feat(mcp): hot-reload bot client on admin UI save/delete

Saving or deleting an MCP server in the admin UI only persisted to
kv_settings — the bot's MCP client kept its stale connections until a
container restart. /mcp update also still pointed at the unmounted
legacy config/mcp.json file, so the emergency fallback was broken too.

- adminapi.Server gains an optional MCPReloader hook; set/delete
  handlers call it synchronously (30 s timeout) after saveMCPServers
  and surface success/failure in the page flash.
- Telegram /mcp update now reads from a user-supplied loader, wired in
  main.go to adminapi.LoadMCPServersFromSettings (kv_settings first,
  file fallback for local dev).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Alexey Panfilov

cmd/agent/main.go

@@ -385,6 +385,16 @@ func main() {
 	if cfg.AdminAPI.Enabled && cfg.AdminAPI.BaseURL != "" {
 		handler.SetAdminBaseURL(cfg.AdminAPI.BaseURL)
 	}
+	// /mcp update reads the live config from kv_settings (source of truth),
+	// falling back to whatever the legacy file holds when the DB is empty.
+	handler.SetMCPLoader(func(ctx context.Context) (map[string]config.MCPServerConfig, error) {
+		if servers, found, err := adminapi.LoadMCPServersFromSettings(ctx, settingsStore); err != nil {
+			return nil, err
+		} else if found {
+			return servers, nil
+		}
+		return config.LoadMCPServers("config/mcp.json")
+	})
 
 	if cfg.VoiceAPI.Enabled {
 		// chat_id: DB override > config. Non-destructive: if no DB value,
@@ -409,6 +419,7 @@ func main() {
 		adminCfg := cfg.AdminAPI
 		adminCfg.TrustForwardAuth = llm.GetBoolSetting(settingsCtx, settingsStore, llm.SettingKeyTrustForwardAuth, adminCfg.TrustForwardAuth)
 		adminSrv := adminapi.New(adminCfg, router, capStore, settingsStore, usageStore, cfg, logger)
+		adminSrv.SetMCPReloader(ag)
 		if err := adminSrv.Start(); err != nil {
 			logger.Error("admin API failed to start", "err", err)
 		} else {

internal/adminapi/handlers.go

@@ -679,6 +679,28 @@ type uiMCPData struct {
 	Servers      []uiMCPRow
 	BridgeExport string // MCP_BRIDGE_EXPORT_PATH if set, shown as a banner note
 	SavedName    string // non-empty after a successful save — used by template to flash a success message
+	ReloadOK     string // non-empty on successful live reload (e.g. "3 servers, 42 tools")
+	ReloadErr    string // non-empty if the live reload failed after the DB save
+}
+
+// reloadMCPLive hot-reloads the bot's MCP client with the given config set.
+// Uses a detached context with a 30 s timeout — the request's context is
+// typically 5 s which isn't enough to reconnect several servers. Returns
+// human-readable strings for the UI flash; empty strings if no reloader is
+// wired.
+func (s *Server) reloadMCPLive(servers map[string]config.MCPServerConfig) (okMsg, errMsg string) {
+	if s.reloader == nil {
+		return "", ""
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	toolCount, err := s.reloader.ReloadMCP(ctx, servers)
+	if err != nil {
+		s.logger.Warn("mcp live reload failed", "err", err)
+		return "", err.Error()
+	}
+	s.logger.Info("mcp live reload ok", "servers", len(servers), "tools", toolCount)
+	return fmt.Sprintf("%d servers, %d tools", len(servers), toolCount), ""
 }
 
 // loadMCPForUI returns the current MCP list flattened into UI rows. Prefers
@@ -829,12 +851,15 @@ func (s *Server) handleMCPSet(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.logger.Info("mcp server updated", "name", name, "url", url)
+	reloadOK, reloadErr := s.reloadMCPLive(current)
 	// Re-render the page so the new row shows up.
 	data := uiMCPData{
 		ActiveTab:    "mcp",
 		Servers:      mcpToRows(current),
 		BridgeExport: os.Getenv("MCP_BRIDGE_EXPORT_PATH"),
 		SavedName:    name,
+		ReloadOK:     reloadOK,
+		ReloadErr:    reloadErr,
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := render(w, viewMCP, data); err != nil {
@@ -873,10 +898,13 @@ func (s *Server) handleMCPDelete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.logger.Info("mcp server deleted", "name", name)
+	reloadOK, reloadErr := s.reloadMCPLive(current)
 	data := uiMCPData{
 		ActiveTab:    "mcp",
 		Servers:      mcpToRows(current),
 		BridgeExport: os.Getenv("MCP_BRIDGE_EXPORT_PATH"),
+		ReloadOK:     reloadOK,
+		ReloadErr:    reloadErr,
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	_ = render(w, viewMCP, data)

internal/adminapi/server.go

@@ -17,6 +17,12 @@ import (
 	"telegram-agent/internal/llm"
 )
 
+// MCPReloader is the minimal surface the admin UI needs from the bot's MCP
+// client to hot-reload after a save/delete. Agent implements it; nil-safe.
+type MCPReloader interface {
+	ReloadMCP(ctx context.Context, configs map[string]config.MCPServerConfig) (int, error)
+}
+
 // Server wraps an http.Server + the upstream dependencies it needs to render
 // and mutate routing state.
 type Server struct {
@@ -26,11 +32,16 @@ type Server struct {
 	settings   llm.SettingsStore // for AA cache persistence; may be nil
 	usageStore llm.UsageStore    // for Usage/Cost section; may be nil
 	cfgRef     *config.Config    // needed for enumerating OpenRouter slots
+	reloader   MCPReloader       // may be nil (local dev / tests)
 	logger     *slog.Logger
 
 	httpSrv *http.Server
 }
 
+// SetMCPReloader wires the hot-reload hook so saving/deleting MCP servers in
+// the UI applies immediately without a container restart.
+func (s *Server) SetMCPReloader(r MCPReloader) { s.reloader = r }
+
 // New constructs the admin API server but does not start it. Call Start to
 // bind the listener.
 func New(cfg config.AdminAPIConfig, router *llm.Router, capStore llm.CapabilityStore, settings llm.SettingsStore, usageStore llm.UsageStore, cfgRef *config.Config, logger *slog.Logger) *Server {

internal/adminapi/templates/mcp.html

@@ -14,6 +14,7 @@
   .mcp-actions { display: flex; gap: 0.5rem; margin-top: 0.5rem; }
   .mcp-bridge-note { background: #fff3e0; color: #92400e; padding: 0.5rem 0.75rem; border-radius: 4px; margin-bottom: 1rem; font-size: 0.9em; }
   .mcp-flash-ok { background: #dcfce7; color: #15803d; padding: 0.5rem 0.75rem; border-radius: 4px; margin-bottom: 1rem; font-size: 0.9em; }
+  .mcp-flash-err { background: #fee2e2; color: #991b1b; padding: 0.5rem 0.75rem; border-radius: 4px; margin-bottom: 1rem; font-size: 0.9em; }
 </style>
 </head>
 <body>
@@ -24,6 +25,14 @@ <h1>Admin</h1>
 <div class="mcp-flash-ok">Saved <code>{{.SavedName}}</code>.</div>
 {{end}}
 
+{{if .ReloadOK}}
+<div class="mcp-flash-ok">Bot MCP reloaded: {{.ReloadOK}}.</div>
+{{end}}
+
+{{if .ReloadErr}}
+<div class="mcp-flash-err">Saved, but live reload failed: <code>{{.ReloadErr}}</code>. Restart the container or run <code>/mcp update</code> to retry.</div>
+{{end}}
+
 {{if .BridgeExport}}
 <div class="mcp-bridge-note">
   <strong>Bridge mirror active.</strong> Every save also writes to

internal/telegram/handler.go

@@ -81,6 +81,10 @@ type Handler struct {
 	adminBaseURL string // public URL of the admin web UI (empty = feature off)
 	logger       *slog.Logger
 
+	// mcpLoader returns the current MCP config set. When set, /mcp update
+	// reads from here (the DB in prod) instead of the legacy file. May be nil.
+	mcpLoader func(ctx context.Context) (map[string]config.MCPServerConfig, error)
+
 	forwardMu  sync.Mutex
 	forwardBuf map[int64]*forwardedContent
 
@@ -90,6 +94,13 @@ type Handler struct {
 	sem chan struct{} // concurrency limiter for handleUpdate goroutines
 }
 
+// SetMCPLoader wires the source of truth for the /mcp update command. Pass a
+// closure reading from kv_settings so the command reflects the admin UI's
+// edits instead of the now-unmounted config/mcp.json.
+func (h *Handler) SetMCPLoader(f func(ctx context.Context) (map[string]config.MCPServerConfig, error)) {
+	h.mcpLoader = f
+}
+
 // SetAdminBaseURL sets the public admin UI URL surfaced in /routing as a
 // "Open Admin UI" button. Empty string disables the button.
 func (h *Handler) SetAdminBaseURL(u string) { h.adminBaseURL = u }
@@ -1378,17 +1389,25 @@ func (h *Handler) handleMCPCommand(chatID int64, args string) {
 	switch strings.TrimSpace(args) {
 	case "update", "reload":
 		h.sendPlain(chatID, "Reloading MCP servers...")
-		configs, err := config.LoadMCPServers("config/mcp.json")
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		var (
+			configs map[string]config.MCPServerConfig
+			err     error
+		)
+		if h.mcpLoader != nil {
+			configs, err = h.mcpLoader(ctx)
+		} else {
+			configs, err = config.LoadMCPServers("config/mcp.json")
+		}
 		if err != nil {
-			h.sendPlain(chatID, "Error loading mcp.json: "+err.Error())
+			h.sendPlain(chatID, "Error loading MCP config: "+err.Error())
 			return
 		}
 		if len(configs) == 0 {
-			h.sendPlain(chatID, "No MCP servers configured in mcp.json.")
+			h.sendPlain(chatID, "No MCP servers configured.")
 			return
 		}
-		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer cancel()
 		toolCount, err := h.agent.ReloadMCP(ctx, configs)
 		if err != nil {
 			h.sendPlain(chatID, "Error: "+err.Error())