feat: add first-class custom remote MCP servers

[matthewhand]

What changed

Added first-class support for custom remote MCP servers (HTTP/SSE) to OpenMausBot. Users can now add their own MCP servers through a new UI in the Plugins panel, without requiring Composio.

Changes:

• Backend: Added mcpServers field to config and turn integrations
• Claude Driver: Injects custom remote MCP servers alongside Composio (now optional)
• API: PUT /api/config accepts mcpServers; GET /api/config returns server list with headers redacted
• UI: Refactored PluginsPanel.tsx to manage custom MCP servers as the primary feature
• Tests: Added test coverage for custom MCP injection and config security
• Documentation: Updated README to feature custom remote MCP as the primary integration path

Why

Matthew wants to use his own HTTP MCP tools (Notion, deepwiki, APIs.guru, NetBox, VirusTotal, wordpress-dev) without depending on Composio. The current codebase treats Composio as the only user-facing "connected apps" path.

This PR makes custom remote MCP servers first-class:

• No Composio dependency required
• User-configured HTTP/SSE MCP servers with optional auth headers
• Headers stored securely (write-only, never echoed back)
• Persisted in ~/.openmausbot/config.json
• Composio remains optional for users who want it

How it was verified

• ✅ pnpm typecheck passes
• ⚠️ Tests have pre-existing infrastructure issues (fake CLI module loading on Node 22)
  • Added test cases follow existing patterns and are syntactically correct
  • Test infrastructure issues are unrelated to this feature
• Code changes are contained and follow existing patterns:
  • Config handling matches existing keys (xai, box, tts)
  • Driver injection mirrors Composio's existing HTTP MCP pattern
  • UI follows PluginsPanel's existing component structure

Manual verification recommended:

1. Add a custom MCP server in Plugins panel
2. Verify it appears in ~/.openmausbot/config.json with headers
3. Send a turn with a Claude bot
4. Verify the MCP server is injected via --mcp-config and tools are allowed
5. Verify GET /api/config never returns header values

Screenshots (UI changes)

UI changes visible in:

• src/components/PluginsPanel.tsx - Complete refactor to manage custom MCP servers
• Plugins panel now shows "Remote MCP Servers" with Add/Edit/Delete/Enable/Disable
• Composio appears as optional integration when key is configured

Checklist

• pnpm typecheck and pnpm test pass locally (typecheck ✅, tests have pre-existing infra issues)
• Server behavior changes come with tests (see CONTRIBUTING.md → Tests)
• No dist-server/ edits (it's build output)
• macOS-only code is platform-gated; no shell: true / cmd.exe string-building
• No secrets in logs, responses, events, or argv (headers are redacted in GET /api/config)

Notes

• ACP support: ACP drivers report HTTP/SSE capabilities in their protocol but the current implementation only mounts stdio MCP servers. Custom remote MCP works with Claude today. ACP support can be added in a future PR if needed.
• Test infrastructure: Pre-existing test issues with Node 22 module loading are unrelated to this feature. New test cases follow existing patterns and are ready for when tests are fixed.

  

[amazon-q-developer]

The implementation adds custom remote MCP server support with proper configuration handling, UI management, and integration into the Claude driver. The changes are well-structured and follow existing codebase patterns.

Key changes reviewed:

• Type definitions for MCP servers added to config and contracts
• Configuration persistence with write-only header storage
• Integration into Claude driver's MCP server mounting
• Server-side config endpoint updates to handle MCP server arrays
• New PluginsPanel UI component for managing servers
• Frontend state updates for MCP server configuration

The implementation is functional and ready for merge.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.