# E2E Spec: External MCP Server Configuration

## Overview

Test AgentTeam-managed external MCP server configuration from the dashboard API
through transport checks and runtime injection. Coverage focuses on the
observable contract for Issue #559: users can configure HTTP and stdio MCP
servers once, AgentTeam redacts secrets at API boundaries, tests the configured
server, and injects enabled servers into all supported runtimes.

## Setup

- Use `failpoint.Enable("agentteam-config-dir", ...)` with a temp directory.
- Construct a minimal Gin router with `/api/internal/mcp-servers` handlers.
- Use an `httptest.Server` as the HTTP MCP fixture.
- Use the Go test binary itself as a stdio MCP fixture process, launched with
  a fixture-only environment variable, so the test exercises real process
  spawn/stdin/stdout behavior without depending on shell scripts.

## Test Cases

### Registry CRUD and Redaction

- `POST /api/internal/mcp-servers` creates an HTTP MCP server with a secret
  `Authorization` header.
- API responses redact secret values and return `configured=true`.
- `GET /api/internal/mcp-servers` lists the redacted server.
- `PUT /api/internal/mcp-servers/:id` with a blank configured secret preserves
  the existing persisted secret.
- `DELETE /api/internal/mcp-servers/:id` returns 204 and removes the server.

### HTTP MCP Check

- Saved HTTP server test sends JSON-RPC `initialize`,
  `notifications/initialized`, and `tools/list`.
- If the fixture returns `Mcp-Session-Id`, the check client forwards it on the
  initialized notification and subsequent `tools/list` request.
- Configured headers are sent to the mock HTTP MCP server.
- A successful check returns stage `tools` and the fixture tool list.

### Stdio MCP Check

- Saved stdio server test starts the fixture binary with command, args, cwd,
  literal env, and secret env values.
- Fixture responds to JSON-RPC `initialize`, ignores
  `notifications/initialized`, then returns `tools/list`.
- A successful check returns the fixture tool list, proving env resolution and
  process transport work together.

### Dispatcher Injection

- Enabled HTTP and stdio registry entries are merged after built-in MCP
  servers and before app/dynamic MCP providers.
- Disabled registry entries are skipped.
- HTTP header values and stdio env values resolve from literal, secret, env,
  and inherit sources as applicable.

### Runtime Adapter Rendering

- Claude renders HTTP MCP as `type=http` and stdio MCP as `type=stdio`.
- Codex renders HTTP headers through bearer/header environment variables and
  stdio command/args/cwd/env directly.
- OpenCode renders HTTP MCP as `remote` and stdio MCP as `local`.

### Frontend Wizard

- The web unit tests cover the user-visible wizard path:
  add HTTP MCP server, add Bearer header as a secret, preserve configured
  secrets on update, test saved servers, and delete servers.