fix(connectors): MCP single-writer enforcement + security hardening (#976)

src/gaia/apps/webui/package.json

@@ -71,7 +71,6 @@
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "react-markdown": "^9.1.0",
-    "rehype-raw": "^7.0.0",
     "rehype-sanitize": "^6.0.0",
     "remark-gfm": "^4.0.1",
     "typescript": "^5.3.3",

src/gaia/apps/webui/src/components/MessageBubble.tsx

@@ -4,7 +4,7 @@
 import React, { useCallback, useRef, useState, useEffect, useMemo } from 'react';
 import { Copy, Check, AlertTriangle, Trash2, RefreshCw, FolderOpen } from 'lucide-react';
 import ReactMarkdown from 'react-markdown';
-import rehypeRaw from 'rehype-raw';
+import { SAFE_DISALLOWED_ELEMENTS, safeUrlTransform } from '../utils/markdown';
 import remarkGfm from 'remark-gfm';
 import { AgentActivity } from './AgentActivity';
 import * as api from '../services/api';
@@ -598,7 +598,8 @@ function RenderedContent({ content, showCursor }: { content: string; showCursor?
         <div className="md-content">
             <ReactMarkdown
                 remarkPlugins={[remarkGfm]}
-                rehypePlugins={[rehypeRaw]}
+                disallowedElements={[...SAFE_DISALLOWED_ELEMENTS]}
+                urlTransform={safeUrlTransform}
                 components={{
                     // Code block vs inline code detection.
                     // react-markdown calls `code` for both inline `code` and

src/gaia/apps/webui/src/services/api.ts

@@ -3,7 +3,7 @@
 
 /** API client for GAIA Agent UI backend. */
 
-import type { Session, Message, Document, SystemStatus, Settings, StreamEvent, TunnelStatus, BrowseResponse, IndexFolderResponse, MCPServerInfo, MCPCatalogEntry, MCPServerStatus, AgentInfo } from '../types';
+import type { Session, Message, Document, SystemStatus, Settings, StreamEvent, TunnelStatus, BrowseResponse, IndexFolderResponse, MCPServerInfo, MCPServerStatus, AgentInfo } from '../types';
 import { getApiBase } from '../utils/apiBase';
 import { log } from '../utils/logger';
 
@@ -618,30 +618,16 @@ export async function getTunnelStatus(): Promise<TunnelStatus> {
 
 // -- MCP Server Management -------------------------------------------------------
 
+// MCP server configuration moved to the connectors framework (#927):
+//   - Catalog tiles  → POST /api/connectors/{id}/configure (see connectorsStore)
+//   - Custom servers → CLI `gaia connectors mcp add` today; UI in #977
+//   - Catalog list   → GET /api/connectors/catalog (filter by type='mcp_server')
+// Only read-only runtime endpoints remain:
+
 export async function listMCPServers(): Promise<{ servers: MCPServerInfo[] }> {
     return apiFetch('GET', '/mcp/servers');
 }
 
-export async function addMCPServer(data: { name: string; command: string; args?: string[]; env?: Record<string, string> }): Promise<{ status: string; name: string }> {
-    return apiFetch('POST', '/mcp/servers', data);
-}
-
-export async function removeMCPServer(name: string): Promise<{ status: string; name: string }> {
-    return apiFetch('DELETE', `/mcp/servers/${name}`);
-}
-
-export async function enableMCPServer(name: string): Promise<{ status: string; name: string }> {
-    return apiFetch('POST', `/mcp/servers/${name}/enable`);
-}
-
-export async function disableMCPServer(name: string): Promise<{ status: string; name: string }> {
-    return apiFetch('POST', `/mcp/servers/${name}/disable`);
-}
-
-export async function getMCPCatalog(): Promise<{ catalog: MCPCatalogEntry[] }> {
-    return apiFetch('GET', '/mcp/catalog');
-}
-
 export async function getMCPRuntimeStatus(): Promise<{ servers: MCPServerStatus[] }> {
     return apiFetch('GET', '/mcp/status');
 }

src/gaia/apps/webui/src/types/index.ts

@@ -302,18 +302,6 @@ export interface MCPServerInfo {
     enabled: boolean;
 }
 
-export interface MCPCatalogEntry {
-    name: string;
-    display_name: string;
-    description: string;
-    category: string;
-    tier: number;
-    command: string;
-    args: string[];
-    env: Record<string, string>;
-    requires_config: string[];
-}
-
 export interface MCPServerStatus {
     name: string;
     connected: boolean;