Module mcp 

MuxAPI handlers for the v1 standalone MCP Server primitive. mcp.list / mcp.get / mcp.upsert / mcp.delete / mcp.bind / mcp.unbind

Plus the Connectors-level catalog (mcp.catalog.): global servers only, window-scoped — no agent_id, no check_s1 (mirrors bundle. auth shape, since Connectors has no agent connection context to gate on).

db_mcp_servers is authoritatively identity_store as of Phase 2 of SPEC_DURABLE_BINDINGS_2026_09_10.md (§5.1/§5.4) — see skill.rs’s module doc comment for the full catalog/mstore split; this file mirrors it exactly for MCP servers.

Functions

observed_agents 🔒

observed_source 🔒

Where an observed server comes from: AgentMux’s own sources by name (its agentmux server, a catalog server), else what the CLI said.

register

register_mcp_bind 🔒

register_mcp_catalog_bind 🔒

register_mcp_catalog_delete 🔒

register_mcp_catalog_list 🔒

register_mcp_catalog_list_for_agent 🔒

Catalog-tier sibling of mcp.list (above) — GLOBAL SERVERS ONLY, each annotated with bound_to_agent for the caller-supplied agent_id, no check_s1. AgentStashModal’s MCP Servers tab (the per-agent Stash view) runs over the dashboard’s connection, which is never agent-authenticated, so mcp.list’s gate can never be satisfied from that caller — the exact same reasoning as mcp.catalog.bind above. Deliberately does NOT reuse mcp.list’s full computation (global + this agent’s own private servers): with no check_s1, agent_id is unverified, and a private server’s config can carry secrets — returning it for an arbitrary caller-chosen agent_id would be an IDOR into every agent’s private MCP config. See Store::mcp_server_list_global_for_agent’s doc comment and docs/reports/REPORT_ARMORY_ARCHITECTURE_AND_NAMING_REVIEW_2026_07_23.md §2.2.

register_mcp_catalog_probe 🔒

Health/prerequisite probe for a global catalog server, callable without an agent context (mirrors mcp.catalog.*’s window-scoped, no-check_s1 shape) — this is what lets Connectors → MCP servers show a connected/error status per row before any agent has bound the server. See SPEC_MCP_INTEGRATION_PARITY_ABLETON_PILOT_2026_07_08.md §4.4.

register_mcp_catalog_set_reach 🔒

Who a global catalog server reaches beyond its binds (every agent, container agents too). Global rows only, like the rest of mcp.catalog.*. The switches live in the identity store beside the catalog, so they survive an upgrade (SPEC_CONNECTORS_MCP_WHAT_AGENTS_RUN_2026_10_10.md §2.1).

register_mcp_catalog_unbind 🔒

Catalog-tier sibling of mcp.unbind (above) — same DB write, no check_s1. Restricted to global rows only, matching the guard register_mcp_catalog_bind/register_mcp_catalog_delete already apply in this file: any window connection can sever any agent’s binding to a global server (an intentional, pre-existing trust boundary — bind and delete already have the same or larger blast radius), but a private row’s own binding must not be touchable via this no-check_s1 surface, even though mcp_id is never exposed by any no-check_s1 command today — defense in depth over relying solely on UUID secrecy. reagentx P1 on PR #2329 (round 2).

register_mcp_catalog_upsert 🔒

register_mcp_delete 🔒

register_mcp_get 🔒

register_mcp_list 🔒

register_mcp_observed_list 🔒

The MCP servers each running agent’s CLI reports having (backend::mcp_observed), with AgentMux’s own sources named: builtin for the agentmux server, catalog for a catalog server of that name. Names and statuses only; a pane that no longer exists is dropped.

register_mcp_probe 🔒

Health/prerequisite probe for one of this agent’s own or bound-global servers (SPEC_MCP_INTEGRATION_PARITY_ABLETON_PILOT_2026_07_08.md §4.4). Opens a short-lived MCP connection and reports whether the server actually speaks the protocol — distinct from mcp.upsert’s “is this valid JSON” check, which tells you nothing about reachability.

register_mcp_unbind 🔒

register_mcp_upsert 🔒