Feat/cli mcp config

[osimuka]

Summary

Describe the problem and the changes in this pull request.

Validation

• npm run typecheck
• npm run build
• npm test

Checklist

• Tests added or updated where behavior changed
• Documentation updated where needed
• No secrets or generated credentials are included
• Changes are focused and backward-compatible, or breaking changes are documented

[Copilot]

🟡 Changes recommended

Invalid enabled values can silently enable servers, and the new documentation interrupts existing runtime instructions.

2 open findings

• Reject non-boolean enabled values before sanitizing · New
• Move MCP section after the OpenTUI shell example · New

What changed in this PR

Adds JSON-based MCP server configuration to interactive CLI chat.

Changes:

• Adds --mcp-config parsing and agent integration.
• Adds parser tests and usage documentation.
• Bumps package version to 0.4.2.

File	Description
cli.ts	Loads MCP configuration for chat mode.
api/​core/​library/​mcpSettings.ts	Parses and sanitizes configuration files.
tests/​mcpSettings.test.ts	Tests supported and malformed configurations.
README.md	Documents CLI MCP usage.
package.json, package-lock.json	Bumps package version.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The parser rejects common keyed MCP configurations and silently rewrites malformed executable fields.

0 open findings

2 resolved since last review

• Reject non-boolean enabled values before sanitizing
• Move MCP section after the OpenTUI shell example

Previously missed (1)

In code that hasn't changed since last review

Support keyed-object MCP configurations

api/​core/​library/​mcpSettings.ts:281

mcpServers is commonly an object keyed by server name (for example, { "mcpServers": { "filesystem": { "command": "npx", ... } } }), but this parser only accepts an array. As a result, existing Claude/Cursor-style MCP config files passed to the new CLI option are rejected even though the option is presented as loading an MCP config. Please accept the keyed-object form as well and derive stable id/name values from each key.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Config validation can silently switch malformed remote entries to local execution and discard invalid authentication headers.

2 open findings

• Reject blank or non-string URLs instead of falling back to commands · New
• Validate MCP server headers before sanitization · New

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Malformed HTTP headers can pass configuration validation and cause the MCP server to be silently skipped.

0 open findings

2 resolved since last review

• Reject blank or non-string URLs instead of falling back to commands
• Validate MCP server headers before sanitization

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Configured PATH environment overrides are discarded before MCP child processes launch.

0 open findings

Previously missed (2)

In code that hasn't changed since last review

Report an explicit error for URLs exceeding the maximum length

api/​core/​library/​mcpSettings.ts:358

URLs over MAX_URL_LENGTH take this branch but report that the value is not a non-empty string, which gives users the wrong remediation. Split the length check so oversized URLs get an explicit size-limit error.

Preserve configured PATH when building child process environment

api/​core/​library/​mcpSettings.ts:435

A PATH supplied through this config is not actually preserved for the child process: createTransportParams merges server.env and then unconditionally replaces env.PATH in api/core/agent/tools/mcpTools.ts:207-211. This contradicts the documented merged env behavior and can prevent configured executables from being found. Build the augmented path from the merged value, or otherwise retain the config override.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

PATH augmentation corrupts configured Windows PATH values by using a POSIX-only separator.

2 open findings

• Use platform delimiter when processing server PATH · New
• Use platform PATH separator in portability test · New

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The implementation is validated, documented, backward-compatible, and has focused automated tests.

0 open findings

2 resolved since last review

• Use platform delimiter when processing server PATH
• Use platform PATH separator in portability test

🧠 Review effort: Balanced