fabro/docs/public
Scott Werner 173968a780
Some checks are pending
Rust / Format (push) Waiting to run
Rust / Clippy (push) Waiting to run
Rust / Generated Docs (push) Waiting to run
Rust / Test (Linux) (push) Waiting to run
Rust / Test (macOS) (push) Waiting to run
TypeScript / Typecheck (push) Waiting to run
TypeScript / Test (push) Waiting to run
TypeScript / Build (push) Waiting to run
feat(server): mcp-servers HTTP API — handlers + AppState wiring (#532)
## What

Adds the **mcp-servers HTTP API**: `GET/POST /api/v1/mcp-servers` and
`GET/PUT/DELETE /api/v1/mcp-servers/{id}` on top of the merged
`fabro-mcp-store` foundation and OpenAPI spec.

This includes the AppState wiring needed for the catalog to work end to
end: `McpServerStore` construction from `{active-config-dir}/mcps/`, an
`AppState` accessor, the `fabro-server` dependency, and route
registration for list/create/get/replace/delete handlers.

The API mirrors the automations concurrency pattern with ETags on
read/write responses and required `If-Match` headers for replace/delete.

## Resolved before merge

- **Credential-omitting read model:** read responses now return
`McpServerView` / `McpTransportView`, so stored env/header values are
not exposed by GET/list/create/replace responses. Responses include only
`env_keys` / `header_keys`; persisted values remain available to runtime
execution.
- **Manifest catalog references:** run manifest validation, graph
rendering, preflight, and run creation now resolve server-managed MCP
catalog references such as `[run.agent.mcps.<name>] id = "..."`.
- **Schema strictness:** unknown MCP transport fields are rejected,
aligning the reused Rust domain type with the OpenAPI
`additionalProperties: false` contract.
- **Create response headers:** the `POST /mcp-servers` 201 response now
documents its `ETag` header in OpenAPI.

## Follow-up intentionally left out

Credential-literal validation remains structural only: create/replace
currently accept literal env/header values and persist them for runtime
use. The warn-vs-hard-reject UX is a separate follow-up for the settings
UI; it is not a response-omission issue.

## Testing

Current PR checks are green:

- Rust: format, clippy, generated docs, Linux tests
- TypeScript: build, test, typecheck

Local checks run during the simplify/CI-fix pass:

- `cargo +nightly-2026-04-14 fmt --check --all`
- `cargo +nightly-2026-04-14 clippy --locked --workspace --all-targets
-- -D warnings`
- `cargo nextest run -p fabro-config run_agent_mcps`
- `cargo nextest run -p fabro-mcp-store`
- `cargo nextest run -p fabro-api --test mcp_server_round_trip`
- `cargo build -p fabro-api`
- `cargo nextest run -p fabro-server --features test-support
system_sandbox_provider`
- `cargo nextest run -p fabro-server --features test-support --test it
mcp_servers`

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-30 15:06:24 -04:00
..
administration feat(web): add server-managed Environments CRUD settings UI (#462) 2026-06-13 08:44:38 -04:00
agents feat(sandbox): secure daytona snapshot names (#429) 2026-05-27 11:52:35 -04:00
api-reference feat(server): mcp-servers HTTP API — handlers + AppState wiring (#532) 2026-06-30 15:06:24 -04:00
changelog feat(web): add server-managed Environments CRUD settings UI (#462) 2026-06-13 08:44:38 -04:00
core-concepts fix(cli): use server catalog for provider login (#529) 2026-06-26 08:46:38 -04:00
examples feat(sandbox): secure daytona snapshot names (#429) 2026-05-27 11:52:35 -04:00
execution feat(workflow): support overriding cwd for local sandbox provider (#467) 2026-06-14 12:32:32 -04:00
getting-started refactor: rationalize server secret scopes (vault-only for optional int… (#401) 2026-05-25 17:26:01 -04:00
human-tools fix(config): disable Slack unless configured 2026-06-02 18:41:36 -04:00
images Add system resources settings page (#328) 2026-05-20 17:22:53 -04:00
integrations fix(cli): use server catalog for provider login (#529) 2026-06-26 08:46:38 -04:00
languages refactor(docs): split docs/ into public/ and internal/ 2026-04-27 07:21:13 -07:00
logo refactor(docs): split docs/ into public/ and internal/ 2026-04-27 07:21:13 -07:00
reference feat(llm): Amazon Bedrock provider — Converse codec, SigV4 + API-key auth (#459) 2026-06-16 11:46:49 -04:00
tutorials docs: sync product docs with runtime changes 2026-05-26 21:55:17 -04:00
workflows docs: refresh changelog and sync product docs 2026-06-11 11:04:31 -04:00
.mintignore refactor(docs): move .mintignore into docs/public and update skill paths 2026-04-27 07:29:59 -07:00
docs.json feat(llm): Amazon Bedrock provider — Converse codec, SigV4 + API-key auth (#459) 2026-06-16 11:46:49 -04:00
dot-highlight.js refactor(docs): split docs/ into public/ and internal/ 2026-04-27 07:21:13 -07:00
favicon.svg refactor(docs): split docs/ into public/ and internal/ 2026-04-27 07:21:13 -07:00