feat(mcp): add Takt MCP transport-allowlist adapter

.rulesync/skills/rulesync-feature-research/references/takt.md

@@ -2,25 +2,26 @@
 
 ## Official Docs
 
-| Feature       | Official docs                                    | Upstream surface                                     |
-| ------------- | ------------------------------------------------ | ---------------------------------------------------- |
-| index         | `https://github.com/nrslib/takt`                 | TAKT repository                                      |
-| `rules`       | `https://nrslib.com/faceted-prompting/`          | Faceted prompting policies                           |
-| `ignore`      | No dedicated upstream ignore surface in map      | No Rulesync-supported TAKT ignore target in map      |
-| `mcp`         | No dedicated upstream MCP surface in map         | No Rulesync-supported TAKT MCP target in map         |
-| `commands`    | `https://nrslib.com/faceted-prompting/`          | Faceted prompting instructions                       |
-| `subagents`   | `https://nrslib.com/faceted-prompting/`          | Faceted prompting personas                           |
-| `skills`      | `https://nrslib.com/faceted-prompting/`          | Faceted prompting knowledge                          |
-| `hooks`       | No dedicated upstream hooks surface in map       | No Rulesync-supported TAKT hooks target in map       |
-| `permissions` | No dedicated upstream permissions surface in map | No Rulesync-supported TAKT permissions target in map |
+| Feature       | Official docs                                                    | Upstream surface                                                                                       |
+| ------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| index         | `https://github.com/nrslib/takt`                                 | TAKT repository                                                                                        |
+| `rules`       | `https://nrslib.com/faceted-prompting/`                          | Faceted prompting policies                                                                             |
+| `ignore`      | No dedicated upstream ignore surface in map                      | No Rulesync-supported TAKT ignore target in map                                                        |
+| `mcp`         | `https://github.com/nrslib/takt/blob/main/docs/configuration.md` | `workflow_mcp_servers` transport allowlist in `config.yaml` (per-step `mcp_servers` not representable) |
+| `commands`    | `https://nrslib.com/faceted-prompting/`                          | Faceted prompting instructions                                                                         |
+| `subagents`   | `https://nrslib.com/faceted-prompting/`                          | Faceted prompting personas                                                                             |
+| `skills`      | `https://nrslib.com/faceted-prompting/`                          | Faceted prompting knowledge                                                                            |
+| `hooks`       | No dedicated upstream hooks surface in map                       | No Rulesync-supported TAKT hooks target in map                                                         |
+| `permissions` | No dedicated upstream permissions surface in map                 | No Rulesync-supported TAKT permissions target in map                                                   |
 
 ## Client Anchors
 
 Common adapter paths: `rulesync-source-map.md`.
 
-| Surface     | Anchor                                                                                                 |
-| ----------- | ------------------------------------------------------------------------------------------------------ |
-| `rules`     | `.takt/facets/policies`, `takt.name` stem override, and plain-Markdown output in `takt-rule.ts`        |
-| `commands`  | `.takt/facets/instructions`, `takt.name` stem override, and frontmatter stripping in `takt-command.ts` |
-| `subagents` | `.takt/facets/personas`, `takt.name` stem override, and plain-Markdown output in `takt-subagent.ts`    |
-| `skills`    | Flat `.takt/facets/knowledge/{name}.md` output and unsupported reverse import in `takt-skill.ts`       |
+| Surface     | Anchor                                                                                                                                         |
+| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `rules`     | `.takt/facets/policies`, `takt.name` stem override, and plain-Markdown output in `takt-rule.ts`                                                |
+| `commands`  | `.takt/facets/instructions`, `takt.name` stem override, and frontmatter stripping in `takt-command.ts`                                         |
+| `subagents` | `.takt/facets/personas`, `takt.name` stem override, and plain-Markdown output in `takt-subagent.ts`                                            |
+| `skills`    | Flat `.takt/facets/knowledge/{name}.md` output and unsupported reverse import in `takt-skill.ts`                                               |
+| `mcp`       | `workflow_mcp_servers` default-deny transport allowlist merged into `.takt/config.yaml`; server definitions not representable in `takt-mcp.ts` |

README.md

@@ -94,7 +94,7 @@ The tables below show whether each tool supports a given feature (✅ = supporte
 | Kilo Code              |  ✅   |   ✅   | ✅  |    ✅    |    ✅     |   ✅   |  ✅   |     ✅      |
 | Roo Code               |  ✅   |   ✅   | ✅  |    ✅    |    ✅     |   ✅   |       |             |
 | Rovodev (Atlassian)    |  ✅   |        | ✅  |          |    ✅     |   ✅   |       |     ✅      |
-| Takt                   |  ✅   |        |     |    ✅    |    ✅     |   ✅   |       |     ✅      |
+| Takt                   |  ✅   |        | ✅  |    ✅    |    ✅     |   ✅   |       |     ✅      |
 | Vibe Code              |  ✅   |   ✅   | ✅  |          |    ✅     |   ✅   |  ✅   |     ✅      |
 | Qwen Code              |  ✅   |   ✅   | ✅  |    ✅    |    ✅     |   ✅   |  ✅   |     ✅      |
 | Reasonix               |       |        | ✅  |          |           |        |       |             |

cspell.json

@@ -23,6 +23,7 @@
   ],
   "words": [
     "agentic",
+    "lossiness",
     "Blocklist",
     "aiassistant",
     "anthropics",

docs/reference/file-formats.md

@@ -614,6 +614,8 @@ The `type` (and the equivalent `transport`) field accepts `local`, `stdio`, `sse
 
 > **Kilo Code note:** Kilo's MCP config uses its own native shape in `kilo.jsonc` (`type: "local" | "remote"`, `environment`, `enabled`, `command` as an array). Rulesync maps `stdio`/`local` ⇄ Kilo `local` and `http`/`sse` ⇄ Kilo `remote`; on import, Kilo `remote` is normalized to the canonical `http` transport (the deprecated `sse` is no longer emitted). The Kilo-specific `timeout` (local + remote, a positive integer in milliseconds) and `oauth` (remote only — either an OAuth-config object or `false` to disable auto-detection) fields are preserved on round-trip. The `kilo.jsonc` `skills` config key (`skills.paths` for extra skill locations and `skills.urls` for remote skill manifests) is likewise preserved when Rulesync writes the file.
 
+> **Takt note (partial / transport-allowlist only):** Takt does **not** have a project- or global-level registry of MCP server _definitions_. The concrete `mcp_servers` map (`command`/`args`/`env` or `type`/`url`/`headers`) is declared **per workflow step** inside individual workflow YAML files; there is no top-level `mcp_servers` key in `config.yaml`, and Takt's config loader hard-rejects unknown top-level keys (introduced with MCP support in [Takt v0.21.0](https://github.com/nrslib/takt/blob/main/CHANGELOG.md)). What `config.yaml` _does_ hold is the **default-deny transport allowlist** `workflow_mcp_servers: { stdio, sse, http }` — without it, workflow-defined MCP servers are refused regardless of how they are declared. So Rulesync emits **only** this allowlist into the shared `.takt/config.yaml` (project) / `~/.takt/config.yaml` (global), enabling exactly the transports your `.rulesync/mcp.json` servers use (`local`/`stdio` ⇒ `stdio`; `sse` ⇒ `sse`; `http`/`streamable-http`/`ws` ⇒ `http`). The merge is in place — every other top-level key (`provider`, `provider_profiles`, …) is preserved and the file is never deleted. **Documented lossiness:** per-server names, commands, env, URLs, and headers are not representable in `config.yaml` and are intentionally **not** written; you still declare the concrete servers in your workflow YAML steps, and Rulesync only opens the transport gate that permits them. As a corollary, **import** cannot reconstruct server definitions from a transport allowlist and yields an empty `mcpServers` map. See the [Takt configuration docs](https://github.com/nrslib/takt/blob/main/docs/configuration.md).
+
 ### MCP Tool Config (`enabledTools` / `disabledTools`)
 
 You can control which individual tools from an MCP server are enabled or disabled using `enabledTools` and `disabledTools` arrays per server.

docs/reference/supported-tools.md

@@ -24,7 +24,7 @@ Rulesync supports both **generation** and **import** for All of the major AI cod
 | Kilo Code              | kilo            | ✅ 🌏 |   ✅   |  ✅ 🌏   |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  | ✅ 🌏 |    ✅ 🌏    |
 | Roo Code               | roo             | ✅ 🌏 |   ✅   |    ✅    |    ✅    |    ✅     | ✅ 🌏  |       |             |
 | Rovodev (Atlassian)    | rovodev         | ✅ 🌏 |        |    🌏    |          |   ✅ 🌏   | ✅ 🌏  |       |     🌏      |
-| Takt                   | takt            | ✅ 🌏 |        |          |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  |       |    ✅ 🌏    |
+| Takt                   | takt            | ✅ 🌏 |        |  ✅ 🌏   |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  |       |    ✅ 🌏    |
 | Vibe Code              | vibe            | ✅ 🌏 |   ✅   |  ✅ 🌏   |          |   ✅ 🌏   | ✅ 🌏  | ✅ 🌏 |    ✅ 🌏    |
 | Qwen Code              | qwencode        | ✅ 🌏 |   ✅   | ✅ 🌏 🔧 |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  | ✅ 🌏 |    ✅ 🌏    |
 | Reasonix               | reasonix        |       |        |  ✅ 🌏   |          |           |        |       |             |

docs/tools/takt.md

@@ -38,9 +38,17 @@ Output files are **plain Markdown** — the source frontmatter is dropped entire
 .rulesync/skills/oncall/SKILL.md →  .takt/facets/knowledge/oncall.md
 ```
 
+## MCP (partial — transport allowlist only)
+
+Takt has no project- or global-level registry of MCP server _definitions_: the concrete `mcp_servers` map (`command`/`args`/`env` or `type`/`url`/`headers`) is declared **per workflow step** inside individual workflow YAML files, and Takt's `config.yaml` loader rejects unknown top-level keys. The one MCP knob `config.yaml` does expose is the **default-deny transport allowlist** `workflow_mcp_servers: { stdio, sse, http }`; until a transport is enabled there, every workflow-defined MCP server using it is refused.
+
+Rulesync therefore emits **only** this allowlist into the shared `.takt/config.yaml` (project) / `~/.takt/config.yaml` (global), turning on exactly the transports the servers in `.rulesync/mcp.json` use (`local`/`stdio` → `stdio`, `sse` → `sse`, `http`/`streamable-http`/`ws` → `http`). The merge is in place, so the active provider, provider profiles, and all other config keys are preserved; the file is never deleted.
+
+**Lossiness:** the per-server names, commands, env, URLs, and headers are not representable in `config.yaml` and are intentionally not written — you still declare the concrete servers in your workflow YAML steps; Rulesync only opens the transport gate that permits them. Because of this, reverse import cannot reconstruct server definitions and yields an empty `mcpServers` map.
+
 ## Scope
 
-Both project mode (`.takt/facets/...`) and global mode (`~/.takt/facets/...`) are supported.
+Both project mode (`.takt/facets/...`, `.takt/config.yaml`) and global mode (`~/.takt/facets/...`, `~/.takt/config.yaml`) are supported.
 
 ## Importing existing TAKT files into rulesync
 

skills/rulesync/file-formats.md

@@ -614,6 +614,8 @@ The `type` (and the equivalent `transport`) field accepts `local`, `stdio`, `sse
 
 > **Kilo Code note:** Kilo's MCP config uses its own native shape in `kilo.jsonc` (`type: "local" | "remote"`, `environment`, `enabled`, `command` as an array). Rulesync maps `stdio`/`local` ⇄ Kilo `local` and `http`/`sse` ⇄ Kilo `remote`; on import, Kilo `remote` is normalized to the canonical `http` transport (the deprecated `sse` is no longer emitted). The Kilo-specific `timeout` (local + remote, a positive integer in milliseconds) and `oauth` (remote only — either an OAuth-config object or `false` to disable auto-detection) fields are preserved on round-trip. The `kilo.jsonc` `skills` config key (`skills.paths` for extra skill locations and `skills.urls` for remote skill manifests) is likewise preserved when Rulesync writes the file.
 
+> **Takt note (partial / transport-allowlist only):** Takt does **not** have a project- or global-level registry of MCP server _definitions_. The concrete `mcp_servers` map (`command`/`args`/`env` or `type`/`url`/`headers`) is declared **per workflow step** inside individual workflow YAML files; there is no top-level `mcp_servers` key in `config.yaml`, and Takt's config loader hard-rejects unknown top-level keys (introduced with MCP support in [Takt v0.21.0](https://github.com/nrslib/takt/blob/main/CHANGELOG.md)). What `config.yaml` _does_ hold is the **default-deny transport allowlist** `workflow_mcp_servers: { stdio, sse, http }` — without it, workflow-defined MCP servers are refused regardless of how they are declared. So Rulesync emits **only** this allowlist into the shared `.takt/config.yaml` (project) / `~/.takt/config.yaml` (global), enabling exactly the transports your `.rulesync/mcp.json` servers use (`local`/`stdio` ⇒ `stdio`; `sse` ⇒ `sse`; `http`/`streamable-http`/`ws` ⇒ `http`). The merge is in place — every other top-level key (`provider`, `provider_profiles`, …) is preserved and the file is never deleted. **Documented lossiness:** per-server names, commands, env, URLs, and headers are not representable in `config.yaml` and are intentionally **not** written; you still declare the concrete servers in your workflow YAML steps, and Rulesync only opens the transport gate that permits them. As a corollary, **import** cannot reconstruct server definitions from a transport allowlist and yields an empty `mcpServers` map. See the [Takt configuration docs](https://github.com/nrslib/takt/blob/main/docs/configuration.md).
+
 ### MCP Tool Config (`enabledTools` / `disabledTools`)
 
 You can control which individual tools from an MCP server are enabled or disabled using `enabledTools` and `disabledTools` arrays per server.

skills/rulesync/supported-tools.md

@@ -24,7 +24,7 @@ Rulesync supports both **generation** and **import** for All of the major AI cod
 | Kilo Code              | kilo            | ✅ 🌏 |   ✅   |  ✅ 🌏   |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  | ✅ 🌏 |    ✅ 🌏    |
 | Roo Code               | roo             | ✅ 🌏 |   ✅   |    ✅    |    ✅    |    ✅     | ✅ 🌏  |       |             |
 | Rovodev (Atlassian)    | rovodev         | ✅ 🌏 |        |    🌏    |          |   ✅ 🌏   | ✅ 🌏  |       |     🌏      |
-| Takt                   | takt            | ✅ 🌏 |        |          |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  |       |    ✅ 🌏    |
+| Takt                   | takt            | ✅ 🌏 |        |  ✅ 🌏   |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  |       |    ✅ 🌏    |
 | Vibe Code              | vibe            | ✅ 🌏 |   ✅   |  ✅ 🌏   |          |   ✅ 🌏   | ✅ 🌏  | ✅ 🌏 |    ✅ 🌏    |
 | Qwen Code              | qwencode        | ✅ 🌏 |   ✅   | ✅ 🌏 🔧 |  ✅ 🌏   |   ✅ 🌏   | ✅ 🌏  | ✅ 🌏 |    ✅ 🌏    |
 | Reasonix               | reasonix        |       |        |  ✅ 🌏   |          |           |        |       |             |

src/constants/takt-paths.ts

@@ -17,3 +17,12 @@ export const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
  * @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
  */
 export const TAKT_CONFIG_FILE_NAME = "config.yaml";
+
+/**
+ * Top-level key in Takt's `config.yaml` holding the workflow MCP transport
+ * allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
+ * transport must be explicitly enabled here before any workflow-defined MCP
+ * server using it is permitted to run.
+ * @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+ */
+export const TAKT_WORKFLOW_MCP_SERVERS_KEY = "workflow_mcp_servers";