feat: MCP-native skill architecture (nonnaclaw)

Replace NanoClaw's codemods-based skill model with MCP-native skills
that add capabilities through community MCP servers and scoped
authorization instead of code generation.

- Add host-side MCP bridge (src/mcp-bridge.ts) that spawns MCP servers
  as child processes and exposes them via HTTP endpoints
- Add container-side MCP proxy with HTTP upstream transport and
  scopeTemplate enforcement (tool allowlists + param pinning)
- Extend SkillManifest with pollTool, pollIntervalMs, pollTimestampArg
- Fix authorized_skills column read/write in DB accessors
- Convert WhatsApp skill to use lharries/whatsapp-mcp community server
- Remove old custom Baileys WhatsApp implementation
- Add /install skill for generic skill installation
- Update CLAUDE.md files for channel-agnostic, MCP-aware agents
- Rewrite README for nonnaclaw philosophy and architecture

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: nickdirienzo

.gitignore

@@ -18,6 +18,9 @@ groups/global/*
 !groups/main/CLAUDE.md
 !groups/global/CLAUDE.md
 
+# Skills (cloned per-installation from external repos)
+skills/
+
 # Secrets
 *.keys.json
 .env

README.md

@@ -14,6 +14,8 @@ import { CronExpressionParser } from 'cron-parser';
 const IPC_DIR = '/workspace/ipc';
 const MESSAGES_DIR = path.join(IPC_DIR, 'messages');
 const TASKS_DIR = path.join(IPC_DIR, 'tasks');
+const STATE_DIR = path.join(IPC_DIR, 'state');
+const STATE_SNAPSHOT = path.join(IPC_DIR, 'current_state.json');
 
 // Context from environment variables (set by the agent runner)
 const chatJid = process.env.NANOCLAW_CHAT_JID!;
@@ -280,6 +282,92 @@ Use available_groups.json to find the JID for a group. The folder name should be
   },
 );
 
+// --- Structured memory (KV store) ---
+
+server.tool(
+  'save_state',
+  `Save a key-value pair that persists across agent invocations. Use this for remembering preferences, cursors, thread IDs, or any structured data that should survive between conversations.
+
+Values are scoped to this group — other groups cannot read or modify them.`,
+  {
+    key: z.string().describe('The key to save (e.g., "user_preference", "last_cursor")'),
+    value: z.string().describe('The value to save (will be stored as a string — use JSON.stringify for structured data)'),
+  },
+  async (args) => {
+    const data = {
+      type: 'save_state',
+      groupFolder,
+      key: args.key,
+      value: args.value,
+      timestamp: new Date().toISOString(),
+    };
+
+    writeIpcFile(STATE_DIR, data);
+
+    return { content: [{ type: 'text' as const, text: `State saved: ${args.key}` }] };
+  },
+);
+
+server.tool(
+  'get_state',
+  `Read previously saved state for this group. Returns all saved key-value pairs, or a specific key's value.`,
+  {
+    key: z.string().optional().describe('Specific key to read. If omitted, returns all saved state.'),
+  },
+  async (args) => {
+    try {
+      if (!fs.existsSync(STATE_SNAPSHOT)) {
+        return { content: [{ type: 'text' as const, text: args.key ? 'Key not found.' : 'No saved state.' }] };
+      }
+
+      const allState: Record<string, string> = JSON.parse(
+        fs.readFileSync(STATE_SNAPSHOT, 'utf-8'),
+      );
+
+      if (args.key) {
+        const value = allState[args.key];
+        if (value === undefined) {
+          return { content: [{ type: 'text' as const, text: `Key "${args.key}" not found.` }] };
+        }
+        return { content: [{ type: 'text' as const, text: value }] };
+      }
+
+      if (Object.keys(allState).length === 0) {
+        return { content: [{ type: 'text' as const, text: 'No saved state.' }] };
+      }
+
+      const formatted = Object.entries(allState)
+        .map(([k, v]) => `${k}: ${v}`)
+        .join('\n');
+      return { content: [{ type: 'text' as const, text: formatted }] };
+    } catch (err) {
+      return {
+        content: [{ type: 'text' as const, text: `Error reading state: ${err instanceof Error ? err.message : String(err)}` }],
+      };
+    }
+  },
+);
+
+server.tool(
+  'delete_state',
+  'Delete a previously saved key-value pair.',
+  {
+    key: z.string().describe('The key to delete'),
+  },
+  async (args) => {
+    const data = {
+      type: 'delete_state',
+      groupFolder,
+      key: args.key,
+      timestamp: new Date().toISOString(),
+    };
+
+    writeIpcFile(STATE_DIR, data);
+
+    return { content: [{ type: 'text' as const, text: `State deleted: ${args.key}` }] };
+  },
+);
+
 // Start the stdio transport
 const transport = new StdioServerTransport();
 await server.connect(transport);

container/agent-runner/src/ipc-mcp-stdio.ts

@@ -0,0 +1,146 @@
+/**
+ * MCP Proxy — sits between agent and upstream MCP server.
+ * Enforces tool allowlists and param pinning per ProxyConfig.
+ *
+ * Reads config from MCP_PROXY_CONFIG env var (JSON).
+ * Starts as stdio MCP server (for agent SDK) and connects
+ * to the upstream MCP server via stdio (spawn) or HTTP (bridge).
+ *
+ * Security model:
+ * - Only tools with `allow: true` in rules are visible to the agent
+ * - Pinned params are injected on every call — agent can't override them
+ * - Pinned params are hidden from tool schemas so agent doesn't see them
+ * - Tools not in rules are blocked (secure by default)
+ */
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js';
+
+interface ToolRule {
+  allow: boolean;
+  pinnedParams?: Record<string, string>;
+}
+
+interface ProxyConfig {
+  upstream: {
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    /** HTTP URL for connecting to a host-side MCP bridge */
+    url?: string;
+  };
+  rules: Record<string, ToolRule>;
+}
+
+// --- Parse config ---
+
+const configJson = process.env.MCP_PROXY_CONFIG;
+if (!configJson) {
+  process.stderr.write('MCP_PROXY_CONFIG env var is required\n');
+  process.exit(1);
+}
+
+const config: ProxyConfig = JSON.parse(configJson);
+
+// --- Connect to upstream MCP server ---
+
+const upstream = new Client({ name: 'nonnaclaw-mcp-proxy', version: '1.0.0' });
+
+if (config.upstream.url) {
+  // HTTP mode: connect to host-side MCP bridge
+  const httpTransport = new StreamableHTTPClientTransport(
+    new URL(config.upstream.url),
+  );
+  await upstream.connect(httpTransport);
+} else if (config.upstream.command) {
+  // Stdio mode: spawn upstream as child process
+  const stdioTransport = new StdioClientTransport({
+    command: config.upstream.command,
+    args: config.upstream.args,
+    env: { ...process.env, ...config.upstream.env } as Record<string, string>,
+  });
+  await upstream.connect(stdioTransport);
+} else {
+  process.stderr.write('ProxyConfig.upstream must have either url or command\n');
+  process.exit(1);
+}
+
+// Fetch upstream tool list once at startup
+const { tools: upstreamTools } = await upstream.listTools();
+
+// --- Create proxy server ---
+
+const proxy = new Server(
+  { name: 'nanoclaw-mcp-proxy', version: '1.0.0' },
+  { capabilities: { tools: {} } },
+);
+
+// tools/list — return only allowed tools, with pinned params hidden from schemas
+proxy.setRequestHandler(ListToolsRequestSchema, async () => {
+  const tools = upstreamTools
+    .filter((tool) => config.rules[tool.name]?.allow === true)
+    .map((tool) => {
+      const pinnedKeys = new Set(
+        Object.keys(config.rules[tool.name]?.pinnedParams || {}),
+      );
+      if (pinnedKeys.size === 0) return tool;
+
+      // Remove pinned params from the schema so agent doesn't see them
+      const schema = {
+        ...(tool.inputSchema || { type: 'object' as const }),
+      } as {
+        type: string;
+        properties?: Record<string, unknown>;
+        required?: string[];
+      };
+
+      if (schema.properties) {
+        const props = { ...schema.properties };
+        for (const key of pinnedKeys) delete props[key];
+        schema.properties = props;
+      }
+
+      if (schema.required) {
+        schema.required = schema.required.filter((r) => !pinnedKeys.has(r));
+      }
+
+      return { ...tool, inputSchema: schema };
+    });
+
+  return { tools };
+});
+
+// tools/call — check allowlist, inject pinned params, forward to upstream
+proxy.setRequestHandler(CallToolRequestSchema, async (request) => {
+  const { name, arguments: args } = request.params;
+  const rule = config.rules[name];
+
+  if (!rule?.allow) {
+    return {
+      content: [
+        { type: 'text' as const, text: `Tool "${name}" is not allowed.` },
+      ],
+      isError: true,
+    };
+  }
+
+  // Pinned params override anything the agent provides
+  const mergedArgs = {
+    ...(args || {}),
+    ...(rule.pinnedParams || {}),
+  };
+
+  return await upstream.callTool({ name, arguments: mergedArgs });
+});
+
+// --- Start stdio transport (facing agent SDK) ---
+
+const transport = new StdioServerTransport();
+await proxy.connect(transport);

container/agent-runner/src/mcp-proxy.ts

@@ -10,11 +10,11 @@ You are Andy, a personal assistant. You help with tasks, answer questions, and c
 - Read and write files in your workspace
 - Run bash commands in your sandbox
 - Schedule tasks to run later or on a recurring basis
-- Send messages back to the chat
+- Use any MCP tools provided by installed skills (messaging, contacts, media, etc.)
 
 ## Communication
 
-Your output is sent to the user or group.
+Your output is sent to the user or group via whichever messaging channel they use.
 
 You also have `mcp__nanoclaw__send_message` which sends a message immediately while you're still working. This is useful when you want to acknowledge a request before starting longer work.
 
@@ -34,6 +34,10 @@ Text inside `<internal>` tags is logged but not sent to the user. If you've alre
 
 When working as a sub-agent or teammate, only use `send_message` if instructed to by the main agent.
 
+## MCP Tools
+
+You may have additional MCP tools from installed skills (e.g., WhatsApp, Telegram). These are auto-discovered — check your available tools. Skill tools are scoped per-group: some parameters may be pre-filled to restrict which chats or resources you can access.
+
 ## Your Workspace
 
 Files you create are saved in `/workspace/group/`. Use this for notes, research, or anything that should persist.
@@ -49,7 +53,7 @@ When you learn something important:
 
 ## Message Formatting
 
-NEVER use markdown. Only use WhatsApp/Telegram formatting:
+NEVER use markdown. Only use messaging-app formatting:
 - *single asterisks* for bold (NEVER **double asterisks**)
 - _underscores_ for italic
 - • bullet points