[shuv1337]

Problem

Agents can use shared MCP servers but cannot manage them without editing harness configuration or using the settings UI.

Change

Add t3_mcp_server_list, t3_mcp_server_set, t3_mcp_server_remove, and t3_mcp_server_test, all with environmentId peer forwarding. List/set expose only public metadata, hasToken, and shared-<id>. Writes use the existing settings service; testing uses SharedMcpServers.test.

All four require orchestration capability and a live full-access/default thread or a full-access MCP client. Read-only, supervised, plan-mode, inactive, narrowed and restricted-link callers cannot manage the settings. Writes recheck after acquiring the caller's command lock.

Tokens enter only through a one-use request_secret reference, consumed with its project scope. Secret refs are destination-host-local: for a forwarded token update, first request the secret in a thread on that host and pass its destination projectId.

Review fixes

• Owner-approved policy: providers:manage guards UI/WebSocket clients; full-access orchestrator callers may manage shared MCP servers through these tools. Updated the contract comment and user guidance.
• Corrected effects: added or re-enabled servers reach new sessions only; disabling, removing, changing URL, or changing token applies immediately. Updated result text, descriptions, and eval fixtures.
• Removed ineffective annotations on optional fields.
• Set rejects unknown keys, including raw bearerToken, through strict MCP validation and service decoding.
• Settings failures explain that a supplied secret ref was consumed and a new one is needed.
• Partial updates pass SECRET_REDACTED, not the plaintext saved token. The real settings service preserves or clears it, including clearing on URL changes.
• label: null clears the label; removing an unknown id fails with the management service's not_found reason.
• Shortened all four descriptions without merging tools; trimmed orchestration documentation to host-local refs, project scope, URL changes, and session effects.
• Regression coverage includes the corrected notice, raw-token rejection, nullable labels, missing removals, and marker-based preservation. Token keep/clear/URL-change tests now use the real settings service.

Context budget

Measured with AgentContextBudget.test.ts against main 30e776dc26:

Bytes	main	This PR	Change
Claude system append	5,366	5,366	0
Codex additional context	7,096	7,096	0
MCP tool-list JSON	49,064	50,090	+1,026 (+2.09%)

The final budget is 71 bytes smaller than the pre-review PR (50,161 bytes). It includes the nullable-label schema change. No unrelated tool descriptions were cut.

This still exceeds main's ceiling; the context-budget growth check requires maintainer approval via agent-context-increase. No label was added.

Eval results

Live runs were attempted for shared-mcp.ndjson on both supported backends:

• GPT-6 Astra with GPT-6.1 Terra shell: blocked before model calls. ~/.codex/config.toml has no model_providers.vibeproxy; the proxy loader exits with KeyError: 'model_providers'. A CLIProxyAPI endpoint configured under that name, with working authentication, is required. The existing Codex subscription/OAuth login is not an input this eval harness supports; no OpenAI API key is configured there.
• Claude Sonnet 5.5: blocked before model calls. ANTHROPIC_API_KEY is absent from the environment and there is no worktree-root .env. The harness explicitly does not use ANTHROPIC_AUTH_TOKEN or ANTHROPIC_BASE_URL.

No live samples ran; no live pass rate is claimed. Codex-format dry runs successfully built 3 shared-MCP cases and 27 secrets cases. The existing eval-auth papercut is pc_5f1425cca2cf.

Verification

• vp run check:changed: passed format, lint, both knip checks, GraphQL, all 37 affected-package typechecks, and 545 selected tests.
• Focused handler, proxy, MCP HTTP, server settings, settings contracts, context-budget, eval-runner and secret-grader tests: 1,095 passed across 8 files.
• git diff --check: passed.
• Server/MCP-only change; no frontend, provider adapter, or running s2 instance was changed or restarted.
• Review fixes were committed separately. PR remains a draft; no labels, merge, or release.

Model: GPT-6 Astra. Harness: Pi (shuvpi).