feat(acp): extra MCP servers via env, with a trust boundary for their credentials - #4

Merged

wiggdevin merged 13 commits into

Sep 4, 2026

Commits on Sep 4, 2026

feat(acp): accept extra MCP servers via BUZZ_ACP_EXTRA_MCP_COMMANDS

BradGroux
authored and
wiggdevin
committed
18c45ea
Fix extra MCP server name collisions and shell-aware argv parsing

authored and
wiggdevin
committed
768c6e3
Address P0/P1 review feedback: credential isolation, fail-closed, name sanitization

authored and
wiggdevin
committed
072fb99
style(buzz-acp): rustfmt the imported PR #6651 extra-MCP parser
wiggdevin
committed
ac597bd
docs(mcp): name NOSTR_PRIVATE_KEY in the untrusted-server credential lists
wiggdevin
committed
aa83130
test(buzz-agent): bind the untrusted MCP spawn boundary end to end
wiggdevin
committed
1566240
fix(acp): cut extra MCP server names to the registry's 128-byte limit
wiggdevin
committed
356b3ba
fix(buzz-agent): confine MCP hooks and declared env to trusted servers
wiggdevin
committed
d9a30d8
fix(buzz-acp): correct the extra-MCP parser's contracts and bind its wire seam
wiggdevin
committed
6130fe0
fix(buzz-agent): contain an over-long third-party tool name; narrow the trust claims
wiggdevin
committed
99310c9
fix(buzz-acp): refuse extra MCP servers an adapter cannot honour, and bound them
wiggdevin
committed
9308e53
Merge remote-tracking branch 'origin/zs/main' into port/6651
wiggdevin
committed
5a41a76
Merge remote-tracking branch 'origin/zs/main' into port/6651
wiggdevin
committed
685065d