec 031): how MCP tools are exposed to clients
+ Valid values: "retrieve_tools" (default), "direct", "code_execution"
+ type: string
sensitive_data_detection:
$ref: '#/components/schemas/config.SensitiveDataDetectionConfig'
tls:
@@ -2522,6 +2527,22 @@ paths:
summary: Search MCP servers in a registry
tags:
- registries
+ /api/v1/routing:
+ get:
+ description: Get the current routing mode and available MCP endpoints
+ responses:
+ "200":
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/contracts.SuccessResponse'
+ description: Routing mode information
+ security:
+ - ApiKeyAuth: []
+ - ApiKeyQuery: []
+ summary: Get routing mode information
+ tags:
+ - status
/api/v1/secrets:
post:
description: Stores a secret value in the operating system's secure keyring.
diff --git a/web/frontend/dist/assets/Activity-3jsAMS7R.js b/web/frontend/dist/assets/Activity-3jsAMS7R.js
new file mode 100644
index 00000000..38cf46a2
--- /dev/null
+++ b/web/frontend/dist/assets/Activity-3jsAMS7R.js
@@ -0,0 +1 @@
+import{d as Be,e as Ve,r as v,f as C,s as ie,c as o,o as l,a as t,t as n,n as g,j as y,E as Ke,_ as Qe,x as Ge,A as We,I as Xe,g as r,m as x,M as je,l as ae,L as le,F as B,p as V,y as N,B as Ye,v as Le,i as Y,w as Ee,k as Ze,z as oe,h as et}from"./index-DMP0eryo.js";const tt={class:"json-viewer-container"},st={class:"flex justify-between items-start mb-2"},at={class:"text-xs text-base-content/60"},lt=["title"],ot={key:0,class:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},nt={key:1,class:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},it=["innerHTML"],rt=Be({__name:"JsonViewer",props:{data:{},maxHeight:{default:"24rem"}},setup(re){const H=re,z=Ve(),b=v(!1);let _=null;const M=C(()=>{try{return JSON.stringify(H.data,null,2)}catch{return String(H.data)}}),F=C(()=>new Blob([M.value]).size.toLocaleString()),i=C(()=>{let m=M.value;return m=m.replace(/&/g,"&").replace(//g,">"),m=m.replace(/("(?:[^"\\]|\\.)*")\s*:/g,'$1:').replace(/:\s*("(?:[^"\\]|\\.)*")/g,': $1').replace(/:\s*(-?\d+\.?\d*)/g,': $1').replace(/:\s*(true|false)/g,': $1').replace(/:\s*(null)/g,': $1'),m}),I=async()=>{try{await navigator.clipboard.writeText(M.value),b.value=!0,z.addToast({type:"success",title:"Copied!",message:"JSON copied to clipboard"}),_&&clearTimeout(_),_=setTimeout(()=>{b.value=!1},2e3)}catch{z.addToast({type:"error",title:"Copy Failed",message:"Failed to copy to clipboard"})}};return ie(()=>H.data,()=>{b.value=!1,_&&clearTimeout(_)}),(m,c)=>(l(),o("div",tt,[t("div",st,[t("div",at,n(F.value)+" bytes ",1),t("button",{onClick:I,class:g(["btn btn-xs btn-ghost gap-1",{"btn-success":b.value}]),title:b.value?"Copied!":"Copy to clipboard"},[b.value?(l(),o("svg",nt,[...c[1]||(c[1]=[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M5 13l4 4L19 7"},null,-1)])])):(l(),o("svg",ot,[...c[0]||(c[0]=[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z"},null,-1)])])),y(" "+n(b.value?"Copied!":"Copy"),1)],10,lt)]),t("pre",{class:"json-viewer bg-base-300 p-3 rounded text-xs overflow-auto w-full",style:Ke({maxHeight:m.maxHeight}),innerHTML:i.value},null,12,it)]))}}),ne=Qe(rt,[["__scopeId","data-v-919a3d3e"]]),dt={class:"space-y-6"},ut={class:"flex flex-wrap justify-between items-start gap-4"},ct={class:"flex items-center gap-4"},vt={class:"form-control"},pt={class:"label cursor-pointer gap-2"},mt={class:"flex items-center gap-2"},bt=["disabled"],gt={key:0,class:"stats shadow bg-base-100 w-full"},_t={class:"stat"},xt={class:"stat-value text-2xl"},yt={class:"stat"},ft={class:"stat-value text-2xl text-success"},ht={class:"stat"},kt={class:"stat-value text-2xl text-error"},wt={class:"stat"},Ct={class:"stat-value text-2xl text-warning"},St={class:"card bg-base-100 shadow-md"},At={class:"card-body py-4"},Tt={class:"flex flex-wrap gap-4 items-end"},Dt={class:"form-control min-w-[180px]"},Mt={class:"dropdown dropdown-bottom"},$t={tabindex:"0",role:"button",class:"select select-bordered select-sm w-full text-left flex items-center justify-between"},jt={key:0},Lt={key:1},Et={key:2,class:"truncate"},Bt={tabindex:"0",class:"dropdown-content z-[10] menu p-2 shadow-lg bg-base-200 rounded-box w-56"},Vt={class:"menu-title flex flex-row justify-between items-center"},Nt={class:"label cursor-pointer justify-start gap-2 py-1"},Ft=["checked","onChange"],It={class:"text-lg"},Ut={class:"form-control min-w-[150px]"},zt=["value"],Jt={class:"form-control min-w-[120px]"},Ot={class:"form-control min-w-[120px]"},Rt={key:0,class:"form-control min-w-[150px]"},Ht=["value"],Pt={class:"form-control min-w-[140px]"},qt={key:1,class:"form-control min-w-[120px]"},Kt={class:"form-control min-w-[180px]"},Qt=["value"],Gt={class:"form-control min-w-[160px]"},Wt={class:"form-control min-w-[160px]"},Xt={class:"dropdown dropdown-end"},Yt={tabindex:"0",class:"dropdown-content z-[1] menu p-2 shadow-lg bg-base-200 rounded-box w-40"},Zt={key:0,class:"flex flex-wrap gap-2 mt-2 pt-2 border-t border-base-300"},es=["onClick"],ts={key:0,class:"badge badge-sm badge-outline"},ss={key:1,class:"badge badge-sm badge-outline"},as={key:2,class:"badge badge-sm badge-outline"},ls={key:3,class:"badge badge-sm badge-outline"},os={key:4,class:"badge badge-sm badge-outline"},ns={key:5,class:"badge badge-sm badge-outline"},is={key:6,class:"badge badge-sm badge-outline"},rs={key:7,class:"badge badge-sm badge-outline"},ds={key:8,class:"badge badge-sm badge-outline"},us={class:"card bg-base-100 shadow-md"},cs={class:"card-body"},vs={key:0,class:"flex justify-center py-12"},ps={key:1,class:"alert alert-error"},ms={key:2,class:"text-center py-12 text-base-content/60"},bs={class:"text-lg"},gs={class:"text-sm mt-1"},_s={key:3,class:"overflow-x-auto"},xs={class:"table table-sm"},ys=["onClick"],fs={class:"text-sm"},hs={class:"text-xs text-base-content/60"},ks={class:"flex items-center gap-2"},ws={class:"text-lg"},Cs={class:"text-sm"},Ss={key:1,class:"text-base-content/40"},As={class:"max-w-xs truncate"},Ts={key:0,class:"text-sm bg-base-200 px-2 py-1 rounded"},Ds={key:1,class:"text-sm"},Ms={key:2,class:"text-base-content/40"},$s=["data-tip"],js={key:1,class:"text-base-content/40"},Ls=["data-tip"],Es={key:1,class:"text-base-content/40"},Bs={key:0,class:"text-sm"},Vs={key:1,class:"text-base-content/40"},Ns=["onClick"],Fs={key:0,class:"flex justify-between items-center mt-4 pt-4 border-t border-base-300"},Is={class:"text-sm text-base-content/60"},Us={class:"join"},zs=["disabled"],Js=["disabled"],Os={class:"join-item btn btn-sm"},Rs=["disabled"],Hs=["disabled"],Ps={class:"form-control"},qs={class:"drawer drawer-end"},Ks={class:"drawer-side z-50"},Qs={class:"bg-base-100 w-[500px] min-h-full p-6"},Gs={key:0,class:"space-y-4"},Ws={class:"flex justify-between items-start"},Xs={class:"text-lg font-bold flex items-center gap-2"},Ys={class:"text-2xl"},Zs={class:"text-sm text-base-content/60"},ea={class:"flex items-center gap-2"},ta={class:"space-y-3"},sa={key:0,class:"flex gap-2"},aa={class:"text-xs bg-base-200 px-2 py-1 rounded break-all"},la={key:1,class:"flex gap-2"},oa={key:2,class:"flex gap-2"},na={class:"text-sm bg-base-200 px-2 py-1 rounded"},ia={key:3,class:"flex gap-2"},ra={class:"text-sm"},da={key:4,class:"flex gap-2"},ua={class:"text-xs bg-base-200 px-2 py-1 rounded"},ca={key:5,class:"flex gap-2"},va={class:"badge badge-sm badge-outline"},pa={key:0},ma={class:"font-semibold mb-2 text-warning flex items-center gap-2"},ba={class:"flex flex-col gap-2 w-full text-inherit"},ga={class:"flex items-center gap-2"},_a={key:0,class:"flex flex-col gap-1"},xa={class:"flex flex-wrap gap-1"},ya={key:1,class:"flex flex-col gap-1"},fa={class:"text-sm space-y-1"},ha={class:"font-mono text-xs text-inherit"},ka={class:"text-inherit/70 text-xs"},wa={key:0,class:"badge badge-xs badge-ghost"},Ca={key:1},Sa={class:"alert alert-warning"},Aa={class:"flex flex-col gap-2 w-full"},Ta={class:"flex items-center gap-2"},Da={class:"badge badge-warning"},Ma={key:0,class:"flex flex-col gap-1"},$a={class:"text-sm"},ja={key:1,class:"flex flex-col gap-1"},La={class:"text-sm"},Ea={key:2,class:"text-sm italic"},Ba={key:2},Va={key:3},Na={class:"font-semibold mb-2 flex items-center gap-2"},Fa={key:0,class:"badge badge-sm badge-warning"},Ia={key:4},Ua={class:"alert alert-error"},za={class:"text-sm break-words"},Ja={key:5},Oa={class:"bg-base-200 rounded p-3 space-y-2"},Ra={key:0,class:"flex gap-2"},Ha={key:1,class:"flex gap-2"},Pa={class:"text-sm"},qa={key:2,class:"flex gap-2"},Ka={class:"text-sm"},Qa={key:6},Wa=Be({__name:"Activity",setup(re){const H=We(),z=Ve(),b=v([]),_=v(null),M=v(!1),F=v(null),i=v(null),I=v(!1),m=v(!0),c=v([]),S=v(""),$=v(""),A=v(""),f=v(""),j=v(""),h=v(""),T=v(""),L=v(""),E=v(""),de=[{value:"tool_call",label:"Tool Call",icon:"🔧"},{value:"system_start",label:"System Start",icon:"🚀"},{value:"system_stop",label:"System Stop",icon:"🛑"},{value:"internal_tool_call",label:"Internal Tool Call",icon:"⚙️"},{value:"config_change",label:"Config Change",icon:"⚡"},{value:"policy_decision",label:"Policy Decision",icon:"🛡️"},{value:"quarantine_change",label:"Quarantine Change",icon:"⚠️"},{value:"server_change",label:"Server Change",icon:"🔄"}],p=v(1),U=v(25),G=v("timestamp"),P=v("desc"),Ne=C(()=>{const s=new Set;return b.value.forEach(e=>{e.server_name&&s.add(e.server_name)}),Array.from(s).sort()}),Fe=C(()=>{const s=new Set;return b.value.forEach(e=>{var u;const d=(u=e.metadata)==null?void 0:u._auth_agent_name;d&&s.add(d)}),Array.from(s).sort()}),ue=C(()=>{const s=new Map;return b.value.forEach(e=>{var d;if(e.session_id&&!s.has(e.session_id)){const u=(d=e.metadata)==null?void 0:d.client_name;s.set(e.session_id,{clientName:u})}}),Array.from(s.entries()).map(([e,d])=>{const u=e.slice(-5),D=d.clientName?`${d.clientName} ...${u}`:`...${u}`;return{id:e,label:D,clientName:d.clientName}}).sort((e,d)=>e.label.localeCompare(d.label))}),Ie=s=>{const e=ue.value.find(d=>d.id===s);return(e==null?void 0:e.label)||`...${s.slice(-5)}`},W=C(()=>c.value.length>0||S.value||$.value||A.value||f.value||j.value||h.value||T.value||L.value||E.value),ce=C(()=>{let s=b.value;if(c.value.length>0&&(s=s.filter(e=>c.value.includes(e.type))),S.value&&(s=s.filter(e=>e.server_name===S.value)),$.value&&(s=s.filter(e=>e.session_id===$.value)),A.value&&(s=s.filter(e=>e.status===A.value)),f.value==="true"?s=s.filter(e=>e.has_sensitive_data===!0):f.value==="false"&&(s=s.filter(e=>!e.has_sensitive_data)),j.value&&f.value==="true"&&(s=s.filter(e=>e.max_severity===j.value)),h.value&&(s=s.filter(e=>{var d;return((d=e.metadata)==null?void 0:d._auth_auth_type)===h.value})),T.value&&(s=s.filter(e=>{var d;return((d=e.metadata)==null?void 0:d._auth_agent_name)===T.value})),L.value){const e=new Date(L.value).getTime();s=s.filter(d=>new Date(d.timestamp).getTime()>=e)}if(E.value){const e=new Date(E.value).getTime();s=s.filter(d=>new Date(d.timestamp).getTime()<=e)}return s}),X=C(()=>{const s=[...ce.value],e=G.value,d=P.value;return s.sort((u,D)=>{let k,w;return e==="timestamp"?(k=new Date(u.timestamp).getTime(),w=new Date(D.timestamp).getTime()):e==="duration_ms"?(k=u.duration_ms??0,w=D.duration_ms??0):(k=u[e]??"",w=D[e]??""),typeof k=="string"&&typeof w=="string"?d==="asc"?k.localeCompare(w):w.localeCompare(k):d==="asc"?k-w:w-k}),s}),J=C(()=>Math.ceil(X.value.length/U.value)),Ue=C(()=>{const s=(p.value-1)*U.value;return X.value.slice(s,s+U.value)}),q=async()=>{M.value=!0,F.value=null;try{const[s,e]=await Promise.all([oe.getActivities({limit:200}),oe.getActivitySummary("24h")]);s.success&&s.data?b.value=s.data.activities||[]:F.value=s.error||"Failed to load activities",e.success&&e.data&&(_.value=e.data)}catch(s){F.value=s instanceof Error?s.message:"Unknown error"}finally{M.value=!1}},ze=()=>{c.value=[],S.value="",$.value="",A.value="",f.value="",j.value="",h.value="",T.value="",L.value="",E.value="",p.value=1},ve=s=>{const e=c.value.indexOf(s);e>=0?c.value.splice(e,1):c.value.push(s)},Je=()=>{c.value=[]},K=s=>{G.value===s?P.value=P.value==="asc"?"desc":"asc":(G.value=s,P.value=s==="timestamp"||s==="duration_ms"?"desc":"asc")},Q=s=>G.value!==s?"":P.value==="asc"?"↑":"↓",pe=s=>{i.value=s,I.value=!0},me=()=>{I.value=!1,i.value=null},be=s=>{const e=oe.getActivityExportUrl({format:s,type:c.value.length>0?c.value.join(","):void 0,server:S.value||void 0,status:A.value||void 0});window.open(e,"_blank")},O=s=>{if(!m.value)return;const e=s.detail;e&&(e.server_name||e.tool_name||e.type||e.internal_tool_name||e.action||e.version||e.reason)&&(console.log("Activity event received, refreshing from API:",e),q())},ge=s=>{if(!m.value)return;const e=s.detail;e&&(e.server_name||e.tool_name||e.status||e.internal_tool_name||e.target_server)&&(console.log("Activity completed event received, refreshing from API:",e),q())},_e=s=>new Date(s).toLocaleString(),Oe=s=>{const e=Date.now(),d=new Date(s).getTime(),u=e-d;return u<1e3?"Just now":u<6e4?`${Math.floor(u/1e3)}s ago`:u<36e5?`${Math.floor(u/6e4)}m ago`:u<864e5?`${Math.floor(u/36e5)}h ago`:`${Math.floor(u/864e5)}d ago`},Z=s=>({tool_call:"Tool Call",system_start:"System Start",system_stop:"System Stop",internal_tool_call:"Internal Tool Call",config_change:"Config Change",policy_decision:"Policy Decision",quarantine_change:"Quarantine Change",server_change:"Server Change"})[s]||s,ee=s=>({tool_call:"🔧",system_start:"🚀",system_stop:"🛑",internal_tool_call:"⚙️",config_change:"⚡",policy_decision:"🛡️",quarantine_change:"⚠️",server_change:"🔄"})[s]||"📋",xe=s=>({success:"Success",error:"Error",blocked:"Blocked"})[s]||s,ye=s=>({success:"badge-success",error:"badge-error",blocked:"badge-warning"})[s]||"badge-ghost",fe=s=>s<1e3?`${Math.round(s)}ms`:`${(s/1e3).toFixed(2)}s`,Re=s=>{if(typeof s=="object")return s;try{return JSON.parse(s)}catch{return s}},te=s=>({critical:"☢️",high:"⚠️",medium:"⚡",low:"ℹ️"})[s||""]||"⚠️",se=s=>({critical:"badge-error",high:"badge-warning",medium:"badge-info",low:"badge-ghost"})[s||""]||"badge-warning",he=s=>({read:"📖",write:"✏️",destructive:"⚠️"})[s]||"❓",ke=s=>({read:"badge-info",write:"badge-warning",destructive:"badge-error"})[s]||"badge-ghost",He=s=>{if(!s.metadata)return!1;const e=["intent","decision","reason","policy_rule"];return Object.keys(s.metadata).filter(u=>!e.includes(u)).length>0},Pe=s=>{if(!s.metadata)return{};const e=["intent","decision","reason","policy_rule"],d={};for(const[u,D]of Object.entries(s.metadata))e.includes(u)||(d[u]=D);return d};ie([c,S,A,f,j,h,T,L,E],()=>{p.value=1},{deep:!0}),ie(h,s=>{s!=="agent"&&(T.value="")});const we=s=>{s.key==="Escape"&&I.value&&me()};return Ge(()=>{const s=H.query.session;s&&($.value=s),q(),window.addEventListener("mcpproxy:activity",O),window.addEventListener("mcpproxy:activity-started",O),window.addEventListener("mcpproxy:activity-completed",ge),window.addEventListener("mcpproxy:activity-policy",O),window.addEventListener("keydown",we)}),Xe(()=>{window.removeEventListener("mcpproxy:activity",O),window.removeEventListener("mcpproxy:activity-started",O),window.removeEventListener("mcpproxy:activity-completed",ge),window.removeEventListener("mcpproxy:activity-policy",O),window.removeEventListener("keydown",we)}),(s,e)=>{var u,D,k,w,Ce;const d=Ze("router-link");return l(),o("div",dt,[t("div",ut,[e[26]||(e[26]=t("div",null,[t("h1",{class:"text-3xl font-bold"},"Activity Log"),t("p",{class:"text-base-content/70 mt-1"},"Monitor and analyze all activity across your MCP servers")],-1)),t("div",ct,[t("div",vt,[t("label",pt,[e[24]||(e[24]=t("span",{class:"label-text text-sm"},"Auto-refresh",-1)),x(t("input",{type:"checkbox","onUpdate:modelValue":e[0]||(e[0]=a=>m.value=a),class:"toggle toggle-sm toggle-primary"},null,512),[[je,m.value]])])]),t("div",mt,[t("div",{class:g(["badge",ae(z).connected?"badge-success":"badge-error"])},[t("span",{class:g(["w-2 h-2 rounded-full mr-1",ae(z).connected?"bg-success animate-pulse":"bg-error"])},null,2),y(" "+n(ae(z).connected?"Live":"Disconnected"),1)],2)]),m.value?r("",!0):(l(),o("button",{key:0,onClick:q,class:"btn btn-sm btn-ghost",disabled:M.value},[(l(),o("svg",{class:g(["w-4 h-4",{"animate-spin":M.value}]),fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[...e[25]||(e[25]=[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"},null,-1)])],2))],8,bt))])]),_.value?(l(),o("div",gt,[t("div",_t,[e[27]||(e[27]=t("div",{class:"stat-title"},"Total (24h)",-1)),t("div",xt,n(_.value.total_count),1)]),t("div",yt,[e[28]||(e[28]=t("div",{class:"stat-title"},"Success",-1)),t("div",ft,n(_.value.success_count),1)]),t("div",ht,[e[29]||(e[29]=t("div",{class:"stat-title"},"Errors",-1)),t("div",kt,n(_.value.error_count),1)]),t("div",wt,[e[30]||(e[30]=t("div",{class:"stat-title"},"Blocked",-1)),t("div",Ct,n(_.value.blocked_count),1)])])):r("",!0),t("div",St,[t("div",At,[t("div",Tt,[t("div",Dt,[e[33]||(e[33]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Type")],-1)),t("div",Mt,[t("div",$t,[c.value.length===0?(l(),o("span",jt,"All Types")):c.value.length===de.length?(l(),o("span",Lt,"All Types")):(l(),o("span",Et,n(c.value.length)+" selected",1)),e[31]||(e[31]=t("svg",{class:"w-4 h-4 shrink-0",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M19 9l-7 7-7-7"})],-1))]),t("ul",Bt,[t("li",Vt,[e[32]||(e[32]=t("span",null,"Event Types",-1)),c.value.length>0?(l(),o("button",{key:0,onClick:le(Je,["stop"]),class:"btn btn-xs btn-ghost"}," Clear ")):r("",!0)]),(l(),o(B,null,V(de,a=>t("li",{key:a.value},[t("label",Nt,[t("input",{type:"checkbox",checked:c.value.includes(a.value),onChange:R=>ve(a.value),class:"checkbox checkbox-sm"},null,40,Ft),t("span",It,n(a.icon),1),t("span",null,n(a.label),1)])])),64))])])]),t("div",Ut,[e[35]||(e[35]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Server")],-1)),x(t("select",{"onUpdate:modelValue":e[1]||(e[1]=a=>S.value=a),class:"select select-bordered select-sm"},[e[34]||(e[34]=t("option",{value:""},"All Servers",-1)),(l(!0),o(B,null,V(Ne.value,a=>(l(),o("option",{key:a,value:a},n(a),9,zt))),128))],512),[[N,S.value]])]),t("div",Jt,[e[37]||(e[37]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Status")],-1)),x(t("select",{"onUpdate:modelValue":e[2]||(e[2]=a=>A.value=a),class:"select select-bordered select-sm"},[...e[36]||(e[36]=[t("option",{value:""},"All",-1),t("option",{value:"success"},"Success",-1),t("option",{value:"error"},"Error",-1),t("option",{value:"blocked"},"Blocked",-1)])],512),[[N,A.value]])]),t("div",Ot,[e[39]||(e[39]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Auth")],-1)),x(t("select",{"onUpdate:modelValue":e[3]||(e[3]=a=>h.value=a),class:"select select-bordered select-sm"},[...e[38]||(e[38]=[t("option",{value:""},"All",-1),t("option",{value:"admin"},"🔑 Admin",-1),t("option",{value:"agent"},"🤖 Agent",-1)])],512),[[N,h.value]])]),h.value==="agent"?(l(),o("div",Rt,[e[41]||(e[41]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Agent")],-1)),x(t("select",{"onUpdate:modelValue":e[4]||(e[4]=a=>T.value=a),class:"select select-bordered select-sm"},[e[40]||(e[40]=t("option",{value:""},"All Agents",-1)),(l(!0),o(B,null,V(Fe.value,a=>(l(),o("option",{key:a,value:a},n(a),9,Ht))),128))],512),[[N,T.value]])])):r("",!0),t("div",Pt,[e[43]||(e[43]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Sensitive Data")],-1)),x(t("select",{"onUpdate:modelValue":e[5]||(e[5]=a=>f.value=a),class:"select select-bordered select-sm"},[...e[42]||(e[42]=[t("option",{value:""},"All",-1),t("option",{value:"true"},"⚠️ Detected",-1),t("option",{value:"false"},"Clean",-1)])],512),[[N,f.value]])]),f.value==="true"?(l(),o("div",qt,[e[45]||(e[45]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Severity")],-1)),x(t("select",{"onUpdate:modelValue":e[6]||(e[6]=a=>j.value=a),class:"select select-bordered select-sm"},[...e[44]||(e[44]=[Ye('',5)])],512),[[N,j.value]])])):r("",!0),t("div",Kt,[e[47]||(e[47]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"Session")],-1)),x(t("select",{"onUpdate:modelValue":e[7]||(e[7]=a=>$.value=a),class:"select select-bordered select-sm"},[e[46]||(e[46]=t("option",{value:""},"All Sessions",-1)),(l(!0),o(B,null,V(ue.value,a=>(l(),o("option",{key:a.id,value:a.id},n(a.label),9,Qt))),128))],512),[[N,$.value]])]),t("div",Gt,[e[48]||(e[48]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"From")],-1)),x(t("input",{type:"datetime-local","onUpdate:modelValue":e[8]||(e[8]=a=>L.value=a),class:"input input-bordered input-sm"},null,512),[[Le,L.value]])]),t("div",Wt,[e[49]||(e[49]=t("label",{class:"label py-1"},[t("span",{class:"label-text text-xs"},"To")],-1)),x(t("input",{type:"datetime-local","onUpdate:modelValue":e[9]||(e[9]=a=>E.value=a),class:"input input-bordered input-sm"},null,512),[[Le,E.value]])]),W.value?(l(),o("button",{key:2,onClick:ze,class:"btn btn-sm btn-ghost"}," Clear Filters ")):r("",!0),e[51]||(e[51]=t("div",{class:"flex-1"},null,-1)),t("div",Xt,[e[50]||(e[50]=t("div",{tabindex:"0",role:"button",class:"btn btn-sm btn-outline"},[t("svg",{class:"w-4 h-4 mr-1",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 10v6m0 0l-3-3m3 3l3-3m2 8H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"})]),y(" Export ")],-1)),t("ul",Yt,[t("li",null,[t("a",{onClick:e[10]||(e[10]=a=>be("json"))},"Export as JSON")]),t("li",null,[t("a",{onClick:e[11]||(e[11]=a=>be("csv"))},"Export as CSV")])])])]),W.value?(l(),o("div",Zt,[e[53]||(e[53]=t("span",{class:"text-xs text-base-content/60"},"Active filters:",-1)),(l(!0),o(B,null,V(c.value,a=>(l(),o("span",{key:a,class:"badge badge-sm badge-outline gap-1 cursor-pointer hover:badge-error",onClick:R=>ve(a)},[y(n(ee(a))+" "+n(Z(a))+" ",1),e[52]||(e[52]=t("svg",{class:"w-3 h-3",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M6 18L18 6M6 6l12 12"})],-1))],8,es))),128)),S.value?(l(),o("span",ts,"Server: "+n(S.value),1)):r("",!0),A.value?(l(),o("span",ss,"Status: "+n(A.value),1)):r("",!0),h.value?(l(),o("span",as,"Auth: "+n(h.value==="admin"?"🔑 Admin":"🤖 Agent"),1)):r("",!0),T.value?(l(),o("span",ls,"Agent: "+n(T.value),1)):r("",!0),f.value?(l(),o("span",os," Sensitive: "+n(f.value==="true"?"⚠️ Detected":"Clean"),1)):r("",!0),j.value?(l(),o("span",ns,"Severity: "+n(j.value),1)):r("",!0),$.value?(l(),o("span",is,"Session: "+n(Ie($.value)),1)):r("",!0),L.value?(l(),o("span",rs,"From: "+n(new Date(L.value).toLocaleString()),1)):r("",!0),E.value?(l(),o("span",ds,"To: "+n(new Date(E.value).toLocaleString()),1)):r("",!0)])):r("",!0)])]),t("div",us,[t("div",cs,[M.value&&b.value.length===0?(l(),o("div",vs,[...e[54]||(e[54]=[t("span",{class:"loading loading-spinner loading-lg"},null,-1)])])):F.value?(l(),o("div",ps,[e[55]||(e[55]=t("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"})],-1)),t("span",null,n(F.value),1),t("button",{onClick:q,class:"btn btn-sm btn-ghost"},"Retry")])):ce.value.length===0?(l(),o("div",ms,[e[56]||(e[56]=t("svg",{class:"w-16 h-16 mx-auto mb-4 opacity-30",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2"})],-1)),t("p",bs,n(W.value?"No matching activities":"No activity records found"),1),t("p",gs,n(W.value?"Try adjusting your filters":"Activity will appear here as tools are called and actions are taken"),1)])):(l(),o("div",_s,[t("table",xs,[t("thead",null,[t("tr",null,[t("th",{class:"cursor-pointer hover:bg-base-200",onClick:e[12]||(e[12]=a=>K("timestamp"))}," Time "+n(Q("timestamp")),1),t("th",{class:"cursor-pointer hover:bg-base-200",onClick:e[13]||(e[13]=a=>K("type"))}," Type "+n(Q("type")),1),t("th",{class:"cursor-pointer hover:bg-base-200",onClick:e[14]||(e[14]=a=>K("server_name"))}," Server "+n(Q("server_name")),1),e[57]||(e[57]=t("th",null,"Details",-1)),e[58]||(e[58]=t("th",null,"Sensitive",-1)),e[59]||(e[59]=t("th",null,"Intent",-1)),t("th",{class:"cursor-pointer hover:bg-base-200",onClick:e[15]||(e[15]=a=>K("status"))}," Status "+n(Q("status")),1),t("th",{class:"cursor-pointer hover:bg-base-200",onClick:e[16]||(e[16]=a=>K("duration_ms"))}," Duration "+n(Q("duration_ms")),1),e[60]||(e[60]=t("th",null,null,-1))])]),t("tbody",null,[(l(!0),o(B,null,V(Ue.value,a=>{var R,Se,Ae,Te,De,Me,$e;return l(),o("tr",{key:a.id,class:g(["hover cursor-pointer",{"bg-base-200":((R=i.value)==null?void 0:R.id)===a.id}]),onClick:qe=>pe(a)},[t("td",null,[t("div",fs,n(_e(a.timestamp)),1),t("div",hs,n(Oe(a.timestamp)),1)]),t("td",null,[t("div",ks,[t("span",ws,n(ee(a.type)),1),t("span",Cs,n(Z(a.type)),1)])]),t("td",null,[a.server_name?(l(),et(d,{key:0,to:`/servers/${a.server_name}`,class:"link link-hover font-medium",onClick:e[17]||(e[17]=le(()=>{},["stop"]))},{default:Ee(()=>[y(n(a.server_name),1)]),_:2},1032,["to"])):(l(),o("span",Ss,"-"))]),t("td",null,[t("div",As,[a.tool_name?(l(),o("code",Ts,n(a.tool_name),1)):(Se=a.metadata)!=null&&Se.action?(l(),o("span",Ds,n(a.metadata.action),1)):(l(),o("span",Ms,"-"))])]),t("td",null,[a.has_sensitive_data?(l(),o("div",{key:0,class:"tooltip tooltip-top","data-tip":(a.detection_types||[]).join(", ")},[t("span",{class:g(["badge badge-sm gap-1",se(a.max_severity)])},n(te(a.max_severity))+" "+n(((Ae=a.detection_types)==null?void 0:Ae.length)||0),3)],8,$s)):(l(),o("span",js,"-"))]),t("td",null,[(De=(Te=a.metadata)==null?void 0:Te.intent)!=null&&De.operation_type?(l(),o("div",{key:0,class:"tooltip tooltip-top","data-tip":(($e=(Me=a.metadata)==null?void 0:Me.intent)==null?void 0:$e.reason)||"No reason provided"},[t("span",{class:g(["badge badge-sm gap-1",ke(a.metadata.intent.operation_type)])},n(he(a.metadata.intent.operation_type))+" "+n(a.metadata.intent.operation_type),3)],8,Ls)):(l(),o("span",Es,"-"))]),t("td",null,[t("div",{class:g(["badge badge-sm",ye(a.status)])},n(xe(a.status)),3)]),t("td",null,[a.duration_ms!==void 0?(l(),o("span",Bs,n(fe(a.duration_ms)),1)):(l(),o("span",Vs,"-"))]),t("td",null,[t("button",{class:"btn btn-xs btn-ghost",onClick:le(qe=>pe(a),["stop"])},[...e[61]||(e[61]=[t("svg",{class:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M9 5l7 7-7 7"})],-1)])],8,Ns)])],10,ys)}),128))])]),J.value>1?(l(),o("div",Fs,[t("div",Is," Showing "+n((p.value-1)*U.value+1)+"-"+n(Math.min(p.value*U.value,X.value.length))+" of "+n(X.value.length),1),t("div",Us,[t("button",{onClick:e[18]||(e[18]=a=>p.value=1),disabled:p.value===1,class:"join-item btn btn-sm"}," « ",8,zs),t("button",{onClick:e[19]||(e[19]=a=>p.value=Math.max(1,p.value-1)),disabled:p.value===1,class:"join-item btn btn-sm"}," ‹ ",8,Js),t("button",Os,n(p.value)+" / "+n(J.value),1),t("button",{onClick:e[20]||(e[20]=a=>p.value=Math.min(J.value,p.value+1)),disabled:p.value===J.value,class:"join-item btn btn-sm"}," › ",8,Rs),t("button",{onClick:e[21]||(e[21]=a=>p.value=J.value),disabled:p.value===J.value,class:"join-item btn btn-sm"}," » ",8,Hs)]),t("div",Ps,[x(t("select",{"onUpdate:modelValue":e[22]||(e[22]=a=>U.value=a),class:"select select-bordered select-sm"},[...e[62]||(e[62]=[t("option",{value:10},"10 / page",-1),t("option",{value:25},"25 / page",-1),t("option",{value:50},"50 / page",-1),t("option",{value:100},"100 / page",-1)])],512),[[N,U.value,void 0,{number:!0}]])])])):r("",!0)]))])]),t("div",qs,[x(t("input",{id:"activity-detail-drawer",type:"checkbox",class:"drawer-toggle","onUpdate:modelValue":e[23]||(e[23]=a=>I.value=a)},null,512),[[je,I.value]]),t("div",Ks,[e[88]||(e[88]=t("label",{for:"activity-detail-drawer","aria-label":"close sidebar",class:"drawer-overlay"},null,-1)),t("div",Qs,[i.value?(l(),o("div",Gs,[t("div",Ws,[t("div",null,[t("h3",Xs,[t("span",Ys,n(ee(i.value.type)),1),y(" "+n(Z(i.value.type)),1)]),t("p",Zs,n(_e(i.value.timestamp)),1)]),t("button",{onClick:me,class:"btn btn-sm btn-circle btn-ghost"},[...e[63]||(e[63]=[t("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M6 18L18 6M6 6l12 12"})],-1)])])]),t("div",ea,[e[64]||(e[64]=t("span",{class:"text-sm text-base-content/60"},"Status:",-1)),t("div",{class:g(["badge",ye(i.value.status)])},n(xe(i.value.status)),3)]),t("div",ta,[i.value.id?(l(),o("div",sa,[e[65]||(e[65]=t("span",{class:"text-sm text-base-content/60 w-24 shrink-0"},"ID:",-1)),t("code",aa,n(i.value.id),1)])):r("",!0),i.value.server_name?(l(),o("div",la,[e[66]||(e[66]=t("span",{class:"text-sm text-base-content/60 w-24 shrink-0"},"Server:",-1)),Y(d,{to:`/servers/${i.value.server_name}`,class:"link link-primary text-sm"},{default:Ee(()=>[y(n(i.value.server_name),1)]),_:1},8,["to"])])):r("",!0),i.value.tool_name?(l(),o("div",oa,[e[67]||(e[67]=t("span",{class:"text-sm text-base-content/60 w-24 shrink-0"},"Tool:",-1)),t("code",na,n(i.value.tool_name),1)])):r("",!0),i.value.duration_ms!==void 0?(l(),o("div",ia,[e[68]||(e[68]=t("span",{class:"text-sm text-base-content/60 w-24 shrink-0"},"Duration:",-1)),t("span",ra,n(fe(i.value.duration_ms)),1)])):r("",!0),i.value.session_id?(l(),o("div",da,[e[69]||(e[69]=t("span",{class:"text-sm text-base-content/60 w-24 shrink-0"},"Session:",-1)),t("code",ua,n(i.value.session_id),1)])):r("",!0),i.value.source?(l(),o("div",ca,[e[70]||(e[70]=t("span",{class:"text-sm text-base-content/60 w-24 shrink-0"},"Source:",-1)),t("span",va,n(i.value.source),1)])):r("",!0)]),i.value.has_sensitive_data?(l(),o("div",pa,[t("h4",ma,[t("span",null,n(te(i.value.max_severity)),1),e[71]||(e[71]=y(" Sensitive Data Detected ",-1))]),t("div",{class:g(["alert",i.value.max_severity==="critical"?"alert-error":"alert-warning"])},[t("div",ba,[t("div",ga,[e[72]||(e[72]=t("span",{class:"font-semibold"},"Severity:",-1)),t("span",{class:g(["badge",se(i.value.max_severity)])},n(te(i.value.max_severity))+" "+n(i.value.max_severity||"unknown"),3)]),i.value.detection_types&&i.value.detection_types.length>0?(l(),o("div",_a,[e[73]||(e[73]=t("span",{class:"font-semibold"},"Detection Types:",-1)),t("div",xa,[(l(!0),o(B,null,V(i.value.detection_types,a=>(l(),o("span",{key:a,class:"badge badge-sm bg-base-100/20 border-current text-inherit"},n(a),1))),128))])])):r("",!0),(u=i.value.metadata)!=null&&u.sensitive_data_detection?(l(),o("div",ya,[e[74]||(e[74]=t("span",{class:"font-semibold"},"Detections:",-1)),t("div",fa,[(l(!0),o(B,null,V(i.value.metadata.sensitive_data_detection.detections||[],(a,R)=>(l(),o("div",{key:R,class:"flex items-center gap-2 bg-base-100/20 rounded px-2 py-1"},[t("span",{class:g(["badge badge-xs",se(a.severity)])},n(a.severity),3),t("span",ha,n(a.type),1),t("span",ka,"in "+n(a.location),1),a.is_likely_example?(l(),o("span",wa,"example")):r("",!0)]))),128))])])):r("",!0)])],2)])):r("",!0),i.value.type==="policy_decision"||i.value.status==="blocked"?(l(),o("div",Ca,[e[78]||(e[78]=t("h4",{class:"font-semibold mb-2 text-warning flex items-center gap-2"},[t("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"})]),y(" Policy Decision ")],-1)),t("div",Sa,[t("div",Aa,[t("div",Ta,[e[75]||(e[75]=t("span",{class:"font-semibold"},"Decision:",-1)),t("span",Da,n(((D=i.value.metadata)==null?void 0:D.decision)||i.value.status||"Blocked"),1)]),(k=i.value.metadata)!=null&&k.reason?(l(),o("div",Ma,[e[76]||(e[76]=t("span",{class:"font-semibold"},"Reason:",-1)),t("span",$a,n(i.value.metadata.reason),1)])):(w=i.value.metadata)!=null&&w.policy_rule?(l(),o("div",ja,[e[77]||(e[77]=t("span",{class:"font-semibold"},"Policy Rule:",-1)),t("span",La,n(i.value.metadata.policy_rule),1)])):(l(),o("div",Ea," Tool call was blocked by security policy "))])])])):r("",!0),i.value.arguments&&Object.keys(i.value.arguments).length>0?(l(),o("div",Ba,[e[79]||(e[79]=t("h4",{class:"font-semibold mb-2 flex items-center gap-2"},[y(" Request Arguments "),t("span",{class:"badge badge-sm badge-info"},"JSON")],-1)),Y(ne,{data:i.value.arguments,"max-height":"12rem"},null,8,["data"])])):r("",!0),i.value.response?(l(),o("div",Va,[t("h4",Na,[e[80]||(e[80]=y(" Response Body ",-1)),e[81]||(e[81]=t("span",{class:"badge badge-sm badge-info"},"JSON",-1)),i.value.response_truncated?(l(),o("span",Fa,"Truncated")):r("",!0)]),Y(ne,{data:Re(i.value.response),"max-height":"16rem"},null,8,["data"])])):r("",!0),i.value.error_message?(l(),o("div",Ia,[e[82]||(e[82]=t("h4",{class:"font-semibold mb-2 text-error"},"Error Message",-1)),t("div",Ua,[t("span",za,n(i.value.error_message),1)])])):r("",!0),(Ce=i.value.metadata)!=null&&Ce.intent?(l(),o("div",Ja,[e[86]||(e[86]=t("h4",{class:"font-semibold mb-2"},"Intent Declaration",-1)),t("div",Oa,[i.value.metadata.intent.operation_type?(l(),o("div",Ra,[e[83]||(e[83]=t("span",{class:"text-sm text-base-content/60"},"Operation:",-1)),t("span",{class:g(["badge badge-sm",ke(i.value.metadata.intent.operation_type)])},n(he(i.value.metadata.intent.operation_type))+" "+n(i.value.metadata.intent.operation_type),3)])):r("",!0),i.value.metadata.intent.data_sensitivity?(l(),o("div",Ha,[e[84]||(e[84]=t("span",{class:"text-sm text-base-content/60"},"Sensitivity:",-1)),t("span",Pa,n(i.value.metadata.intent.data_sensitivity),1)])):r("",!0),i.value.metadata.intent.reason?(l(),o("div",qa,[e[85]||(e[85]=t("span",{class:"text-sm text-base-content/60"},"Reason:",-1)),t("span",Ka,n(i.value.metadata.intent.reason),1)])):r("",!0)])])):r("",!0),He(i.value)?(l(),o("div",Qa,[e[87]||(e[87]=t("h4",{class:"font-semibold mb-2 flex items-center gap-2"},[y(" Additional Details "),t("span",{class:"badge badge-sm badge-ghost"},"JSON")],-1)),Y(ne,{data:Pe(i.value),"max-height":"12rem"},null,8,["data"])])):r("",!0)])):r("",!0)])])])])}}});export{Wa as default};
diff --git a/web/frontend/dist/assets/Activity-7YqHqUto.css b/web/frontend/dist/assets/Activity-7YqHqUto.css
new file mode 100644
index 00000000..923e101f
--- /dev/null
+++ b/web/frontend/dist/assets/Activity-7YqHqUto.css
@@ -0,0 +1 @@
+.json-viewer-container[data-v-919a3d3e]{width:100%}.json-viewer[data-v-919a3d3e]{white-space:pre-wrap;word-wrap:break-word;overflow-wrap:anywhere;line-height:1.5;font-family:Monaco,Menlo,Ubuntu Mono,Consolas,source-code-pro,monospace}.json-viewer[data-v-919a3d3e]::-webkit-scrollbar{width:8px;height:8px}.json-viewer[data-v-919a3d3e]::-webkit-scrollbar-track{border-radius:.25rem;--tw-bg-opacity: 1;background-color:var(--fallback-b2,oklch(var(--b2)/var(--tw-bg-opacity, 1)))}.json-viewer[data-v-919a3d3e]::-webkit-scrollbar-thumb{border-radius:.25rem;background-color:var(--fallback-bc,oklch(var(--bc)/.2))}.json-viewer[data-v-919a3d3e]::-webkit-scrollbar-thumb:hover{background-color:var(--fallback-bc,oklch(var(--bc)/.3))}
diff --git a/web/frontend/dist/assets/AdminDashboard-_SN62PSb.js b/web/frontend/dist/assets/AdminDashboard-_SN62PSb.js
new file mode 100644
index 00000000..7938effb
--- /dev/null
+++ b/web/frontend/dist/assets/AdminDashboard-_SN62PSb.js
@@ -0,0 +1 @@
+import{d as C,r as _,K as j,f as S,x as U,I as A,c as l,o as n,a as s,g as m,j as b,n as f,t as a,i as k,w,k as B,F as y,p as M}from"./index-DMP0eryo.js";const T={class:"space-y-6 max-w-6xl mx-auto"},V={class:"flex justify-between items-center"},N=["disabled"],R={class:"stats shadow bg-base-100 w-full"},D={class:"stat"},H={class:"stat-value text-primary"},$={class:"stat-desc"},z={class:"stat"},I={class:"stat-value text-secondary"},E={class:"stat"},F={class:"stat-value text-accent"},L={class:"stat-desc"},J={class:"stat"},K={class:"stat-value text-info"},P={class:"stat-desc"},q={key:0,class:"flex justify-center py-12"},G={key:1,class:"alert alert-error"},O={key:2,class:"grid grid-cols-1 lg:grid-cols-2 gap-6"},Q={class:"card bg-base-100 shadow-sm"},W={class:"card-body"},X={class:"flex items-center justify-between mb-3"},Y={key:0,class:"text-center py-4 text-base-content/60 text-sm"},Z={key:1,class:"space-y-2"},ss={class:"font-medium text-sm"},ts={class:"text-xs text-base-content/50"},es={class:"flex items-center gap-2"},as={class:"text-xs text-base-content/50"},os={class:"card bg-base-100 shadow-sm"},ls={class:"card-body"},ns={class:"flex items-center justify-between mb-3"},rs={key:0,class:"text-center py-4 text-base-content/60 text-sm"},is={key:1,class:"space-y-2"},ds={class:"text-sm"},cs={class:"text-xs"},vs={key:0,class:"text-base-content/50 ml-1"},us={class:"text-xs text-base-content/50"},hs={class:"flex items-center gap-2"},_s={class:"text-xs text-base-content/50"},bs=C({__name:"AdminDashboard",setup(ms){const i=_(!1),d=_(""),c=_([]),v=_([]);let u=null;const o=j({totalUsers:0,activeUsers:0,activeSessions:0,totalServers:0,healthyServers:0,toolCalls24h:0,errorRate24h:0}),g=S(()=>o.totalUsers>0||c.value.length>0||v.value.length>0);function p(r){const t=Date.now(),h=new Date(r).getTime(),e=t-h;return e<1e3?"Just now":e<6e4?`${Math.floor(e/1e3)}s ago`:e<36e5?`${Math.floor(e/6e4)}m ago`:e<864e5?`${Math.floor(e/36e5)}h ago`:`${Math.floor(e/864e5)}d ago`}async function x(){i.value=!0,d.value="";try{const r=await fetch("/api/v1/admin/dashboard",{credentials:"include"});if(!r.ok)throw new Error(`HTTP ${r.status}: ${r.statusText}`);const t=await r.json();o.totalUsers=t.total_users||0,o.activeUsers=t.active_users||0,o.activeSessions=t.active_sessions||0,o.totalServers=t.total_servers||0,o.healthyServers=t.healthy_servers||0,o.toolCalls24h=t.tool_calls_24h||0,o.errorRate24h=t.error_rate_24h||0,c.value=t.recent_users||[],v.value=t.recent_activity||[]}catch(r){d.value=r instanceof Error?r.message:"Failed to load dashboard data"}finally{i.value=!1}}return U(()=>{x(),u=setInterval(x,3e4)}),A(()=>{u&&(clearInterval(u),u=null)}),(r,t)=>{const h=B("router-link");return n(),l("div",T,[s("div",V,[t[2]||(t[2]=s("div",null,[s("h1",{class:"text-2xl font-bold"},"Admin Dashboard"),s("p",{class:"text-base-content/70 mt-1"},"Server overview and system health")],-1)),s("button",{onClick:x,class:"btn btn-sm btn-ghost",disabled:i.value},[(n(),l("svg",{class:f(["w-4 h-4",{"animate-spin":i.value}]),fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[...t[0]||(t[0]=[s("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"},null,-1)])],2)),t[1]||(t[1]=b(" Refresh ",-1))],8,N)]),s("div",R,[s("div",D,[t[3]||(t[3]=s("div",{class:"stat-figure text-primary"},[s("svg",{class:"w-8 h-8",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[s("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0z"})])],-1)),t[4]||(t[4]=s("div",{class:"stat-title"},"Total Users",-1)),s("div",H,a(o.totalUsers),1),s("div",$,a(o.activeUsers)+" active",1)]),s("div",z,[t[5]||(t[5]=s("div",{class:"stat-figure text-secondary"},[s("svg",{class:"w-8 h-8",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[s("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M13 10V3L4 14h7v7l9-11h-7z"})])],-1)),t[6]||(t[6]=s("div",{class:"stat-title"},"Active Sessions",-1)),s("div",I,a(o.activeSessions),1),t[7]||(t[7]=s("div",{class:"stat-desc"},"Current connections",-1))]),s("div",E,[t[8]||(t[8]=s("div",{class:"stat-figure text-accent"},[s("svg",{class:"w-8 h-8",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[s("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M5 12h14M5 12a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v4a2 2 0 01-2 2M5 12a2 2 0 00-2 2v4a2 2 0 002 2h14a2 2 0 002-2v-4a2 2 0 00-2-2"})])],-1)),t[9]||(t[9]=s("div",{class:"stat-title"},"Total Servers",-1)),s("div",F,a(o.totalServers),1),s("div",L,a(o.healthyServers)+" healthy",1)]),s("div",J,[t[10]||(t[10]=s("div",{class:"stat-figure text-info"},[s("svg",{class:"w-8 h-8",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[s("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2"})])],-1)),t[11]||(t[11]=s("div",{class:"stat-title"},"Tool Calls (24h)",-1)),s("div",K,a(o.toolCalls24h),1),s("div",P,a(o.errorRate24h)+"% error rate",1)])]),i.value&&!g.value?(n(),l("div",q,[...t[12]||(t[12]=[s("span",{class:"loading loading-spinner loading-lg"},null,-1)])])):m("",!0),d.value?(n(),l("div",G,[t[13]||(t[13]=s("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[s("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"})],-1)),s("span",null,a(d.value),1)])):m("",!0),g.value?(n(),l("div",O,[s("div",Q,[s("div",W,[s("div",X,[t[15]||(t[15]=s("h2",{class:"card-title text-lg"},"Recent Users",-1)),k(h,{to:"/admin/users",class:"btn btn-xs btn-ghost"},{default:w(()=>[...t[14]||(t[14]=[b("View All",-1)])]),_:1})]),c.value.length===0?(n(),l("div",Y," No users yet ")):(n(),l("div",Z,[(n(!0),l(y,null,M(c.value,e=>(n(),l("div",{key:e.id,class:"flex items-center justify-between py-2 border-b border-base-200 last:border-0"},[s("div",null,[s("div",ss,a(e.display_name||e.email),1),s("div",ts,a(e.email),1)]),s("div",es,[s("span",{class:f(["badge badge-xs",e.role==="admin"?"badge-primary":"badge-ghost"])},a(e.role),3),s("span",as,a(e.last_login_at?p(e.last_login_at):"Never"),1)])]))),128))]))])]),s("div",os,[s("div",ls,[s("div",ns,[t[17]||(t[17]=s("h2",{class:"card-title text-lg"},"Recent Activity",-1)),k(h,{to:"/activity",class:"btn btn-xs btn-ghost"},{default:w(()=>[...t[16]||(t[16]=[b("View All",-1)])]),_:1})]),v.value.length===0?(n(),l("div",rs," No recent activity ")):(n(),l("div",is,[(n(!0),l(y,null,M(v.value,e=>(n(),l("div",{key:e.id,class:"flex items-center justify-between py-2 border-b border-base-200 last:border-0"},[s("div",null,[s("div",ds,[s("code",cs,a(e.tool_name||e.type),1),e.server_name?(n(),l("span",vs,"on "+a(e.server_name),1)):m("",!0)]),s("div",us,a(e.user_email||"system"),1)]),s("div",hs,[s("span",{class:f(["badge badge-xs",e.status==="success"?"badge-success":e.status==="error"?"badge-error":"badge-ghost"])},a(e.status),3),s("span",_s,a(p(e.timestamp)),1)])]))),128))]))])])])):m("",!0)])}}});export{bs as default};
diff --git a/web/frontend/dist/assets/AdminServers-BS1vVmqX.js b/web/frontend/dist/assets/AdminServers-BS1vVmqX.js
new file mode 100644
index 00000000..e5db215a
--- /dev/null
+++ b/web/frontend/dist/assets/AdminServers-BS1vVmqX.js
@@ -0,0 +1 @@
+import{d as L,r as c,f as m,x as U,c as o,o as r,a as t,g as w,t as n,F as y,m as x,v as R,y as _,p as q,n as k,L as B,N}from"./index-DMP0eryo.js";const V={class:"p-4 max-w-7xl mx-auto"},H={class:"grid grid-cols-4 gap-3 mb-6"},I={class:"stat bg-base-100 rounded-lg shadow-sm p-3"},O={class:"stat-value text-lg"},z={class:"stat bg-base-100 rounded-lg shadow-sm p-3"},J={class:"stat-value text-lg text-success"},Q={class:"stat bg-base-100 rounded-lg shadow-sm p-3"},G={class:"stat-value text-lg text-info"},K={class:"stat bg-base-100 rounded-lg shadow-sm p-3"},W={class:"stat-value text-lg text-base-content/40"},X={key:0,class:"flex justify-center py-8"},Y={class:"flex gap-2 mb-4"},Z={key:0,class:"text-base-content/50 py-8 text-center"},ee={key:1,class:"overflow-x-auto"},te={class:"table table-sm w-full"},se=["onClick"],ae={class:"font-medium"},ne={class:"badge badge-ghost badge-xs"},le={class:"text-xs text-base-content/50 truncate max-w-xs"},oe={key:0,class:"badge badge-info badge-xs"},re={key:1,class:"badge badge-ghost badge-xs"},de={class:"dropdown dropdown-end"},ie={tabindex:"0",class:"dropdown-content z-[1] menu p-1 shadow-lg bg-base-100 rounded-lg w-48 border border-base-300"},ue=["onClick"],ce=["onClick"],ve={class:"border-t border-base-200 mt-1 pt-1"},be=["onClick"],he={key:2,class:"alert alert-error mt-4"},ge={key:3,class:"toast toast-end toast-bottom"},me={class:"alert alert-success"},xe=L({__name:"AdminServers",setup(pe){const C=N(),p=c(!0),l=c(""),d=c(""),i=c([]),v=c(""),b=c(""),h=c(""),S=m(()=>i.value.filter(s=>s.enabled&&s.connected).length),$=m(()=>i.value.filter(s=>s.shared).length),T=m(()=>i.value.filter(s=>!s.enabled).length),E=m(()=>{let s=i.value;if(v.value){const e=v.value.toLowerCase();s=s.filter(a=>a.name.toLowerCase().includes(e)||a.url&&a.url.toLowerCase().includes(e)||a.command&&a.command.toLowerCase().includes(e)||a.protocol.toLowerCase().includes(e))}return b.value==="enabled"?s=s.filter(e=>e.enabled):b.value==="disabled"&&(s=s.filter(e=>!e.enabled)),h.value==="shared"?s=s.filter(e=>e.shared):h.value==="private"&&(s=s.filter(e=>!e.shared)),s});function M(s){if(s.quarantined)return"badge-error";if(!s.enabled)return"badge-ghost";if(s.health)switch(s.health.level){case"healthy":return"badge-success";case"degraded":return"badge-warning";case"unhealthy":return"badge-error"}return s.connected?"badge-success":"badge-warning"}function P(s){return s.quarantined?"quarantined":s.enabled?s.health?s.health.level:s.connected?"connected":"disconnected":"disabled"}function A(s){C.push("/servers/"+encodeURIComponent(s.name))}async function g(){p.value=!0,l.value="";try{const s=await fetch("/api/v1/admin/servers",{credentials:"include"});if(!s.ok)throw new Error(`HTTP ${s.status}: ${s.statusText}`);const e=await s.json();Array.isArray(e)?i.value=e:e&&Array.isArray(e.servers)?i.value=e.servers:i.value=[]}catch(s){l.value=s instanceof Error?s.message:"Failed to load servers"}finally{p.value=!1}}async function F(s){l.value="",d.value="";try{const e=s.enabled?"disable":"enable",a=await fetch(`/api/v1/admin/servers/${encodeURIComponent(s.name)}/${e}`,{method:"POST",credentials:"include"});if(!a.ok){const u=await a.json().catch(()=>({}));throw new Error(u.message||u.error||`HTTP ${a.status}`)}d.value=`Server "${s.name}" ${s.enabled?"disabled":"enabled"}.`,await g(),f()}catch(e){l.value=e instanceof Error?e.message:"Failed to update server"}}async function j(s){if(s.enabled){l.value="",d.value="";try{const e=await fetch(`/api/v1/admin/servers/${encodeURIComponent(s.name)}/restart`,{method:"POST",credentials:"include"});if(!e.ok){const a=await e.json().catch(()=>({}));throw new Error(a.message||a.error||`HTTP ${e.status}`)}d.value=`Server "${s.name}" restarted.`,await g(),f()}catch(e){l.value=e instanceof Error?e.message:"Failed to restart server"}}}async function D(s){l.value="",d.value="";try{const e=!s.shared,a=await fetch(`/api/v1/admin/servers/${encodeURIComponent(s.name)}/shared`,{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify({shared:e})});if(!a.ok){const u=await a.json().catch(()=>({}));throw new Error(u.message||u.error||`HTTP ${a.status}`)}d.value=`Server "${s.name}" is now ${e?"shared with all users":"private"}.`,await g(),f()}catch(e){l.value=e instanceof Error?e.message:"Failed to update server"}}function f(){setTimeout(()=>{d.value=""},3e3)}return U(()=>{g()}),(s,e)=>(r(),o("div",V,[e[14]||(e[14]=t("div",{class:"flex justify-between items-center mb-6"},[t("div",null,[t("h1",{class:"text-2xl font-bold"},"Server Management"),t("p",{class:"text-sm text-base-content/60 mt-1"},"Manage upstream MCP servers. Shared servers are available to all users.")])],-1)),t("div",H,[t("div",I,[e[5]||(e[5]=t("div",{class:"stat-title text-xs"},"Total",-1)),t("div",O,n(i.value.length),1)]),t("div",z,[e[6]||(e[6]=t("div",{class:"stat-title text-xs"},"Connected",-1)),t("div",J,n(S.value),1)]),t("div",Q,[e[7]||(e[7]=t("div",{class:"stat-title text-xs"},"Shared",-1)),t("div",G,n($.value),1)]),t("div",K,[e[8]||(e[8]=t("div",{class:"stat-title text-xs"},"Disabled",-1)),t("div",W,n(T.value),1)])]),p.value?(r(),o("div",X,[...e[9]||(e[9]=[t("span",{class:"loading loading-spinner loading-lg"},null,-1)])])):(r(),o(y,{key:1},[t("div",Y,[x(t("input",{"onUpdate:modelValue":e[0]||(e[0]=a=>v.value=a),type:"text",placeholder:"Filter servers...",class:"input input-bordered input-sm flex-1"},null,512),[[R,v.value]]),x(t("select",{"onUpdate:modelValue":e[1]||(e[1]=a=>b.value=a),class:"select select-bordered select-sm"},[...e[10]||(e[10]=[t("option",{value:""},"All Status",-1),t("option",{value:"enabled"},"Enabled",-1),t("option",{value:"disabled"},"Disabled",-1)])],512),[[_,b.value]]),x(t("select",{"onUpdate:modelValue":e[2]||(e[2]=a=>h.value=a),class:"select select-bordered select-sm"},[...e[11]||(e[11]=[t("option",{value:""},"All",-1),t("option",{value:"shared"},"Shared",-1),t("option",{value:"private"},"Private",-1)])],512),[[_,h.value]])]),i.value.length===0?(r(),o("div",Z," No servers configured. Add servers in the configuration file. ")):(r(),o("div",ee,[t("table",te,[e[13]||(e[13]=t("thead",null,[t("tr",{class:"text-xs uppercase text-base-content/50"},[t("th",null,"Server"),t("th",null,"Protocol"),t("th",null,"Endpoint"),t("th",null,"Status"),t("th",null,"Sharing"),t("th",{class:"text-right"},"Actions")])],-1)),t("tbody",null,[(r(!0),o(y,null,q(E.value,a=>(r(),o("tr",{key:a.name,class:"hover:bg-base-200/50 cursor-pointer transition-colors",onClick:u=>A(a)},[t("td",ae,n(a.name),1),t("td",null,[t("span",ne,n(a.protocol),1)]),t("td",le,n(a.url||a.command||"—"),1),t("td",null,[t("span",{class:k(["badge badge-xs",M(a)])},n(P(a)),3)]),t("td",null,[a.shared?(r(),o("span",oe,"shared")):(r(),o("span",re,"private"))]),t("td",{class:"text-right",onClick:e[3]||(e[3]=B(()=>{},["stop"]))},[t("div",de,[e[12]||(e[12]=t("label",{tabindex:"0",class:"btn btn-ghost btn-xs btn-square"},[t("svg",{class:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 5v.01M12 12v.01M12 19v.01"})])],-1)),t("ul",ie,[t("li",null,[t("a",{onClick:u=>F(a)},n(a.enabled?"Disable":"Enable"),9,ue)]),t("li",null,[t("a",{onClick:u=>j(a),class:k({"opacity-50":!a.enabled})}," Restart ",10,ce)]),t("li",ve,[t("a",{onClick:u=>D(a)},n(a.shared?"Make Private":"Share with Users"),9,be)])])])])],8,se))),128))])])]))],64)),l.value?(r(),o("div",he,[t("span",null,n(l.value),1),t("button",{class:"btn btn-ghost btn-xs",onClick:e[4]||(e[4]=a=>l.value="")},"Dismiss")])):w("",!0),d.value?(r(),o("div",ge,[t("div",me,[t("span",null,n(d.value),1)])])):w("",!0)]))}});export{xe as default};
diff --git a/web/frontend/dist/assets/AdminUsers-LpYNmcL8.js b/web/frontend/dist/assets/AdminUsers-LpYNmcL8.js
new file mode 100644
index 00000000..37486feb
--- /dev/null
+++ b/web/frontend/dist/assets/AdminUsers-LpYNmcL8.js
@@ -0,0 +1 @@
+import{d as T,r as u,f as g,x as $,c as l,o as n,a as t,g as f,j as p,n as x,t as o,m as M,v as U,F as A,p as D,i as E,w as j,k as N}from"./index-DMP0eryo.js";const L={class:"space-y-6 max-w-6xl mx-auto"},V={class:"flex justify-between items-center"},B=["disabled"],S={class:"stats shadow bg-base-100 w-full"},F={class:"stat"},H={class:"stat-value"},P={class:"stat"},R={class:"stat-value text-success"},q={class:"stat"},z={class:"stat-value text-base-content/40"},I={key:0,class:"flex justify-center py-12"},J={key:1,class:"alert alert-error"},O={key:2,class:"text-center py-12 text-base-content/60"},Q={key:3,class:"card bg-base-100 shadow-sm"},G={class:"p-4 border-b border-base-300"},K={class:"overflow-x-auto"},W={class:"table"},X={class:"font-medium"},Y={class:"text-sm text-base-content/60"},Z={class:"badge badge-sm badge-outline"},tt=["title"],et={key:1,class:"text-sm text-base-content/40"},st={class:"flex gap-2"},at=["onClick","disabled","title"],lt={key:0,class:"loading loading-spinner loading-xs"},nt={key:0,class:"p-8 text-center text-base-content/60"},ot={key:4,class:"alert alert-error"},ut=T({__name:"AdminUsers",setup(it){const c=u(!1),b=u(""),v=u(""),i=u([]),r=u(""),m=u(""),y=g(()=>i.value.filter(a=>!a.disabled).length),w=g(()=>i.value.filter(a=>a.disabled).length),_=g(()=>{if(!r.value)return i.value;const a=r.value.toLowerCase();return i.value.filter(e=>e.email.toLowerCase().includes(a)||e.display_name&&e.display_name.toLowerCase().includes(a))});function k(a){const e=Date.now(),d=new Date(a).getTime(),s=e-d;return s<1e3?"Just now":s<6e4?`${Math.floor(s/1e3)}s ago`:s<36e5?`${Math.floor(s/6e4)}m ago`:s<864e5?`${Math.floor(s/36e5)}h ago`:`${Math.floor(s/864e5)}d ago`}async function h(){c.value=!0,b.value="";try{const a=await fetch("/api/v1/admin/users",{credentials:"include"});if(!a.ok)throw new Error(`HTTP ${a.status}: ${a.statusText}`);const e=await a.json();i.value=Array.isArray(e)?e:[]}catch(a){b.value=a instanceof Error?a.message:"Failed to load users"}finally{c.value=!1}}async function C(a){m.value=a.id,v.value="";try{const e=a.disabled?"enable":"disable",d=await fetch(`/api/v1/admin/users/${encodeURIComponent(a.id)}/${e}`,{method:"POST",credentials:"include"});if(!d.ok){const s=await d.json().catch(()=>({}));throw new Error(s.error||`HTTP ${d.status}`)}await h()}catch(e){v.value=e instanceof Error?e.message:"Failed to update user"}finally{m.value=""}}return $(()=>{h()}),(a,e)=>{const d=N("router-link");return n(),l("div",L,[t("div",V,[e[4]||(e[4]=t("div",null,[t("h1",{class:"text-2xl font-bold"},"Users"),t("p",{class:"text-base-content/70 mt-1"},"Manage users and their access")],-1)),t("button",{onClick:h,class:"btn btn-sm btn-ghost",disabled:c.value},[(n(),l("svg",{class:x(["w-4 h-4",{"animate-spin":c.value}]),fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[...e[2]||(e[2]=[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"},null,-1)])],2)),e[3]||(e[3]=p(" Refresh ",-1))],8,B)]),t("div",S,[t("div",F,[e[5]||(e[5]=t("div",{class:"stat-title"},"Total Users",-1)),t("div",H,o(i.value.length),1)]),t("div",P,[e[6]||(e[6]=t("div",{class:"stat-title"},"Active",-1)),t("div",R,o(y.value),1)]),t("div",q,[e[7]||(e[7]=t("div",{class:"stat-title"},"Disabled",-1)),t("div",z,o(w.value),1)])]),c.value&&i.value.length===0?(n(),l("div",I,[...e[8]||(e[8]=[t("span",{class:"loading loading-spinner loading-lg"},null,-1)])])):b.value?(n(),l("div",J,[e[9]||(e[9]=t("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[t("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"})],-1)),t("span",null,o(b.value),1),t("button",{class:"btn btn-sm",onClick:h},"Try Again")])):i.value.length===0?(n(),l("div",O,[...e[10]||(e[10]=[t("p",{class:"text-lg font-medium"},"No users found",-1)])])):(n(),l("div",Q,[t("div",G,[M(t("input",{"onUpdate:modelValue":e[0]||(e[0]=s=>r.value=s),type:"text",placeholder:"Search by email or name...",class:"input input-bordered input-sm w-full max-w-xs"},null,512),[[U,r.value]])]),t("div",K,[t("table",W,[e[12]||(e[12]=t("thead",null,[t("tr",null,[t("th",null,"User"),t("th",null,"Provider"),t("th",null,"Last Login"),t("th",null,"Status"),t("th",null,"Actions")])],-1)),t("tbody",null,[(n(!0),l(A,null,D(_.value,s=>(n(),l("tr",{key:s.id,class:"hover"},[t("td",null,[t("div",null,[t("div",X,o(s.display_name||"-"),1),t("div",Y,o(s.email),1)])]),t("td",null,[t("span",Z,o(s.provider),1)]),t("td",null,[s.last_login_at?(n(),l("span",{key:0,class:"text-sm",title:s.last_login_at},o(k(s.last_login_at)),9,tt)):(n(),l("span",et,"Never"))]),t("td",null,[t("span",{class:x(["badge badge-sm",s.disabled?"badge-error":"badge-success"])},o(s.disabled?"Disabled":"Active"),3)]),t("td",null,[t("div",st,[t("button",{class:"btn btn-ghost btn-xs",onClick:dt=>C(s),disabled:m.value===s.id,title:s.disabled?"Enable user":"Disable user"},[m.value===s.id?(n(),l("span",lt)):f("",!0),p(" "+o(s.disabled?"Enable":"Disable"),1)],8,at),E(d,{to:{path:"/activity",query:{user_id:s.id}},class:"btn btn-ghost btn-xs",title:"View user's activity"},{default:j(()=>[...e[11]||(e[11]=[p(" Activity ",-1)])]),_:1},8,["to"])])])]))),128))])])]),_.value.length===0&&r.value?(n(),l("div",nt,' No users match "'+o(r.value)+'" ',1)):f("",!0)])),v.value?(n(),l("div",ot,[t("span",null,o(v.value),1),t("button",{class:"btn btn-ghost btn-xs",onClick:e[1]||(e[1]=s=>v.value="")},"Dismiss")])):f("",!0)])}}});export{ut as default};
diff --git a/web/frontend/dist/assets/AgentTokens-Cr2jVCc5.js b/web/frontend/dist/assets/AgentTokens-Cr2jVCc5.js
new file mode 100644
index 00000000..8ee7d7d9
--- /dev/null
+++ b/web/frontend/dist/assets/AgentTokens-Cr2jVCc5.js
@@ -0,0 +1 @@
+import{d as Y,e as Z,b as G,r as v,f as M,x as J,c as a,o,a as e,g as k,l as C,j as g,t as r,F as T,p as S,n as A,m as y,v as K,M as B,y as Q,z as F}from"./index-DMP0eryo.js";const X={class:"space-y-6"},ee={class:"flex justify-between items-center"},se={class:"flex gap-2"},te=["disabled"],le={key:0,class:"loading loading-spinner loading-sm"},ae={class:"stats shadow bg-base-100 w-full"},oe={class:"stat"},ne={class:"stat-value"},re={class:"stat"},ie={class:"stat-value text-success"},de={class:"stat"},ue={class:"stat-value text-warning"},ce={key:0,class:"text-center py-12"},ve={key:1,class:"alert alert-error"},me={class:"text-sm"},pe={key:2,class:"text-center py-12"},be={key:3,class:"overflow-x-auto"},ke={class:"table table-zebra w-full"},ge={class:"font-medium"},fe={class:"text-sm bg-base-200 px-2 py-1 rounded"},xe={class:"flex flex-wrap gap-1"},he={class:"flex flex-wrap gap-1"},ye={key:0,class:"text-sm"},we={key:1,class:"text-base-content/40 text-sm"},_e={key:0,class:"badge badge-error badge-sm"},Ce={key:1,class:"badge badge-warning badge-sm"},Te={key:2,class:"badge badge-success badge-sm"},Se={class:"flex gap-1"},Ae=["onClick","disabled"],Fe=["onClick","disabled"],De={key:4,class:"alert alert-warning shadow-lg"},Re={class:"flex-1"},Me={class:"flex items-center gap-2"},Be={class:"text-sm bg-neutral text-neutral-content px-3 py-2 rounded font-mono break-all"},je={class:"modal-box"},Le={class:"space-y-4"},Ee={class:"form-control"},He={key:0,class:"label"},Ie={class:"label-text-alt text-error"},Ne={key:1,class:"label"},Ve={class:"form-control"},$e={class:"flex items-center gap-2 cursor-pointer mb-2 px-1"},ze=["checked"],Ue={key:0,class:"border border-base-300 rounded-lg p-3 max-h-48 overflow-y-auto space-y-1"},Pe={key:0,class:"text-sm text-base-content/50 py-2 text-center"},We=["value"],Oe={class:"text-sm"},qe={key:0,class:"badge badge-success badge-xs ml-auto"},Ye={key:1,class:"badge badge-ghost badge-xs ml-auto"},Ze={key:1,class:"label"},Ge={class:"label-text-alt text-error"},Je={class:"form-control"},Ke={class:"flex flex-col gap-2"},Qe={class:"flex items-center gap-2 cursor-pointer"},Xe={class:"flex items-center gap-2 cursor-pointer"},es={class:"form-control"},ss={class:"modal-action"},ts=["disabled"],ls={key:0,class:"loading loading-spinner loading-sm"},ns=Y({__name:"AgentTokens",setup(as){const u=Z(),D=G(),p=v(!0),f=v(null),b=v([]),x=v(!1),m=v(null),c=v(!1),R=v(null),n=v({name:"",allServers:!0,selectedServers:[],permWrite:!1,permDestructive:!1,expiresIn:"720h"}),d=v({}),j=M(()=>D.servers.map(t=>({name:t.name,connected:t.enabled&&t.tool_count>0})).sort((t,s)=>t.name.localeCompare(s.name)));function I(t){const s=t.target.checked;n.value.allServers=s,s&&(n.value.selectedServers=[])}const N=M(()=>b.value.filter(t=>!t.revoked&&!h(t)).length),V=M(()=>b.value.filter(t=>t.revoked||h(t)).length);function h(t){return new Date(t.expires_at){c.value=!1},2e3)}catch{const t=document.createElement("textarea");t.value=m.value,document.body.appendChild(t),t.select(),document.execCommand("copy"),document.body.removeChild(t),c.value=!0,setTimeout(()=>{c.value=!1},2e3)}}function q(){m.value=null,c.value=!1}return J(async()=>{await new Promise(t=>setTimeout(t,100)),w()}),(t,s)=>(o(),a("div",X,[e("div",ee,[s[9]||(s[9]=e("div",null,[e("h1",{class:"text-3xl font-bold"},"Agent Tokens"),e("p",{class:"text-base-content/70 mt-1"},"Create and manage scoped API tokens for AI agents and automation")],-1)),e("div",se,[e("button",{onClick:s[0]||(s[0]=(...l)=>C(_)&&C(_)(...l)),disabled:p.value,class:"btn btn-outline"},[s[7]||(s[7]=e("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"})],-1)),p.value?(o(),a("span",le)):k("",!0),g(" "+r(p.value?"Refreshing...":"Refresh"),1)],8,te),e("button",{onClick:E,class:"btn btn-primary"},[...s[8]||(s[8]=[e("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 4v16m8-8H4"})],-1),g(" Create Token ",-1)])])])]),e("div",ae,[e("div",oe,[s[10]||(s[10]=e("div",{class:"stat-title"},"Total Tokens",-1)),e("div",ne,r(b.value.length),1),s[11]||(s[11]=e("div",{class:"stat-desc"},"All agent tokens",-1))]),e("div",re,[s[12]||(s[12]=e("div",{class:"stat-title"},"Active",-1)),e("div",ie,r(N.value),1),s[13]||(s[13]=e("div",{class:"stat-desc"},"Currently valid",-1))]),e("div",de,[s[14]||(s[14]=e("div",{class:"stat-title"},"Expired / Revoked",-1)),e("div",ue,r(V.value),1),s[15]||(s[15]=e("div",{class:"stat-desc"},"No longer usable",-1))])]),p.value?(o(),a("div",ce,[...s[16]||(s[16]=[e("span",{class:"loading loading-spinner loading-lg"},null,-1),e("p",{class:"mt-4"},"Loading tokens...",-1)])])):f.value?(o(),a("div",ve,[s[18]||(s[18]=e("svg",{class:"w-6 h-6",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"})],-1)),e("div",null,[s[17]||(s[17]=e("h3",{class:"font-bold"},"Failed to load tokens",-1)),e("div",me,r(f.value),1)]),e("button",{onClick:s[1]||(s[1]=(...l)=>C(_)&&C(_)(...l)),class:"btn btn-sm"}," Try Again ")])):b.value.length===0?(o(),a("div",pe,[s[20]||(s[20]=e("svg",{class:"w-24 h-24 mx-auto mb-4 opacity-50",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"})],-1)),s[21]||(s[21]=e("h3",{class:"text-xl font-semibold mb-2"},"No agent tokens yet",-1)),s[22]||(s[22]=e("p",{class:"text-base-content/70 mb-4"}," Create scoped tokens for your AI agents and automated workflows. ",-1)),e("button",{onClick:E,class:"btn btn-primary"},[...s[19]||(s[19]=[e("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 4v16m8-8H4"})],-1),g(" Create Your First Token ",-1)])])])):(o(),a("div",be,[e("table",ke,[s[25]||(s[25]=e("thead",null,[e("tr",null,[e("th",null,"Name"),e("th",null,"Prefix"),e("th",null,"Servers"),e("th",null,"Permissions"),e("th",null,"Expires"),e("th",null,"Last Used"),e("th",null,"Status"),e("th",null,"Actions")])],-1)),e("tbody",null,[(o(!0),a(T,null,S(b.value,l=>(o(),a("tr",{key:l.name},[e("td",ge,r(l.name),1),e("td",null,[e("code",fe,r(l.token_prefix),1)]),e("td",null,[e("div",xe,[(o(!0),a(T,null,S(l.allowed_servers,i=>(o(),a("span",{key:i,class:"badge badge-outline badge-sm"},r(i),1))),128))])]),e("td",null,[e("div",he,[(o(!0),a(T,null,S(l.permissions,i=>(o(),a("span",{key:i,class:A(["badge badge-sm",z(i)])},r(i),3))),128))])]),e("td",null,[e("span",{class:A({"text-warning":$(l),"text-error":h(l)})},r(L(l.expires_at)),3)]),e("td",null,[l.last_used_at?(o(),a("span",ye,r(L(l.last_used_at)),1)):(o(),a("span",we,"Never"))]),e("td",null,[l.revoked?(o(),a("span",_e,"Revoked")):h(l)?(o(),a("span",Ce,"Expired")):(o(),a("span",Te,"Active"))]),e("td",null,[e("div",Se,[e("button",{onClick:i=>P(l.name),disabled:l.revoked,class:"btn btn-xs btn-outline",title:"Regenerate token secret"},[...s[23]||(s[23]=[e("svg",{class:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"})],-1),g(" Regenerate ",-1)])],8,Ae),e("button",{onClick:i=>W(l.name),disabled:l.revoked,class:"btn btn-xs btn-error btn-outline",title:"Revoke token"},[...s[24]||(s[24]=[e("svg",{class:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636"})],-1),g(" Revoke ",-1)])],8,Fe)])])]))),128))])])])),m.value?(o(),a("div",De,[s[28]||(s[28]=e("svg",{class:"w-6 h-6 shrink-0",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"})],-1)),e("div",Re,[s[26]||(s[26]=e("h3",{class:"font-bold"},"Save this token now!",-1)),s[27]||(s[27]=e("p",{class:"text-sm mb-2"},"This token cannot be retrieved again after you dismiss this message.",-1)),e("div",Me,[e("code",Be,r(m.value),1),e("button",{onClick:O,class:A(["btn btn-sm btn-neutral shrink-0",{"btn-success":c.value}])},r(c.value?"Copied!":"Copy"),3)])]),e("button",{onClick:q,class:"btn btn-sm btn-ghost shrink-0"},"Dismiss")])):k("",!0),e("dialog",{ref_key:"createDialog",ref:R,class:"modal"},[e("div",je,[s[40]||(s[40]=e("h3",{class:"font-bold text-lg mb-4"},"Create Agent Token",-1)),e("div",Le,[e("div",Ee,[s[30]||(s[30]=e("label",{class:"label"},[e("span",{class:"label-text font-medium"},"Token Name")],-1)),y(e("input",{"onUpdate:modelValue":s[2]||(s[2]=l=>n.value.name=l),type:"text",placeholder:"e.g., ci-pipeline, dev-agent",class:A(["input input-bordered w-full",{"input-error":d.value.name}])},null,2),[[K,n.value.name]]),d.value.name?(o(),a("label",He,[e("span",Ie,r(d.value.name),1)])):(o(),a("label",Ne,[...s[29]||(s[29]=[e("span",{class:"label-text-alt"},"Alphanumeric, hyphens, and underscores only",-1)])]))]),e("div",Ve,[s[33]||(s[33]=e("label",{class:"label"},[e("span",{class:"label-text font-medium"},"Allowed Servers")],-1)),e("label",$e,[e("input",{type:"checkbox",checked:n.value.allServers,onChange:I,class:"checkbox checkbox-sm checkbox-primary"},null,40,ze),s[31]||(s[31]=e("span",{class:"text-sm font-medium"},"All servers",-1)),s[32]||(s[32]=e("span",{class:"badge badge-ghost badge-xs"},"wildcard",-1))]),n.value.allServers?k("",!0):(o(),a("div",Ue,[j.value.length===0?(o(),a("div",Pe," No servers configured ")):k("",!0),(o(!0),a(T,null,S(j.value,l=>(o(),a("label",{key:l.name,class:"flex items-center gap-2 cursor-pointer hover:bg-base-200 rounded px-2 py-1"},[y(e("input",{type:"checkbox",value:l.name,"onUpdate:modelValue":s[3]||(s[3]=i=>n.value.selectedServers=i),class:"checkbox checkbox-sm"},null,8,We),[[B,n.value.selectedServers]]),e("span",Oe,r(l.name),1),l.connected?(o(),a("span",qe,"connected")):(o(),a("span",Ye,"offline"))]))),128))])),!n.value.allServers&&d.value.servers?(o(),a("label",Ze,[e("span",Ge,r(d.value.servers),1)])):k("",!0)]),e("div",Je,[s[37]||(s[37]=e("label",{class:"label"},[e("span",{class:"label-text font-medium"},"Permissions")],-1)),e("div",Ke,[s[36]||(s[36]=e("label",{class:"flex items-center gap-2 cursor-not-allowed"},[e("input",{type:"checkbox",checked:"",disabled:"",class:"checkbox checkbox-sm checkbox-info"}),e("span",{class:"text-sm"},"read"),e("span",{class:"badge badge-info badge-xs"},"always included")],-1)),e("label",Qe,[y(e("input",{"onUpdate:modelValue":s[4]||(s[4]=l=>n.value.permWrite=l),type:"checkbox",class:"checkbox checkbox-sm checkbox-warning"},null,512),[[B,n.value.permWrite]]),s[34]||(s[34]=e("span",{class:"text-sm"},"write",-1))]),e("label",Xe,[y(e("input",{"onUpdate:modelValue":s[5]||(s[5]=l=>n.value.permDestructive=l),type:"checkbox",class:"checkbox checkbox-sm checkbox-error"},null,512),[[B,n.value.permDestructive]]),s[35]||(s[35]=e("span",{class:"text-sm"},"destructive",-1))])])]),e("div",es,[s[39]||(s[39]=e("label",{class:"label"},[e("span",{class:"label-text font-medium"},"Expires In")],-1)),y(e("select",{"onUpdate:modelValue":s[6]||(s[6]=l=>n.value.expiresIn=l),class:"select select-bordered w-full"},[...s[38]||(s[38]=[e("option",{value:"168h"},"7 days",-1),e("option",{value:"720h"},"30 days",-1),e("option",{value:"2160h"},"90 days",-1),e("option",{value:"8760h"},"365 days",-1)])],512),[[Q,n.value.expiresIn]])])]),e("div",ss,[e("button",{onClick:H,class:"btn"},"Cancel"),e("button",{onClick:U,disabled:x.value,class:"btn btn-primary"},[x.value?(o(),a("span",ls)):k("",!0),g(" "+r(x.value?"Creating...":"Create Token"),1)],8,ts)])]),s[41]||(s[41]=e("form",{method:"dialog",class:"modal-backdrop"},[e("button",null,"close")],-1))],512)]))}});export{ns as default};
diff --git a/web/frontend/dist/assets/Login-BO9OPmov.js b/web/frontend/dist/assets/Login-BO9OPmov.js
new file mode 100644
index 00000000..f3aef96e
--- /dev/null
+++ b/web/frontend/dist/assets/Login-BO9OPmov.js
@@ -0,0 +1 @@
+import{d as o,u as r,c as a,o as i,a as e,t as l}from"./index-DMP0eryo.js";const d={class:"min-h-screen flex items-center justify-center bg-base-200"},c="your organization",p=o({__name:"Login",setup(u){const s=r();function n(){s.login()}return(m,t)=>(i(),a("div",d,[e("div",{class:"card w-96 bg-base-100 shadow-xl"},[e("div",{class:"card-body items-center text-center"},[t[0]||(t[0]=e("h1",{class:"card-title text-2xl font-bold"},"MCPProxy Server",-1)),t[1]||(t[1]=e("p",{class:"text-base-content/70 mb-4"},"Sign in to access your MCP tools",-1)),t[2]||(t[2]=e("div",{class:"divider"},null,-1)),e("button",{class:"btn btn-primary w-full",onClick:n}," Sign in with "+l(c)),t[3]||(t[3]=e("p",{class:"text-sm text-base-content/50 mt-4"}," Powered by MCPProxy ",-1))])])]))}});export{p as default};
diff --git a/web/frontend/dist/assets/NotFound-alLFYf5-.js b/web/frontend/dist/assets/NotFound-alLFYf5-.js
new file mode 100644
index 00000000..2fa3e067
--- /dev/null
+++ b/web/frontend/dist/assets/NotFound-alLFYf5-.js
@@ -0,0 +1 @@
+import{d as s,c as n,o as a,a as e,i as r,w as l,k as d,j as m}from"./index-DMP0eryo.js";const i={class:"text-center py-20"},u=s({__name:"NotFound",setup(p){return(x,t)=>{const o=d("router-link");return a(),n("div",i,[t[1]||(t[1]=e("h1",{class:"text-6xl font-bold text-base-content/50 mb-4"},"404",-1)),t[2]||(t[2]=e("h2",{class:"text-2xl font-semibold mb-4"},"Page Not Found",-1)),t[3]||(t[3]=e("p",{class:"text-base-content/70 mb-8"}," The page you're looking for doesn't exist or has been moved. ",-1)),r(o,{to:"/",class:"btn btn-primary"},{default:l(()=>[...t[0]||(t[0]=[m(" Go Home ",-1)])]),_:1})])}}});export{u as default};
diff --git a/web/frontend/dist/assets/Repositories-Ob_RpJWO.js b/web/frontend/dist/assets/Repositories-Ob_RpJWO.js
new file mode 100644
index 00000000..00c3be52
--- /dev/null
+++ b/web/frontend/dist/assets/Repositories-Ob_RpJWO.js
@@ -0,0 +1 @@
+import{d as $,r,f as T,x as U,c as a,o as l,a as e,g as v,i as B,m as P,y as q,F as j,p as V,v as E,t as d,w as G,T as Q,B as z,C as J,z as x,j as w}from"./index-DMP0eryo.js";const K={class:"space-y-6"},O={class:"card bg-base-100 shadow-md"},W={class:"card-body"},X={class:"flex flex-col sm:flex-row gap-4"},Y={class:"form-control flex-1"},Z=["disabled"],ee=["value"],se={class:"form-control flex-1"},te=["disabled"],oe={class:"form-control sm:self-end"},ae=["disabled"],le={key:0,class:"loading loading-spinner loading-sm"},ne={key:1},ie={key:0,class:"alert alert-info mt-4"},re={class:"font-semibold"},de={class:"text-sm"},ce={key:0,class:"card bg-base-100 shadow-md"},ue={key:1,class:"alert alert-error"},ve={key:2,class:"space-y-4"},pe={class:"flex justify-between items-center"},he={class:"text-sm text-base-content/70"},me={class:"card-body"},fe={class:"flex justify-between items-start"},be={class:"card-title text-lg"},ge={class:"badge badge-outline badge-sm"},ye={class:"text-sm text-base-content/70 line-clamp-3"},_e={class:"flex flex-wrap gap-2 mt-2"},xe={key:0,class:"badge badge-success badge-sm"},we={key:1,class:"badge badge-info badge-sm"},ke={key:0,class:"mt-3"},Ce={class:"flex items-center justify-between bg-base-200 rounded px-2 py-1"},Me={class:"text-xs flex-1 overflow-x-auto"},Se=["onClick"],Re={class:"card-actions justify-end mt-4"},Te=["onClick"],Be=["onClick","disabled"],Pe={key:0,class:"loading loading-spinner loading-xs"},je={key:1},Ve={key:3,class:"card bg-base-100 shadow-md"},ze={key:4,class:"card bg-base-100 shadow-md"},He={key:5,class:"toast toast-end"},Fe={class:"alert alert-success"},Le=$({__name:"Repositories",setup(Ie){const m=r([]),i=r(""),p=r(""),c=r([]),f=r(!1),u=r(!1),n=r(null),h=r(null),b=r(!1),k=r("");let g=null;const y=T(()=>m.value.find(t=>t.id===i.value)),H=T(()=>[{icon:"📦",title:"Discover MCP Servers",description:"Browse official and community MCP servers from multiple registries",sections:[{title:"How to use",list:["Select a registry from the dropdown menu","Search for servers by name or description",'Click "Add to MCP" to install a server',"View source code and installation commands for each server"]}]},{icon:"🤖",title:"LLM Agent Integration",description:"Let AI agents help you discover and install MCP servers",sections:[{title:"Example prompts",list:["Find and add MCP servers for working with GitHub","Install the best MCP server for file system operations","Search for database-related MCP servers and add them","Discover Slack integration servers and configure them"]}]},{icon:"💡",title:"Installation Tips",description:"Servers can be installed via npm, pip, or connected remotely",sections:[{title:"Server types",list:["NPM packages: Installed with npx command","Python packages: Installed with uvx or pipx","Remote servers: Connected via HTTP endpoints","Docker containers: Run in isolated environments"]}]}]);async function F(){f.value=!0,n.value=null;try{const t=await x.listRegistries();t.success&&t.data?m.value=t.data.registries:n.value=t.error||"Failed to load registries"}catch(t){n.value="Failed to load registries: "+t.message}finally{f.value=!1}}async function _(){if(i.value){u.value=!0,n.value=null;try{const t=await x.searchRegistryServers(i.value,{query:p.value,limit:20});t.success&&t.data?c.value=t.data.servers:(n.value=t.error||"Failed to search servers",c.value=[])}catch(t){n.value="Failed to search servers: "+t.message,c.value=[]}finally{u.value=!1}}}function I(){p.value="",c.value=[],n.value=null,i.value&&_()}function N(){g&&clearTimeout(g),g=setTimeout(()=>{i.value&&_()},500)}async function L(t){h.value=t.id,n.value=null;try{const s=await x.addServerFromRepository(t);s.success?C(`Server "${t.name}" added successfully!`):n.value=s.error||"Failed to add server"}catch(s){n.value="Failed to add server: "+s.message}finally{h.value=null}}function D(t){navigator.clipboard.writeText(t),C("Installation command copied to clipboard!")}function A(t){window.open(t,"_blank")}function C(t){k.value=t,b.value=!0,setTimeout(()=>{b.value=!1},3e3)}return U(()=>{F()}),(t,s)=>(l(),a("div",K,[s[15]||(s[15]=e("div",{class:"flex justify-between items-center"},[e("div",null,[e("h1",{class:"text-3xl font-bold"},"Repositories"),e("p",{class:"text-base-content/70 mt-1"},"Browse and discover MCP server repositories")])],-1)),e("div",O,[e("div",W,[e("div",X,[e("div",Y,[s[3]||(s[3]=e("label",{class:"label"},[e("span",{class:"label-text font-semibold"},"Select Registry")],-1)),P(e("select",{"onUpdate:modelValue":s[0]||(s[0]=o=>i.value=o),class:"select select-bordered w-full",onChange:I,disabled:f.value},[s[2]||(s[2]=e("option",{disabled:"",value:""},"Choose a registry...",-1)),(l(!0),a(j,null,V(m.value,o=>(l(),a("option",{key:o.id,value:o.id},d(o.name),9,ee))),128))],40,Z),[[q,i.value]])]),e("div",se,[s[4]||(s[4]=e("label",{class:"label"},[e("span",{class:"label-text font-semibold"},"Search Servers")],-1)),P(e("input",{"onUpdate:modelValue":s[1]||(s[1]=o=>p.value=o),type:"text",placeholder:"Search by name or description...",class:"input input-bordered w-full",onInput:N,disabled:!i.value||u.value},null,40,te),[[E,p.value]])]),e("div",oe,[e("button",{onClick:_,class:"btn btn-primary",disabled:!i.value||u.value},[u.value?(l(),a("span",le)):(l(),a("span",ne,"Search"))],8,ae)])]),y.value?(l(),a("div",ie,[s[5]||(s[5]=e("svg",{class:"w-5 h-5",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"})],-1)),e("div",null,[e("p",re,d(y.value.name),1),e("p",de,d(y.value.description),1)])])):v("",!0)])]),u.value?(l(),a("div",ce,[...s[6]||(s[6]=[e("div",{class:"card-body"},[e("div",{class:"flex flex-col items-center justify-center py-12"},[e("div",{class:"loading loading-spinner loading-lg mb-4"}),e("p",{class:"text-base-content/70"},"Searching servers...")])],-1)])])):n.value?(l(),a("div",ue,[s[7]||(s[7]=e("svg",{class:"w-6 h-6",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"})],-1)),e("span",null,d(n.value),1)])):c.value.length>0?(l(),a("div",ve,[e("div",pe,[e("p",he,"Found "+d(c.value.length)+" server(s)",1)]),B(Q,{name:"repo-card",tag:"div",class:"grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4"},{default:G(()=>[(l(!0),a(j,null,V(c.value,o=>{var M,S;return l(),a("div",{key:o.id,class:"card bg-base-100 shadow-md hover:shadow-lg transition-shadow"},[e("div",me,[e("div",fe,[e("h3",be,d(o.name),1),e("div",ge,d(o.registry),1)]),e("p",ye,d(o.description),1),e("div",_e,[(S=(M=o.repository_info)==null?void 0:M.npm)!=null&&S.exists?(l(),a("div",xe,[...s[8]||(s[8]=[e("svg",{class:"w-3 h-3 mr-1",fill:"currentColor",viewBox:"0 0 24 24"},[e("path",{d:"M0 0h24v24H0z",fill:"none"}),e("path",{d:"M9 16.17L4.83 12l-1.42 1.41L9 19 21 7l-1.41-1.41z"})],-1),w(" NPM ",-1)])])):v("",!0),o.url?(l(),a("div",we,[...s[9]||(s[9]=[e("svg",{class:"w-3 h-3 mr-1",fill:"currentColor",viewBox:"0 0 24 24"},[e("path",{d:"M0 0h24v24H0z",fill:"none"}),e("path",{d:"M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z"})],-1),w(" Remote ",-1)])])):v("",!0)]),o.installCmd?(l(),a("div",ke,[e("div",Ce,[e("code",Me,d(o.installCmd),1),e("button",{onClick:R=>D(o.installCmd),class:"btn btn-ghost btn-xs ml-2",title:"Copy install command"},[...s[10]||(s[10]=[e("svg",{class:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24"},[e("path",{"stroke-linecap":"round","stroke-linejoin":"round","stroke-width":"2",d:"M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z"})],-1)])],8,Se)])])):v("",!0),e("div",Re,[o.source_code_url?(l(),a("button",{key:0,onClick:R=>A(o.source_code_url),class:"btn btn-ghost btn-sm"},[...s[11]||(s[11]=[e("svg",{class:"w-4 h-4 mr-1",fill:"currentColor",viewBox:"0 0 24 24"},[e("path",{d:"M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"})],-1),w(" Source ",-1)])],8,Te)):v("",!0),e("button",{onClick:R=>L(o),class:"btn btn-primary btn-sm",disabled:h.value===o.id},[h.value===o.id?(l(),a("span",Pe)):(l(),a("span",je,"Add to MCP"))],8,Be)])])])}),128))]),_:1})])):i.value?(l(),a("div",ze,[...s[13]||(s[13]=[z('No Servers Found
Try adjusting your search query or select a different registry.
Select a Registry
Choose a registry from the dropdown to start browsing MCP servers.
Powerful Tool Search
Use our BM25-powered search to find the perfect tool for your task. Search by name, description, or functionality.
Natural Language
Search using natural descriptions like "send email" or "file operations"
Relevance Scoring
Results ranked by relevance with visual score indicators
Cross-Server
Search across all connected MCP servers simultaneously
About MCP Sessions
MCP sessions represent individual connections from AI clients (like Claude Code) to MCPProxy. Each session tracks:
- Tool Calls: Number of tool invocations made during the session
- Token Usage: Total tokens consumed across all tool calls
- Duration: Time from connection to disconnection
Sessions are retained for the 100 most recent connections.
Configuration Tips
• Use Ctrl+Space for autocomplete
• Use Ctrl+F to search in the configuration
• Invalid JSON will be highlighted with red squiggles
• Hot-reloadable: server changes, limits, logging
• Requires restart: listen address, data directory, API key, TLS
🔒 Authentication Required
The API key is invalid or missing. You need an API key to access the MCPProxy web interface.
How to get the API key:
- Using Tray: Right-click the MCPProxy tray icon and select "Open Web UI"
- From Logs: Check mcpproxy startup logs for the API key, then add
?apikey=YOUR_KEY to the URL - Manual Entry: Enter your API key below if you have it