feat: add scoped MCP destinations and composable CLI help

[christso]

Summary

MCP servers can now be managed consistently across project, user, and named-profile destinations from both the command line and the interactive TUI. OAuth guidance uses the correct presentation channel for each adapter, while the internal stdio proxy keeps stdout reserved for JSON-RPC.

• Adds explicit --scope project, --scope user, and --profile <name> destination selection to mcp add, remove, list, get, reauth, and update.
• Adds native TUI flows to list, inspect, add, reauthenticate, and remove MCP servers in every destination.
• Lists servers before actions, uses Back to return to destination selection, and keeps maintenance operations out of the normal server menu.
• Updates generated client configuration automatically after add/remove. If that update fails after the declaration changes, the TUI offers Retry update until it succeeds or the user cancels.
• Uses Update consistently in user-facing TUI labels and status messages; sync and reconciliation remain internal implementation terms.
• Centralizes MCP authentication, persistence, and reconciliation in a presentation-free management module shared by the CLI and TUI.
• Keeps informational OAuth output on normal CLI output and Clack surfaces while preserving proxy diagnostics on stderr.
• Uses an abortable masked callback prompt and restores previous working credentials when reauthentication fails or is cancelled.
• Supports repeatable --client selectors and strict destination/profile validation.
• Materializes profile MCP config inside the profile root, including generated Codex and Copilot bridge config.
• Makes project and user declaration writes atomic and serialized. Failed client updates retain AllAgents ownership for later retry.
• Redacts credential-bearing headers, environment values, URLs, query fields, and stdio arguments from CLI and TUI output.
• Publishes command metadata, output schemas, and interaction requirements through composable --help --json output.
• Ships a thin first-party AllAgents skill wrapper that resolves global or npx runners and follows progressive --help --json links. Root and group responses stay concise; leaf responses expose the complete execution contract, including expected output, interaction, schema, and JSON field allowlists.
• Strengthens repository TUI dogfood guidance around first-time-user review, one decision per screen, navigation, terminology, and failure/retry paths.

This extends the TradingView and client-managed OAuth work on this branch. The HTTP-to-stdio bridge remains internal; users manage one server declaration through either public interface.

Design decisions

• A management operation selects exactly one destination. --scope and --profile are mutually exclusive.
• CLI, TUI, and proxy adapters own presentation only. The shared MCP management module owns authentication, declaration mutation, and destination reconciliation.
• The normal TUI server list contains servers, Add server, and Back. Client updates happen automatically; Retry update appears only after a persisted mutation cannot update generated client configuration.
• OAuth authorization output is injectable. Direct commands use stdout, the TUI uses Clack, and the proxy defaults to stderr because stdout is its protocol channel.
• Running without a destination flag in $HOME preserves the legacy user-workspace behavior. Explicit --scope project from $HOME fails because that path aliases the user workspace.
• Profile secret headers use exact ${ENV_VAR} references. Generated bridge configs retain only the header-to-variable binding; the value resolves at the connection boundary.
• trackedServers remains an ownership record, not a report of the latest successful operation. Non-authoritative client failures retain prior entries.
• Destination mutation uses a bounded lock and atomic rename. Symlink and non-regular config targets fail closed.

Validation

Automated checks:

bun run build
bun run typecheck
bun run lint
bun run schema:check
bun run docs:build
bun test
bun test src/cli/tui/__tests__/mcp.test.ts src/cli/tui/__tests__/wizard.test.ts tests/e2e/mcp-add-proxy.test.ts tests/unit/core/mcp-proxy.test.ts

Results:

• Build, TypeScript, lint, generated schema, documentation, and whitespace checks passed.
• Complete suite: 1,923 passed, 7 skipped, 0 failed across 170 files.
• Final focused MCP/TUI subset: 41 passed, 0 failed.
• bun run check remains red on 143 pre-existing repository formatting/import-order findings; no fix was applied outside this change.
• Structured review covered correctness, project standards, testing, agent/MCP parity, and adversarial navigation. It found missing cancellation coverage and a lost retry path after failed automatic client updates. Both were fixed; targeted re-review found no remaining issue.

Manual E2E with the built CLI:

1. Created temporary project and ordinary user workspaces plus a markets profile.
2. Ran ./dist/index.js mcp add, list, get, update, and remove against the default project destination, --scope user, and --profile markets.
3. Verified declarations landed only in the selected workspace or profile, and generated profile client config included the profile-specific bridge invocation.
4. Verified profile removal deleted its OAuth cache and empty profile root without changing project or user OAuth state.
5. Verified human and JSON output did not expose header, environment, URL, query, or argument credentials.
6. Verified built-CLI progressive JSON help at root, nested group, alias, and leaf paths. Every index link resolves, leaves expose expected output, explicit interaction, schemas, and field allowlists, and -h, --jq, trailing positionals, help-shaped option values, and human help remain correct.
7. Launched the built interactive CLI with agent-tui in an isolated workspace containing HTTP and stdio servers.
8. Verified the main summary uses Update, the project MCP screen lists servers before + Add server and Back, and no permanent maintenance action is shown.
9. Verified Back returns from the server list to destination selection, then from destination selection to the main menu.
10. Added and removed a stdio server through the TUI and verified the declaration changed only in the selected destination.

Review notes

Start with src/core/mcp-management.ts for the shared orchestration boundary. Then review src/cli/commands/mcp.ts and src/cli/tui/actions/mcp.ts as presentation adapters. OAuth channel selection and transactional credential reset live in src/core/mcp-http-stdio-proxy.ts.

Residual operational constraint: removing a profile does not terminate an already-running external MCP proxy process. The CLI does not own client process lifetimes; removal prevents future launches and deletes profile-owned persisted state.

Post-Deploy Monitoring & Validation

This is client-side CLI behavior; there is no central service deployment.

• Window: first seven days after release. Owner: AllAgents maintainers.
• Search support and CI output for Update Error, MCP sync was incomplete, Could not acquire MCP destination lock, OAuth callback failures, repeated authorization prompts, generated bridge launch failures, and stale callback prompts.
• Healthy signals: each operation mutates only its selected destination; the TUI exposes one clear decision per screen; failed client updates retain a contextual retry; OAuth guidance appears as normal interactive output; proxy stdout remains valid JSON-RPC; cancelled reauthentication leaves prior credentials usable.
• Failure signals: a dead-end after failed client update, mixed resource/navigation/maintenance options, cross-profile credentials, secrets in output, a blocked TUI after browser completion, proxy protocol corruption, lost credentials after cancellation, lost ownership after a client CLI failure, or partial workspace YAML.
• Rollback trigger: any cross-destination credential/config leak, protocol corruption, declaration corruption, or unrecoverable failed update. Mitigation: revert the scoped MCP management commits while preserving the prior public project MCP commands.

---

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	d1bcc09
Status:	✅  Deploy successful!
Preview URL:	https://c767eebb.allagents.pages.dev
Branch Preview URL:	https://feat-tradingview-mcp.allagents.pages.dev

View logs