feat(adminapi): MCP tab — DB-backed server list + bridge file sync

MCP servers move from config/mcp.json to kv_settings key 'cfg.mcp.servers'.
Startup prefers the DB value; falls back to the legacy file when the DB
key is unset so existing deployments keep working without migration.

New /mcp admin tab lists every configured server and exposes per-row edit
(URL, type, headers, allow/deny tools) + delete, plus an "Add new server"
form at the bottom. Saves POST to /mcp/{name}/set and always re-render the
full page so the row reflects the persisted state.

Claude Bridge sync: when MCP_BRIDGE_EXPORT_PATH is set, every save mirrors
the list to that path in Claude Desktop format (\"mcpServers\" wrapper).
Atomic write via tempfile+rename. The bridge re-reads the file on each
claude -p call, so no restart on either side.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Alexey Panfilov

cmd/agent/main.go

@@ -224,12 +224,32 @@ func main() {
 	// runtime role changes (admin UI) take effect without a restart.
 	compacter := agent.NewCompacter(router)
 
-	// Init MCP client
+	// Init MCP client. DB (kv_settings) wins over the legacy mcp.json file —
+	// the admin UI writes there, so any user-edited list is authoritative.
 	var mcpClient *mcp.Client
-	mcpServers, err := config.LoadMCPServers("config/mcp.json")
-	if err != nil {
-		logger.Warn("failed to load mcp.json", "err", err)
+	var mcpServers map[string]config.MCPServerConfig
+	var mcpSource string
+	if ss, ok := s.(llm.SettingsStore); ok {
+		mcpCtx, mcpCancel := context.WithTimeout(context.Background(), 3*time.Second)
+		if dbServers, found, dbErr := adminapi.LoadMCPServersFromSettings(mcpCtx, ss); dbErr != nil {
+			logger.Warn("failed to load MCP servers from DB; falling back to file", "err", dbErr)
+		} else if found {
+			mcpServers = dbServers
+			mcpSource = "db"
+		}
+		mcpCancel()
+	}
+	if mcpServers == nil {
+		fileServers, err := config.LoadMCPServers("config/mcp.json")
+		if err != nil {
+			logger.Warn("failed to load mcp.json", "err", err)
+		}
+		mcpServers = fileServers
+		if fileServers != nil {
+			mcpSource = "file"
+		}
 	}
+	logger.Info("MCP config loaded", "servers", len(mcpServers), "source", mcpSource)
 	if len(mcpServers) > 0 {
 		mcpClient = mcp.NewClient(mcpServers, logger)
 		initCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)

internal/adminapi/handlers.go

@@ -4,10 +4,12 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"os"
 	"sort"
 	"strings"
 	"time"
 
+	"telegram-agent/internal/config"
 	"telegram-agent/internal/llm"
 )
 
@@ -661,6 +663,225 @@ func (s *Server) firstGeminiAPIKey() string {
 	return ""
 }
 
+// --- MCP page ---
+
+type uiMCPRow struct {
+	Name       string
+	URL        string
+	Headers    string // JSON-serialised, one per line, for display/edit in a textarea
+	AllowTools string // comma-separated
+	DenyTools  string // comma-separated
+	Type       string
+}
+
+type uiMCPData struct {
+	ActiveTab    string
+	Servers      []uiMCPRow
+	BridgeExport string // MCP_BRIDGE_EXPORT_PATH if set, shown as a banner note
+	SavedName    string // non-empty after a successful save — used by template to flash a success message
+}
+
+// loadMCPForUI returns the current MCP list flattened into UI rows. Prefers
+// the DB list; falls back to the legacy mcp.json file so users landing on
+// the page for the first time see their existing config instead of an
+// empty table.
+func (s *Server) loadMCPForUI(ctx context.Context) map[string]config.MCPServerConfig {
+	if servers, found, _ := LoadMCPServersFromSettings(ctx, s.settings); found {
+		return servers
+	}
+	// File fallback — best effort.
+	if servers, err := config.LoadMCPServers("config/mcp.json"); err == nil {
+		return servers
+	}
+	return nil
+}
+
+func mcpToRows(servers map[string]config.MCPServerConfig) []uiMCPRow {
+	names := sortedMCPServerNames(servers)
+	out := make([]uiMCPRow, 0, len(names))
+	for _, n := range names {
+		sv := servers[n]
+		hdrLines := make([]string, 0, len(sv.Headers))
+		hdrKeys := make([]string, 0, len(sv.Headers))
+		for k := range sv.Headers {
+			hdrKeys = append(hdrKeys, k)
+		}
+		sort.Strings(hdrKeys)
+		for _, k := range hdrKeys {
+			hdrLines = append(hdrLines, k+": "+sv.Headers[k])
+		}
+		out = append(out, uiMCPRow{
+			Name:       n,
+			URL:        sv.URL,
+			Type:       sv.Type,
+			Headers:    strings.Join(hdrLines, "\n"),
+			AllowTools: strings.Join(sv.AllowTools, ","),
+			DenyTools:  strings.Join(sv.DenyTools, ","),
+		})
+	}
+	return out
+}
+
+func (s *Server) handleMCP(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
+	defer cancel()
+	data := uiMCPData{
+		ActiveTab:    "mcp",
+		Servers:      mcpToRows(s.loadMCPForUI(ctx)),
+		BridgeExport: os.Getenv("MCP_BRIDGE_EXPORT_PATH"),
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := render(w, viewMCP, data); err != nil {
+		s.logger.Error("render mcp", "err", err)
+		http.Error(w, "render error", http.StatusInternalServerError)
+	}
+}
+
+// parseHeadersText splits "Key: value" lines into a map. Blank lines are
+// ignored; malformed lines are silently dropped so a UI save with partial
+// typing doesn't wipe the entry.
+func parseHeadersText(text string) map[string]string {
+	out := map[string]string{}
+	for _, line := range strings.Split(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		k, v, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		k = strings.TrimSpace(k)
+		v = strings.TrimSpace(v)
+		if k == "" {
+			continue
+		}
+		out[k] = v
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// splitCSV turns "a,b, c" into ["a","b","c"], trimming and dropping blanks.
+func splitCSV(s string) []string {
+	if strings.TrimSpace(s) == "" {
+		return nil
+	}
+	parts := strings.Split(s, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if t := strings.TrimSpace(p); t != "" {
+			out = append(out, t)
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// handleMCPSet: POST /mcp/{name}/set with body url, headers, allow_tools,
+// deny_tools, type. Upserts the named server in the DB-backed list. Writes
+// the bridge mirror file on success.
+func (s *Server) handleMCPSet(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	name := strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/mcp/"), "/set")
+	name = strings.TrimSpace(name)
+	if name == "" || strings.ContainsAny(name, "/ \t\n") {
+		http.Error(w, "invalid server name", http.StatusBadRequest)
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "parse form", http.StatusBadRequest)
+		return
+	}
+	if s.settings == nil {
+		http.Error(w, "settings store not available", http.StatusServiceUnavailable)
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+	defer cancel()
+
+	current := s.loadMCPForUI(ctx)
+	if current == nil {
+		current = map[string]config.MCPServerConfig{}
+	}
+	url := strings.TrimSpace(r.FormValue("url"))
+	if url == "" {
+		http.Error(w, "url required", http.StatusBadRequest)
+		return
+	}
+	current[name] = config.MCPServerConfig{
+		Type:       strings.TrimSpace(r.FormValue("type")),
+		URL:        url,
+		Headers:    parseHeadersText(r.FormValue("headers")),
+		AllowTools: splitCSV(r.FormValue("allow_tools")),
+		DenyTools:  splitCSV(r.FormValue("deny_tools")),
+	}
+	if err := saveMCPServers(ctx, s.settings, current); err != nil {
+		s.logger.Warn("mcp save failed", "name", name, "err", err)
+		http.Error(w, "save failed: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	s.logger.Info("mcp server updated", "name", name, "url", url)
+	// Re-render the page so the new row shows up.
+	data := uiMCPData{
+		ActiveTab:    "mcp",
+		Servers:      mcpToRows(current),
+		BridgeExport: os.Getenv("MCP_BRIDGE_EXPORT_PATH"),
+		SavedName:    name,
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := render(w, viewMCP, data); err != nil {
+		s.logger.Error("render mcp after save", "err", err)
+	}
+}
+
+// handleMCPDelete: POST /mcp/{name}/delete. Removes the named server.
+func (s *Server) handleMCPDelete(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	name := strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/mcp/"), "/delete")
+	name = strings.TrimSpace(name)
+	if name == "" {
+		http.Error(w, "name required", http.StatusBadRequest)
+		return
+	}
+	if s.settings == nil {
+		http.Error(w, "settings store not available", http.StatusServiceUnavailable)
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+	defer cancel()
+
+	current := s.loadMCPForUI(ctx)
+	if _, ok := current[name]; !ok {
+		http.Error(w, "unknown server: "+name, http.StatusNotFound)
+		return
+	}
+	delete(current, name)
+	if err := saveMCPServers(ctx, s.settings, current); err != nil {
+		s.logger.Warn("mcp delete failed", "name", name, "err", err)
+		http.Error(w, "save failed: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	s.logger.Info("mcp server deleted", "name", name)
+	data := uiMCPData{
+		ActiveTab:    "mcp",
+		Servers:      mcpToRows(current),
+		BridgeExport: os.Getenv("MCP_BRIDGE_EXPORT_PATH"),
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	_ = render(w, viewMCP, data)
+}
+
 // --- Settings page ---
 
 // settingSpec describes one user-editable scalar for the Settings tab.

internal/adminapi/mcp.go

@@ -0,0 +1,97 @@
+package adminapi
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"telegram-agent/internal/config"
+	"telegram-agent/internal/llm"
+)
+
+// SettingKeyMCPServers is the kv_settings key holding the current MCP
+// server list (JSON-encoded map[name]MCPServerConfig). Source of truth —
+// whatever the admin UI writes wins over the legacy mcp.json file at
+// startup.
+const SettingKeyMCPServers = "cfg.mcp.servers"
+
+// LoadMCPServersFromSettings reads the DB-backed MCP list. Returns (nil,
+// false, nil) when no override is set so the caller can fall back to the
+// legacy file. Returns an error only on corrupted JSON — missing value is
+// not an error.
+func LoadMCPServersFromSettings(ctx context.Context, s llm.SettingsStore) (map[string]config.MCPServerConfig, bool, error) {
+	if s == nil {
+		return nil, false, nil
+	}
+	v, ok, err := s.GetSetting(ctx, SettingKeyMCPServers)
+	if err != nil || !ok || strings.TrimSpace(v) == "" {
+		return nil, false, err
+	}
+	var out map[string]config.MCPServerConfig
+	if err := json.Unmarshal([]byte(v), &out); err != nil {
+		return nil, true, fmt.Errorf("parse mcp servers from settings: %w", err)
+	}
+	return out, true, nil
+}
+
+// saveMCPServers writes the full MCP list to kv_settings. Replaces the
+// entire value — the admin UI always sends a complete picture. Also
+// mirrors the list to MCP_BRIDGE_EXPORT_PATH when set (for claude-bridge).
+func saveMCPServers(ctx context.Context, s llm.SettingsStore, servers map[string]config.MCPServerConfig) error {
+	if s == nil {
+		return fmt.Errorf("settings store not available")
+	}
+	data, err := json.Marshal(servers)
+	if err != nil {
+		return err
+	}
+	if err := s.PutSetting(ctx, SettingKeyMCPServers, string(data)); err != nil {
+		return err
+	}
+	// Best-effort mirror for claude-bridge — failures are logged upstream
+	// but don't roll back the DB write.
+	if path := os.Getenv("MCP_BRIDGE_EXPORT_PATH"); path != "" {
+		if err := writeBridgeMCPFile(path, servers); err != nil {
+			return fmt.Errorf("mirror to bridge file: %w", err)
+		}
+	}
+	return nil
+}
+
+// writeBridgeMCPFile renders the MCP server map in Claude Desktop format
+// (wrapped in {"mcpServers": {...}}) and writes it atomically. The bridge
+// reads this file once per `claude -p` invocation so no restart is needed
+// on either side.
+func writeBridgeMCPFile(path string, servers map[string]config.MCPServerConfig) error {
+	wrapper := map[string]any{"mcpServers": servers}
+	data, err := json.MarshalIndent(wrapper, "", "  ")
+	if err != nil {
+		return err
+	}
+	// Ensure parent dir exists — the first deploy may run before the path is created.
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return err
+	}
+	// Atomic write via tempfile + rename so claude-bridge never observes a
+	// half-written file.
+	tmp := path + ".tmp"
+	if err := os.WriteFile(tmp, data, 0o644); err != nil {
+		return err
+	}
+	return os.Rename(tmp, path)
+}
+
+// sortedMCPServerNames returns map keys sorted alphabetically for stable UI
+// rendering.
+func sortedMCPServerNames(m map[string]config.MCPServerConfig) []string {
+	names := make([]string, 0, len(m))
+	for k := range m {
+		names = append(names, k)
+	}
+	sort.Strings(names)
+	return names
+}