Add MCP servers and custom tools for bots

Two new settings pages, MCPs and Tools. Super admins define them; super
admins and admins attach them to bots, to workspaces (every bot there),
or to every bot. Bots get them in chat replies and tasks.

- Custom tools: a JSON-schema of arguments plus an HTTP request, a script
  on the bot's computer, or a prompt, templated with {{args.x}} and
  {{env.KEY}}, secrets redacted from results.
- MCP servers: remote (URL and headers) or stdio commands run on the host
  with a setup command and an isolated env, in a per-process pool. Tools
  are listed into a cache and connect on first call.
- Add, edit, access and try open in modals.
- Markdown, JSON and command fields use twui's AceEditor (CodeEditor),
  its scripts loaded on demand.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/custom-tool-dict.ts

@@ -0,0 +1,66 @@
+/**
+ * What a custom tool does when a bot calls it. `http` calls an API from the
+ * app, `script` runs code on the run's computer, `prompt` runs one model
+ * turn with a filled-in prompt.
+ */
+export const CustomToolKinds = [
+    {
+        title: "HTTP request",
+        value: "http",
+        description: "Calls an API from the app and returns the response.",
+    },
+    {
+        title: "Script on a computer",
+        value: "script",
+        description: "Runs code on the bot's computer and returns what it prints.",
+    },
+    {
+        title: "Prompt",
+        value: "prompt",
+        description: "Runs one model turn with a filled-in prompt and returns the answer.",
+    },
+] as const;
+
+export type CustomToolKind = (typeof CustomToolKinds)[number]["value"];
+
+export const CustomToolHttpMethods = ["GET", "POST", "PUT", "PATCH", "DELETE"] as const;
+
+export type CustomToolHttpMethod = (typeof CustomToolHttpMethods)[number];
+
+/**
+ * Languages a script tool runs in, with the interpreter on the computer
+ * and the code editor's mode.
+ */
+export const CustomToolScriptLanguages = [
+    { title: "Bash", value: "bash", interpreter: "bash", extension: "sh", editor_mode: "sh" },
+    { title: "Python", value: "python", interpreter: "python3", extension: "py", editor_mode: "python" },
+    { title: "JavaScript", value: "javascript", interpreter: "node", extension: "js", editor_mode: "javascript" },
+] as const;
+
+export type CustomToolScriptLanguage = (typeof CustomToolScriptLanguages)[number]["value"];
+
+/**
+ * Names the built-in bot tools use. A custom tool can't take one, and
+ * names starting with a computer's tool prefixes are kept for them too.
+ */
+export const ReservedToolNames = [
+    "add_bot_to_workspace",
+    "ask_user_to_take_over",
+    "assign_computer",
+    "create_bot",
+    "create_schedule",
+    "create_workspace",
+    "delegate_task",
+    "delete_schedule",
+    "list_schedules",
+    "search_computers",
+    "set_bot_workspace_instructions",
+    "set_workspace_computer",
+    "start_task",
+    "update_instructions",
+    "update_memory",
+    "update_schedule",
+    "update_workspace",
+] as const;
+
+export const ReservedToolPrefixes = ["sandbox_", "browser_"] as const;

src/dict/mcp-dict.ts

@@ -0,0 +1,39 @@
+/**
+ * How the app reaches an MCP server. `remote`: over HTTP (Streamable HTTP,
+ * SSE fallback). `stdio`: a command the app starts on its own machine (the
+ * host in dev, the app's container in production) and talks to over its
+ * stdin and stdout.
+ */
+export const McpTransports = [
+    {
+        title: "Remote (URL)",
+        value: "remote",
+    },
+    {
+        title: "Command on this server (stdio)",
+        value: "stdio",
+    },
+] as const;
+
+export type McpTransport = (typeof McpTransports)[number]["value"];
+
+/**
+ * The last time the app listed a server's tools: `ok`, `error` (see its
+ * `last_error`), or `untested` before the first time.
+ */
+export const McpServerStatuses = [
+    {
+        title: "Untested",
+        value: "untested",
+    },
+    {
+        title: "Connected",
+        value: "ok",
+    },
+    {
+        title: "Error",
+        value: "error",
+    },
+] as const;
+
+export type McpServerStatus = (typeof McpServerStatuses)[number]["value"];

src/dict/private-tables.ts

@@ -2,7 +2,7 @@ import type { TableType } from "@/src/types";
 
 /**
  * Tables holding secrets (password hashes, pending login codes, model
- * provider keys, envs). They are never reachable through the admin CRUD API, not
+ * provider keys, envs, MCP servers' headers and env). They are never reachable through the admin CRUD API, not
  * even by super admins.
  */
 export const PrivateTables: TableType[] = [
@@ -10,4 +10,5 @@ export const PrivateTables: TableType[] = [
     "sso_login_codes",
     "harness_providers",
     "envs",
+    "mcp_servers",
 ];

src/dict/settings-pages-dict.ts

@@ -4,10 +4,12 @@ import {
     KeyRound,
     Layers,
     Monitor,
+    Plug,
     Users,
     SlidersHorizontal,
     UserRound,
     Variable,
+    Wrench,
     type LucideIcon,
 } from "lucide-react";
 import type { BUN_SQLITE_COBBLE_USER_TYPES } from "@/db/types/db";
@@ -49,6 +51,8 @@ export const SettingsPages: SettingsPage[] = [
     { title: "Bots", url: "/admin/settings/bots", Icon: Bot, can_view: canManageCrew },
     { title: "Workspaces", url: "/admin/settings/workspaces", Icon: Layers, can_view: canManageCrew },
     { title: "Computers", url: SettingsComputersPath, Icon: Monitor, can_view: canManageCrew },
+    { title: "MCPs", url: "/admin/settings/mcps", Icon: Plug, can_view: canManageCrew },
+    { title: "Tools", url: "/admin/settings/tools", Icon: Wrench, can_view: canManageCrew },
     {
         title: "Users",
         url: "/admin/settings/users",