feat(mcp): connector marketplace + split the Connectors surface (§7/§14/§15)

Fills a gap the blueprint names: the admin had to hand-author every
`mcp_catalog` entry. A remote feed of vetted connectors now proposes them
and the admin installs — the feed is *consultative*, so §14's risk axis is
untouched and the trust anchor stays on the box.

Marketplace client (`src/frontend/api/marketplace.rs`):
- Fetches the feed server-side (it sends no CORS headers) and caches it;
  icons are proxied for the same reason.
- Verifies every declared SHA-256 before writing, fail-closed and
  all-or-nothing. Feed-supplied paths are refused if they escape
  `./scripts/<id>/`. Importing an `mcp_local` entry still demands the
  admin-only `mcp.register_local_script`.
- Translates the feed's vocabulary into Skald's: `user`→`per_user`,
  `mcp_local`→`local_script`. Scope is read, never inferred from transport
  (a remote connector can be per-user — that is what `mcp.register_remote`
  is for), and an unreadable `type` fails closed to the answer needing more
  authority. The feed's `llm_short_description` maps to `description`, the
  column `render_mcp_list` puts in front of the LLM for `activate_tools()`.
- Feed URL is config (`marketplace.url`), not a constant: an on-premise
  product must not hard-require reaching one vendor's host.

Two silent failures found while wiring it:
- `transport_of` maps anything unknown to Stdio, so the feed's
  `streamable-http` would have tried to spawn a command. Normalised on import.
- Some servers want their key as a query param, not a bearer header, and say
  so with a `{key}` placeholder. Substituted at connect time in
  `global_row_spec`/`user_row_spec` — never at rest, so the key stays in its
  own column and the stored URL stays a template.

Pages, split by the question each answers:
- Connectors — what runs (`UserMcpView` = global ∪ per-user) and what I can
  add. Same page for everyone; the admin just has more verbs. One Available
  list with the verb per row: `per_user`→Activate, `global`→Enable globally.
  Enabling a global is the admin's counterpart to activating a per-user one,
  so the catalog picker dropdown is gone — the entry comes from the row.
- Connector Catalog (admin) — what this box offers. One `Add connector`
  with two sources: marketplace first (vetted, hashed), manual second
  (unvetted by nature) — the order mirrors the trust model.
- Marketplace (admin) — reached from the catalog, not the sidebar: it is a
  destination of an action, not a place.

`available()` no longer returns `McpGlobalServerRow`: that row carries
`api_key` and this view now reaches every logged-in user. A slim `GlobalView`
crosses instead, and an admin sees every global (with `can_use` marking their
own) so one enabled for someone else stays manageable.

Also fixes `connectors-page` having no CSS rule at all — every sibling page
has one, so it never got `flex: 1` and left an empty column beside it.

.gitignore

@@ -17,6 +17,7 @@ blueprint/
 /data/
 /logs/
 /tmp/
+/scripts/
 
 # ── Rust build artifacts ──────────────────────────────────────────────────────
 /target/

CLAUDE.md

@@ -77,7 +77,7 @@ Two rules keep the boundary real, and both are enforced by the compiler:
 | `crates/skald-core/src/users/` | `UserManager` (§11): user directory CRUD on `system.db`, credential check, and the map `userid → SqlitePool` of **unlocked** databases. The pool *is* the unlock token — its connect options carry the DEK as SQLCipher's raw key, so an open pool means the key is in RAM (§9) and dropping it re-locks. Knows nothing about cookies: whatever maps an HTTP session to a user id sits above it |
 | `crates/skald-core/src/crypto/` | Envelope encryption (§4/§5.1). A random 256-bit DEK encrypts `{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under `Argon2id(password, salt)`. **The AEAD tag is the password verifier** — one derivation both authenticates and yields the key, and no second hash sits in the admin-readable DB. Cleartext users store the Argon2id output directly, compared constant-time. Argon2 runs in `spawn_blocking` behind a 2-permit semaphore (256 MiB per derivation) |
 | `src/config.rs` | Loads `config.yml`; LLM clients, strength/use_cases, data root. Also hosts `bootstrap_data_dir()` — under the `desktop` feature, relocates the process cwd to a per-user data dir when running inside a `.app` bundle (no-op in dev mode and headless mode) |
-| `crates/skald-core/src/mcp/` | MCP client manager (connects to external MCP servers) |
+| `crates/skald-core/src/mcp/` | MCP runtimes + the `McpProvider` seam (§7): the shared host **global** runtime and the per-user **container** runtimes, unioned per session as `UserMcpView`. See the MCP connectors section |
 | `crates/skald-core/src/plugin/` | Plugin system: discovery, enable/disable, tool registration |
 | `crates/skald-core/src/cron/` | Scheduled job runner |
 | `crates/skald-core/src/compactor.rs` | Context compaction (summarises history when token budget exceeded) |
@@ -100,8 +100,8 @@ Two rules keep the boundary real, and both are enforced by the compiler:
 
 The schema is split into two buckets (§5.1), and the split is the point:
 
-- **`create_registry_tables`** — instance-wide, readable without any user key: `users`, `roles`, `llm_providers`, `llm_models`, `transcribe_models`, `tts_models`, `image_generate_models`, `plugins`, `approval_rules`, `tool_permission_groups`, `config`, `known_tools`, `llm_requests`, `shared_folders` + `shared_folder_members`. The last two (accessor `db/shared_folders.rs`) are the **membership** of the on-disk shared folders (§6): a junction table so a member can be read-only (`can_write`) and so the container mount topology + the `shared/{X}` fs routing both query it. FK `shared_folder_members.user_id → users(id)` is registry→registry (same file), which is allowed — unlike an owner→registry key.
+- **`create_registry_tables`** — instance-wide, readable without any user key: `users`, `roles`, `llm_providers`, `llm_models`, `transcribe_models`, `tts_models`, `image_generate_models`, `plugins`, `approval_rules`, `tool_permission_groups`, `config`, `known_tools`, `llm_requests`, `mcp_catalog`, `mcp_global_servers` + `mcp_global_access`, `role_capabilities`, `shared_folders` + `shared_folder_members`. The MCP four back the Connectors model (§7/§14/§15 — see its own section). The last two (accessor `db/shared_folders.rs`) are the **membership** of the on-disk shared folders (§6): a junction table so a member can be read-only (`can_write`) and so the container mount topology + the `shared/{X}` fs routing both query it. FK `shared_folder_members.user_id → users(id)` is registry→registry (same file), which is allowed — unlike an owner→registry key.
-- **`create_owner_tables`** — one owner's content, **identical schema in every file that has it**: `chat_sessions`, `chat_sessions_stack`, `chat_history`, `chat_llm_tools`, `chat_summaries`, `session_scratchpad`, `session_mcp_grants`, `stack_mcp_grants`, `scheduled_jobs`, `job_runs`, `mcp_servers`, `mcp_events`, `sources`, `secrets`, `projects`, `project_tickets`, `llm_request_payloads`, `memory_docs` (+ FTS5 `memory_docs_fts`). Because `memory_docs` is an owner table, one definition backs **private** memory in each `{userid}.db` and **shared** memory in `system.db` (the household owner) — see the memory namespace note below.
+- **`create_owner_tables`** — one owner's content, **identical schema in every file that has it**: `chat_sessions`, `chat_sessions_stack`, `chat_history`, `chat_llm_tools`, `chat_summaries`, `session_scratchpad`, `session_mcp_grants`, `stack_mcp_grants`, `scheduled_jobs`, `job_runs`, `mcp_user_servers`, `mcp_events`, `sources`, `secrets`, `projects`, `project_tickets`, `llm_request_payloads`, `memory_docs` (+ FTS5 `memory_docs_fts`). `mcp_user_servers` (a user's activated per-user connectors) carries `catalog_name` as a **bare `TEXT` snapshot** of `mcp_catalog.name`, never a FK — an owner→registry key would fail every INSERT. Because `memory_docs` is an owner table, one definition backs **private** memory in each `{userid}.db` and **shared** memory in `system.db` (the household owner) — see the memory namespace note below.
 
 **No foreign key in the owner bucket may point at a registry table.** SQLite cannot enforce a key across files, not even through `ATTACH`, and sqlx turns on `PRAGMA foreign_keys`: the `CREATE TABLE` succeeds and every `INSERT` fails. `db::tests::owner_tables_stand_alone_with_foreign_keys_on` enforces this by running the owner schema against a database holding nothing else, then inserting a row into each table. Two keys crossed and were fixed: `chat_history.model_db_id` (dropped — write-only, and `llm_requests.model_name` already records the model) and `project_tickets.job_id` (fixed by moving `projects`/`project_tickets` into the owner bucket).
 
@@ -109,7 +109,7 @@ The schema is split into two buckets (§5.1), and the split is the point:
 
 **Memory injection into the prompt**: `MessageBuilder::load_inject_memory` routes each `meta.inject_memory` entry — `user-memory/…` → owner pool, `shared-memory/…` → the shared (`system.db`) pool, both via `memory_docs::get`; anything else (`data/…`, `$WD/…`) is a disk read. The shared pool is threaded `ChatSessionManager` → handler → `MessageBuilder`. `main` and `project-coordinator` inject `user-memory/index.md` + `shared-memory/index.md`.
 
-`system.db` still gets **both** bucket functions — but no longer because the migration is unstarted. It gets the owner schema because it *is* the owner of **shared** memory (`memory_docs`) plus, for now, the globally-scoped `secrets` and `mcp_servers`/`mcp_events` (`SecretsStore` and `McpManager` are built on the system pool and shared by reference into every `UserContext`). Every *other* owner table is created there but never written to anymore — the global owner-bound managers that would write them (chat/jobs/etc.) are inert (see "Current state"). Fully dropping `create_owner_tables` from `system.db` is blocked on the §4/§7/§14 scope decisions for secrets and MCP, not on call-site migration.
+`system.db` still gets **both** bucket functions — but no longer because the migration is unstarted. It gets the owner schema because it *is* the owner of **shared** memory (`memory_docs`) plus, for now, the globally-scoped `secrets` and the `mcp_events` lifecycle log (`SecretsStore` and the global `McpManager` are built on the system pool and shared by reference into every `UserContext`; the global runtime's *config* now lives in the registry table `mcp_global_servers`, and per-user connector config in each user's owner `mcp_user_servers`). Every *other* owner table is created there but never written to anymore — the global owner-bound managers that would write them (chat/jobs/etc.) are inert (see "Current state"). Fully dropping `create_owner_tables` from `system.db` is blocked on the §4 scope decision for secrets (plus the residual global `mcp_events` log), not on call-site migration.
 
 `users` (`crates/skald-core/src/db/users.rs`) holds the directory plus auth material. It lives in the system DB, which the box owner can read, so it must never store anything that derives a user's key. `Credentials` is an enum mirroring the table's `CHECK`: an encrypted user carries a **wrapped DEK** (whose AEAD tag *is* the password verifier — hence no `password_hash`); a cleartext user carries an ordinary verifier, or none. `User` is deliberately not `Serialize` and its `Debug` redacts key material — use `User::summary()` for anything leaving the process. `role_id` references `roles(id)` (the `roles` table is now seeded before `users` in `create_registry_tables`).
 
@@ -130,7 +130,26 @@ Two views, **one storage**: the fs-tools run **host-side** in the Skald process
 
 **Containment** (`resolve_host_path`): every physical fs-tool op canonicalizes the resolved path (following symlinks) and prefix-checks it against its mount base, **fail-closed**. Since the same tree is writable from inside the container, a symlink planted there that points outside the home/shared root is caught here — the host-side tool never escapes the user's workspace. `grep_files` stays disk-only (regex ≠ FTS; memory → `memory_search`) but resolves its root the same way. `execute_cmd`'s `workdir` is an agent path mapped to its container path via `UserFs::to_container`.
 
-The threading: `UserContext.fs` (built by `container::build_user_fs` at login, snapshotting shared memberships) → `ChatSessionManager` → `ChatSessionHandler.fs` → `ToolContext.fs`. `execute_cmd` cancellation caveat: dropping the `docker exec` client on /stop may not kill the in-container process (a robust stop tracking the PID + `docker exec … kill` is a follow-up). **MCP servers do not yet run in the container** — relocating the per-user stateful MCPs (WhatsApp/LinkedIn session-file collision, §7) into the container is the next round; the container infra here enables it.
+The threading: `UserContext.fs` (built by `container::build_user_fs` at login, snapshotting shared memberships) → `ChatSessionManager` → `ChatSessionHandler.fs` → `ToolContext.fs`. `execute_cmd` cancellation caveat: dropping the `docker exec` client on /stop may not kill the in-container process (a robust stop tracking the PID + `docker exec … kill` is a follow-up). **Per-user MCP connectors now run inside this container** (§7) — the container infra enabled it; see the MCP connectors section.
+
+## MCP connectors (blueprint §7/§14/§15)
+
+MCP servers are surfaced to users as **"Connectors"** (UI naming; `mcp`/schema stays neutral, §0.1). The old single owner table `mcp_servers`, the agent-facing `register_mcp`/`delete_mcp` tools, and the `mcp` kinds of `list_items`/`toggle_item` are **gone**. Connectors are now admin-curated and user-activated through the Connectors UI/API — never written by the agent, which closes the §14 RCE vector (prompt-injection → agent writes+registers a local script → arbitrary code on the box).
+
+**Two runtimes, one view (§7).** A session's MCP tools are the **union** of:
+
+- **Global runtime** — shared, stateless connectors (web-search, Tavily…) that run on the **host**, connected at boot from `mcp_global_servers` by `McpManager::initialize`. Filtered per user by `mcp_global_access`.
+- **Per-user runtime** — the connectors a user has activated, run **inside their container**, started at first login from that user's owner `mcp_user_servers` and living until restart (§9; the `docker exec -i` children die via `kill_on_drop` when the `UserContext` drops).
+
+`McpProvider` (`mcp/provider.rs`) is the trait the session code talks to, so `all_tool_defs` / `render_mcp_list` / `ActivateTools` never learn which runtime owns a server. `McpManager` implements it directly (used for the inert ownerless bundle, §19); `UserMcpView` implements it as `global ∪ user`, where `accessible_global` is a snapshot of `mcp_global_access` captured when the `UserContext` is built (like fs membership). Both runtimes share `McpManager::connect_all(specs, boot)`; `McpServerSpec` + `global_row_spec`/`user_row_spec` turn a DB row into a connectable spec (a per-user `local_script` spec targets the user's container).
+
+**Authorization is a capability on the role, not `if role==admin`** (§0.1/§14 — `db/role_capabilities.rs`): `mcp.register_remote` + `mcp.register_local_from_catalog` are self-service (seeded on every new role by `roles::create` via `seed_defaults`); `mcp.register_local_script` + `mcp.manage_catalog` are admin-only. `admin` holds every capability by construction (short-circuit in `has()`). API handlers gate through `require_cap`.
+
+**Tables** (see DB section) — registry: `mcp_catalog` (admin-vetted templates; holds only the *schema* of what an activation must supply, never live creds), `mcp_global_servers` + `mcp_global_access`, `role_capabilities`. Owner: `mcp_user_servers` (per-user activations; `api_key` encrypted at rest, `catalog_name` a bare `TEXT` snapshot).
+
+**Endpoints** (`src/frontend/api/mcp.rs`, mounted in `api/mod.rs`) — admin: `/mcp/catalog` (GET/POST/DELETE), `/mcp/global` (list/enable/delete + `/{id}/access` GET/PUT). User: `/mcp/available`, `/mcp/activate`, `/mcp/activated` (+ DELETE `/{id}` to deactivate). `connectors.js` (`<connectors-page>`) renders the user view (activate/deactivate + granted globals) always, and the admin view (catalog + global + per-server access grants) when `role_id === 'admin'`.
+
+**Deferred:** interactive per-user auth (the §15 OAuth-callback / QR / SSH elicitation flow) — only `none`/`api_key` auth kinds are wired. No boot seed of catalog presets yet; the admin populates the catalog from the UI.
 
 ## Sub-agent system
 
@@ -232,6 +251,7 @@ All extend `LightElement` from `web/lib/base.js` (Lit). `ChatSession` (`web/lib/
 | `agent-inbox.js` | `<agent-inbox-page>` | Pending approvals + clarifications from background sessions |
 | `approval-rules.js` | `<approval-rules-page>` | Approval rule management |
 | `cron-jobs.js` | `<cron-jobs-page>` | Scheduled job management |
+| `connectors.js` | `<connectors-page>` | MCP Connectors: user activate/deactivate + granted globals; admin catalog + global-server + per-server access management (§7/§14/§15) |
 | `llm-providers.js` | `<llm-providers-page>` | LLM provider management |
 | `models-hub.js` | `<models-hub-page>` | Models hub landing (LLM / Transcription / Image) |
 | `models-llm.js` | `<models-llm-section>` | LLM model CRUD + drag-and-drop priority |

Cargo.lock

@@ -5484,6 +5484,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
+ "sha2 0.10.9",
  "skald-core",
  "sqlx",
  "tauri",

Cargo.toml

@@ -57,6 +57,9 @@ tower = "0.5"
 serde = { version = "1", features = ["derive"] }
 serde_yaml = "0.9"
 anyhow = "1"
+# Verifies the SHA-256 digests the connector marketplace declares for each file
+# it serves (src/frontend/api/marketplace.rs).
+sha2 = "0.10"
 sqlx = { version = "0.9.0", features = ["runtime-tokio", "sqlite"] }
 reqwest = { version = "0.13.4", default-features = false, features = ["rustls-no-provider", "charset", "http2", "system-proxy", "json", "multipart"] }
 # rustls is pinned as a direct dependency solely to select the crypto provider:

crates/mcp-client/src/config.rs

@@ -16,6 +16,11 @@ pub struct McpServerConfig {
     pub url:     Option<String>,
     /// http only: API key sent as `Authorization: Bearer <key>` (supports `${VAR}` interpolation).
     pub api_key: Option<String>,
+    /// stdio only: when `Some(container)`, the command runs INSIDE that Docker
+    /// container via `docker exec -i` instead of on the host. Set at runtime by
+    /// the manager (per-user connectors, blueprint §7), never parsed from config.
+    #[serde(skip)]
+    pub launch_in: Option<String>,
 }
 
 #[derive(Debug, Deserialize, Clone)]

crates/mcp-client/src/server.rs

@@ -233,15 +233,42 @@ impl McpServer {
         let command = cfg.command.as_deref()
             .ok_or_else(|| anyhow::anyhow!("stdio server '{}' requires 'command'", cfg.name))?;
 
-        let mut cmd = Command::new(command);
+        let mut cmd = match &cfg.launch_in {
+            // Host transport: spawn the command directly.
+            None => {
+                let mut c = Command::new(command);
                 if let Some(args) = &cfg.args {
-            cmd.args(args);
+                    c.args(args);
                 }
                 if let Some(env_map) = &cfg.env {
                     for (k, v) in env_map {
-                cmd.env(k, interpolate_env(v));
+                        c.env(k, interpolate_env(v));
                     }
                 }
+                c
+            }
+            // Container transport (per-user connectors, blueprint §7): run the
+            // command INSIDE the user's container via `docker exec -i`. stdin/
+            // stdout/stderr are proxied transparently, so the JSON-RPC read-loop,
+            // the stderr drain and elicitation write-back all work unchanged. Env
+            // is passed with `-e K=V` so it lands inside the container, not on the
+            // `docker` client. Workdir defaults to the image WORKDIR (`/root`, the
+            // bind-mounted home), so no `-w` coupling to skald-core's path layout.
+            Some(container) => {
+                let mut c = Command::new("docker");
+                c.arg("exec").arg("-i");
+                if let Some(env_map) = &cfg.env {
+                    for (k, v) in env_map {
+                        c.arg("-e").arg(format!("{k}={}", interpolate_env(v)));
+                    }
+                }
+                c.arg(container).arg(command);
+                if let Some(args) = &cfg.args {
+                    c.args(args);
+                }
+                c
+            }
+        };
         cmd.stdin(Stdio::piped())
            .stdout(Stdio::piped())
            // Capture the child's stderr instead of inheriting it: many MCP

crates/mcp-client/tests/elicitation.rs

@@ -109,6 +109,7 @@ async fn elicitation_roundtrip_returns_secret_to_server() {
         env:       None,
         url:       None,
         api_key:   None,
+        launch_in: None,
     };
 
     let server = McpServer::start(&cfg, None, None, Some(Arc::new(AcceptHandler)))

crates/mcp-client/tests/logging.rs

@@ -94,6 +94,7 @@ async fn stderr_and_log_records_are_captured_and_diverted() {
         env: None,
         url: None,
         api_key: None,
+        launch_in: None,
     };
 
     let (notif_tx, mut notif_rx) = mpsc::unbounded_channel::<McpNotification>();

crates/mcp-client/tests/pagination.rs

@@ -86,6 +86,7 @@ async fn tools_list_follows_next_cursor_across_pages() {
         env: None,
         url: None,
         api_key: None,
+        launch_in: None,
     };
 
     let server = McpServer::start(&cfg, None, None, None)

crates/mcp-client/tests/tasks.rs

@@ -101,6 +101,7 @@ fn cfg(script: &std::path::Path, mode: &str, marker: Option<&std::path::Path>) -
         env: None,
         url: None,
         api_key: None,
+        launch_in: None,
     }
 }
 

crates/skald-core/src/db/mcp_catalog.rs

@@ -0,0 +1,177 @@
+//! The admin-curated catalog of installable MCP connectors (blueprint §14/§15).
+//!
+//! Registry table in `system.db`: instance-wide, listable without any user key so
+//! the "Connectors" UI can render it. Each entry is a *template* — a per-user
+//! connector is later instantiated from it into a `{userid}.db`
+//! (`mcp_user_servers`), or a global one is enabled by the admin
+//! (`mcp_global_servers`). No live credential ever lands here: `config_schema_json`
+//! only names the env/secret keys an activation must collect.
+
+use std::collections::HashMap;
+
+use anyhow::Result;
+use serde::Serialize;
+use sqlx::SqlitePool;
+
+#[derive(Debug, Clone, Serialize, sqlx::FromRow)]
+pub struct McpCatalogRow {
+    pub id:                 i64,
+    pub name:               String,
+    /// 'per_user' | 'global' — which category (§15) this entry can be activated as.
+    pub scope:              String,
+    /// 'remote' | 'local_script' — the §14 risk axis.
+    pub source:             String,
+    pub transport:          String,
+    pub command:            Option<String>,
+    pub args_json:          Option<String>,
+    pub env_json:           Option<String>,
+    pub url:                Option<String>,
+    /// local_script: the vetted source path under `./scripts`.
+    pub script_path:        Option<String>,
+    /// Names of the env/secret keys the activation UI must collect (never values).
+    pub config_schema_json: Option<String>,
+    /// 'none'|'api_key'|'oauth'|'qr'|'ssh_key'. Only 'none'/'api_key' are wired now.
+    pub auth_kind:          String,
+    /// JSON array of role ids allowed to activate this; NULL = all roles (§15).
+    pub role_filter:        Option<String>,
+    pub friendly_name:      Option<String>,
+    pub description:        Option<String>,
+    pub created_at:         String,
+}
+
+impl McpCatalogRow {
+    pub fn args(&self) -> Vec<String> {
+        self.args_json.as_deref()
+            .and_then(|s| serde_json::from_str(s).ok())
+            .unwrap_or_default()
+    }
+
+    pub fn env(&self) -> HashMap<String, String> {
+        self.env_json.as_deref()
+            .and_then(|s| serde_json::from_str(s).ok())
+            .unwrap_or_default()
+    }
+
+    /// The role ids allowed to activate this entry, or `None` when unrestricted.
+    pub fn allowed_roles(&self) -> Option<Vec<String>> {
+        self.role_filter.as_deref()
+            .and_then(|s| serde_json::from_str::<Vec<String>>(s).ok())
+    }
+
+    /// Whether a user in `role_id` may activate this entry (§15 per-role catalog).
+    pub fn allowed_for_role(&self, role_id: &str) -> bool {
+        match self.allowed_roles() {
+            None => true,
+            Some(roles) => roles.iter().any(|r| r == role_id),
+        }
+    }
+}
+
+const SELECT: &str =
+    "SELECT id, name, scope, source, transport, command, args_json, env_json, url, \
+            script_path, config_schema_json, auth_kind, role_filter, friendly_name, \
+            description, created_at \
+     FROM mcp_catalog";
+
+// ── Reads ────────────────────────────────────────────────────────────────────
+
+pub async fn list(pool: &SqlitePool) -> Result<Vec<McpCatalogRow>> {
+    let rows = sqlx::query_as::<_, McpCatalogRow>(sqlx::AssertSqlSafe(format!("{SELECT} ORDER BY name")))
+        .fetch_all(pool)
+        .await?;
+    Ok(rows)
+}
+
+/// Catalog entries in a given scope ('per_user' | 'global').
+pub async fn list_for_scope(pool: &SqlitePool, scope: &str) -> Result<Vec<McpCatalogRow>> {
+    let rows = sqlx::query_as::<_, McpCatalogRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE scope = ? ORDER BY name")))
+        .bind(scope)
+        .fetch_all(pool)
+        .await?;
+    Ok(rows)
+}
+
+pub async fn get_by_name(pool: &SqlitePool, name: &str) -> Result<Option<McpCatalogRow>> {
+    let row = sqlx::query_as::<_, McpCatalogRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE name = ?")))
+        .bind(name)
+        .fetch_optional(pool)
+        .await?;
+    Ok(row)
+}
+
+pub async fn get(pool: &SqlitePool, id: i64) -> Result<Option<McpCatalogRow>> {
+    let row = sqlx::query_as::<_, McpCatalogRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE id = ?")))
+        .bind(id)
+        .fetch_optional(pool)
+        .await?;
+    Ok(row)
+}
+
+// ── Writes ───────────────────────────────────────────────────────────────────
+
+/// Fields for creating or updating a catalog entry (keyed on `name`).
+pub struct UpsertCatalog<'a> {
+    pub name:               &'a str,
+    pub scope:              &'a str,
+    pub source:             &'a str,
+    pub transport:          &'a str,
+    pub command:            Option<&'a str>,
+    pub args_json:          Option<String>,
+    pub env_json:           Option<String>,
+    pub url:                Option<&'a str>,
+    pub script_path:        Option<&'a str>,
+    pub config_schema_json: Option<String>,
+    pub auth_kind:          &'a str,
+    pub role_filter:        Option<String>,
+    pub friendly_name:      Option<&'a str>,
+    pub description:        Option<&'a str>,
+}
+
+pub async fn upsert(pool: &SqlitePool, e: UpsertCatalog<'_>) -> Result<i64> {
+    let row = sqlx::query_as::<_, (i64,)>(
+        "INSERT INTO mcp_catalog
+            (name, scope, source, transport, command, args_json, env_json, url,
+             script_path, config_schema_json, auth_kind, role_filter, friendly_name, description)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14)
+         ON CONFLICT(name) DO UPDATE SET
+             scope              = excluded.scope,
+             source             = excluded.source,
+             transport          = excluded.transport,
+             command            = excluded.command,
+             args_json          = excluded.args_json,
+             env_json           = excluded.env_json,
+             url                = excluded.url,
+             script_path        = excluded.script_path,
+             config_schema_json = excluded.config_schema_json,
+             auth_kind          = excluded.auth_kind,
+             role_filter        = excluded.role_filter,
+             friendly_name      = excluded.friendly_name,
+             description        = excluded.description
+         RETURNING id",
+    )
+    .bind(e.name)
+    .bind(e.scope)
+    .bind(e.source)
+    .bind(e.transport)
+    .bind(e.command)
+    .bind(e.args_json)
+    .bind(e.env_json)
+    .bind(e.url)
+    .bind(e.script_path)
+    .bind(e.config_schema_json)
+    .bind(e.auth_kind)
+    .bind(e.role_filter)
+    .bind(e.friendly_name)
+    .bind(e.description)
+    .fetch_one(pool)
+    .await?;
+    Ok(row.0)
+}
+
+pub async fn delete(pool: &SqlitePool, id: i64) -> Result<()> {
+    sqlx::query("DELETE FROM mcp_catalog WHERE id = ?")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}

crates/skald-core/src/db/mcp_global_access.rs

@@ -0,0 +1,91 @@
+//! Which users may use each globally-active MCP connector (blueprint §15).
+//!
+//! Registry junction table in `system.db` — the per-user access filter over
+//! `mcp_global_servers`. Both FKs are registry→registry (allowed), mirroring
+//! `shared_folder_members`. The admin UI's "grant to all / by role" is just a
+//! convenience that inserts rows here.
+
+use anyhow::Result;
+use sqlx::SqlitePool;
+
+// ── Reads ────────────────────────────────────────────────────────────────────
+
+/// The names of the **enabled** global servers a user may use. Feeds the
+/// `accessible_global` snapshot captured when the user's context is built.
+pub async fn server_names_for_user(pool: &SqlitePool, user_id: &str) -> Result<Vec<String>> {
+    let rows = sqlx::query_as::<_, (String,)>(
+        "SELECT s.name
+         FROM   mcp_global_access a
+         JOIN   mcp_global_servers s ON s.id = a.server_id
+         WHERE  a.user_id = ? AND s.enabled = 1
+         ORDER  BY s.name",
+    )
+    .bind(user_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows.into_iter().map(|(n,)| n).collect())
+}
+
+/// The ids of the users granted access to a given global server.
+pub async fn users_for_server(pool: &SqlitePool, server_id: i64) -> Result<Vec<String>> {
+    let rows = sqlx::query_as::<_, (String,)>(
+        "SELECT user_id FROM mcp_global_access WHERE server_id = ? ORDER BY user_id",
+    )
+    .bind(server_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows.into_iter().map(|(u,)| u).collect())
+}
+
+pub async fn has_access(pool: &SqlitePool, server_id: i64, user_id: &str) -> Result<bool> {
+    let row = sqlx::query_as::<_, (i64,)>(
+        "SELECT 1 FROM mcp_global_access WHERE server_id = ? AND user_id = ?",
+    )
+    .bind(server_id)
+    .bind(user_id)
+    .fetch_optional(pool)
+    .await?;
+    Ok(row.is_some())
+}
+
+// ── Writes ───────────────────────────────────────────────────────────────────
+
+/// Grants a user access to a global server. Idempotent on the PK.
+pub async fn grant(pool: &SqlitePool, server_id: i64, user_id: &str) -> Result<()> {
+    sqlx::query(
+        "INSERT OR IGNORE INTO mcp_global_access (server_id, user_id) VALUES (?, ?)",
+    )
+    .bind(server_id)
+    .bind(user_id)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+pub async fn revoke(pool: &SqlitePool, server_id: i64, user_id: &str) -> Result<()> {
+    sqlx::query("DELETE FROM mcp_global_access WHERE server_id = ? AND user_id = ?")
+        .bind(server_id)
+        .bind(user_id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Replaces the full access list for a server in one shot (used by the admin UI's
+/// "set who can use this" form, incl. the by-role bulk grant).
+pub async fn set_access(pool: &SqlitePool, server_id: i64, user_ids: &[String]) -> Result<()> {
+    let mut tx = pool.begin().await?;
+    sqlx::query("DELETE FROM mcp_global_access WHERE server_id = ?")
+        .bind(server_id)
+        .execute(&mut *tx)
+        .await?;
+    for user_id in user_ids {
+        sqlx::query("INSERT OR IGNORE INTO mcp_global_access (server_id, user_id) VALUES (?, ?)")
+            .bind(server_id)
+            .bind(user_id)
+            .execute(&mut *tx)
+            .await?;
+    }
+    tx.commit().await?;
+    Ok(())
+}

crates/skald-core/src/db/mcp_global_servers.rs

@@ -0,0 +1,145 @@
+//! Globally-active MCP connectors (blueprint §7/§15b): shared, stateless servers
+//! (web-search, Tavily…) that run on the HOST and are offered to every user the
+//! admin grants access to (`mcp_global_access`).
+//!
+//! Registry table in `system.db`. The global secret (the admin's API key) is fine
+//! here — `system.db` is admin-owned (§4). `catalog_name` is a registry→registry
+//! FK to `mcp_catalog(name)` (both in this file), which is allowed.
+
+use std::collections::HashMap;
+
+use anyhow::Result;
+use serde::Serialize;
+use sqlx::SqlitePool;
+
+#[derive(Debug, Clone, Serialize, sqlx::FromRow)]
+pub struct McpGlobalServerRow {
+    pub id:            i64,
+    pub name:          String,
+    pub catalog_name:  Option<String>,
+    pub transport:     String,
+    pub command:       Option<String>,
+    pub args_json:     Option<String>,
+    pub env_json:      Option<String>,
+    pub url:           Option<String>,
+    pub api_key:       Option<String>,
+    pub friendly_name: Option<String>,
+    pub description:   Option<String>,
+    pub enabled:       bool,
+}
+
+impl McpGlobalServerRow {
+    pub fn args(&self) -> Vec<String> {
+        self.args_json.as_deref()
+            .and_then(|s| serde_json::from_str(s).ok())
+            .unwrap_or_default()
+    }
+
+    pub fn env(&self) -> HashMap<String, String> {
+        self.env_json.as_deref()
+            .and_then(|s| serde_json::from_str(s).ok())
+            .unwrap_or_default()
+    }
+}
+
+const SELECT: &str =
+    "SELECT id, name, catalog_name, transport, command, args_json, env_json, url, \
+            api_key, friendly_name, description, enabled \
+     FROM mcp_global_servers";
+
+// ── Reads ────────────────────────────────────────────────────────────────────
+
+pub async fn all(pool: &SqlitePool) -> Result<Vec<McpGlobalServerRow>> {
+    let rows = sqlx::query_as::<_, McpGlobalServerRow>(sqlx::AssertSqlSafe(format!("{SELECT} ORDER BY name")))
+        .fetch_all(pool)
+        .await?;
+    Ok(rows)
+}
+
+pub async fn all_enabled(pool: &SqlitePool) -> Result<Vec<McpGlobalServerRow>> {
+    let rows = sqlx::query_as::<_, McpGlobalServerRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE enabled = 1 ORDER BY name")))
+        .fetch_all(pool)
+        .await?;
+    Ok(rows)
+}
+
+pub async fn get(pool: &SqlitePool, id: i64) -> Result<Option<McpGlobalServerRow>> {
+    let row = sqlx::query_as::<_, McpGlobalServerRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE id = ?")))
+        .bind(id)
+        .fetch_optional(pool)
+        .await?;
+    Ok(row)
+}
+
+pub async fn get_by_name(pool: &SqlitePool, name: &str) -> Result<Option<McpGlobalServerRow>> {
+    let row = sqlx::query_as::<_, McpGlobalServerRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE name = ?")))
+        .bind(name)
+        .fetch_optional(pool)
+        .await?;
+    Ok(row)
+}
+
+// ── Writes ───────────────────────────────────────────────────────────────────
+
+pub struct UpsertGlobal<'a> {
+    pub name:          &'a str,
+    pub catalog_name:  Option<&'a str>,
+    pub transport:     &'a str,
+    pub command:       Option<&'a str>,
+    pub args_json:     Option<String>,
+    pub env_json:      Option<String>,
+    pub url:           Option<&'a str>,
+    pub api_key:       Option<&'a str>,
+    pub friendly_name: Option<&'a str>,
+    pub description:   Option<&'a str>,
+}
+
+pub async fn upsert(pool: &SqlitePool, p: UpsertGlobal<'_>) -> Result<i64> {
+    let row = sqlx::query_as::<_, (i64,)>(
+        "INSERT INTO mcp_global_servers
+            (name, catalog_name, transport, command, args_json, env_json, url, api_key, friendly_name, description, enabled)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 1)
+         ON CONFLICT(name) DO UPDATE SET
+             catalog_name  = excluded.catalog_name,
+             transport     = excluded.transport,
+             command       = excluded.command,
+             args_json     = excluded.args_json,
+             env_json      = excluded.env_json,
+             url           = excluded.url,
+             api_key       = excluded.api_key,
+             friendly_name = excluded.friendly_name,
+             description   = excluded.description,
+             enabled       = 1
+         RETURNING id",
+    )
+    .bind(p.name)
+    .bind(p.catalog_name)
+    .bind(p.transport)
+    .bind(p.command)
+    .bind(p.args_json)
+    .bind(p.env_json)
+    .bind(p.url)
+    .bind(p.api_key)
+    .bind(p.friendly_name)
+    .bind(p.description)
+    .fetch_one(pool)
+    .await?;
+    Ok(row.0)
+}
+
+pub async fn set_enabled(pool: &SqlitePool, id: i64, enabled: bool) -> Result<()> {
+    sqlx::query("UPDATE mcp_global_servers SET enabled = ?1 WHERE id = ?2")
+        .bind(enabled as i64)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+pub async fn delete(pool: &SqlitePool, id: i64) -> Result<()> {
+    sqlx::query("DELETE FROM mcp_global_servers WHERE id = ?")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}

crates/skald-core/src/db/mcp_servers.rs

@@ -1,129 +0,0 @@
-use std::collections::HashMap;
-
-use anyhow::Result;
-use serde::{Deserialize, Serialize};
-use sqlx::SqlitePool;
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct McpServerRow {
-    pub id:            i64,
-    pub name:          String,
-    pub transport:     String,
-    pub command:       Option<String>,
-    pub args_json:     Option<String>,
-    pub env_json:      Option<String>,
-    pub url:           Option<String>,
-    pub api_key:       Option<String>,
-    pub description:   Option<String>,
-    pub friendly_name: Option<String>,
-    pub enabled:       bool,
-}
-
-impl McpServerRow {
-    pub fn args(&self) -> Vec<String> {
-        self.args_json.as_deref()
-            .and_then(|s| serde_json::from_str(s).ok())
-            .unwrap_or_default()
-    }
-
-    pub fn env(&self) -> HashMap<String, String> {
-        self.env_json.as_deref()
-            .and_then(|s| serde_json::from_str(s).ok())
-            .unwrap_or_default()
-    }
-}
-
-type RawRow = (i64, String, String, Option<String>, Option<String>, Option<String>, Option<String>, Option<String>, Option<String>, Option<String>, i64);
-
-fn from_raw(r: RawRow) -> McpServerRow {
-    McpServerRow {
-        id:            r.0,
-        name:          r.1,
-        transport:     r.2,
-        command:       r.3,
-        args_json:     r.4,
-        env_json:      r.5,
-        url:           r.6,
-        api_key:       r.7,
-        description:   r.8,
-        friendly_name: r.9,
-        enabled:       r.10 != 0,
-    }
-}
-
-const SELECT: &str =
-    "SELECT id, name, transport, command, args_json, env_json, url, api_key, description, friendly_name, enabled \
-     FROM mcp_servers";
-
-pub async fn all(pool: &SqlitePool) -> Result<Vec<McpServerRow>> {
-    let rows = sqlx::query_as::<_, RawRow>(sqlx::AssertSqlSafe(format!("{SELECT} ORDER BY name")))
-        .fetch_all(pool)
-        .await?;
-    Ok(rows.into_iter().map(from_raw).collect())
-}
-
-pub async fn all_enabled(pool: &SqlitePool) -> Result<Vec<McpServerRow>> {
-    let rows = sqlx::query_as::<_, RawRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE enabled = 1 ORDER BY name")))
-        .fetch_all(pool)
-        .await?;
-    Ok(rows.into_iter().map(from_raw).collect())
-}
-
-pub struct UpsertParams<'a> {
-    pub name:          &'a str,
-    pub transport:     &'a str,
-    pub command:       Option<&'a str>,
-    pub args_json:     Option<String>,
-    pub env_json:      Option<String>,
-    pub url:           Option<&'a str>,
-    pub api_key:       Option<&'a str>,
-    pub description:   Option<&'a str>,
-    pub friendly_name: Option<&'a str>,
-}
-
-pub async fn upsert(pool: &SqlitePool, p: UpsertParams<'_>) -> Result<i64> {
-    let row = sqlx::query_as::<_, (i64,)>(
-        "INSERT INTO mcp_servers (name, transport, command, args_json, env_json, url, api_key, description, friendly_name, enabled)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 1)
-         ON CONFLICT(name) DO UPDATE SET
-             transport     = excluded.transport,
-             command       = excluded.command,
-             args_json     = excluded.args_json,
-             env_json      = excluded.env_json,
-             url           = excluded.url,
-             api_key       = excluded.api_key,
-             description   = excluded.description,
-             friendly_name = excluded.friendly_name,
-             enabled       = 1
-         RETURNING id",
-    )
-    .bind(p.name)
-    .bind(p.transport)
-    .bind(p.command)
-    .bind(p.args_json)
-    .bind(p.env_json)
-    .bind(p.url)
-    .bind(p.api_key)
-    .bind(p.description)
-    .bind(p.friendly_name)
-    .fetch_one(pool)
-    .await?;
-    Ok(row.0)
-}
-
-pub async fn set_enabled(pool: &SqlitePool, name: &str, enabled: bool) -> Result<()> {
-    sqlx::query("UPDATE mcp_servers SET enabled = ?1 WHERE name = ?2")
-        .bind(enabled as i64)
-        .bind(name)
-        .execute(pool)
-        .await?;
-    Ok(())
-}
-
-pub async fn delete(pool: &SqlitePool, name: &str) -> Result<()> {
-    sqlx::query("DELETE FROM mcp_servers WHERE name = ?1")
-        .bind(name)
-        .execute(pool)
-        .await?;
-    Ok(())
-}

crates/skald-core/src/db/mcp_user_servers.rs

@@ -0,0 +1,156 @@
+//! A user's activated per-user MCP connectors (blueprint §7/§14).
+//!
+//! Owner table in each `{userid}.db` — encrypted at rest (SQLCipher), so `api_key`
+//! (a personal secret / OAuth refresh token) needs no column-level crypto.
+//! `catalog_name` is a BARE `TEXT` snapshot of `mcp_catalog.name`, never a FK: an
+//! owner→registry key would fail every INSERT under `PRAGMA foreign_keys=ON` in an
+//! isolated file. Local-script connectors run INSIDE the user's container against a
+//! script copied into the bind-mounted home (`script_rel_path`).
+
+use std::collections::HashMap;
+
+use anyhow::Result;
+use serde::Serialize;
+use sqlx::SqlitePool;
+
+#[derive(Debug, Clone, Serialize, sqlx::FromRow)]
+pub struct McpUserServerRow {
+    pub id:              i64,
+    pub name:            String,
+    /// Bare snapshot of the originating `mcp_catalog.name`; NULL for a
+    /// self-registered remote.
+    pub catalog_name:    Option<String>,
+    /// 'remote' | 'local_script'.
+    pub source:          String,
+    pub transport:       String,
+    pub command:         Option<String>,
+    pub args_json:       Option<String>,
+    pub env_json:        Option<String>,
+    pub url:             Option<String>,
+    pub api_key:         Option<String>,
+    /// Container path of the copied script, for a `local_script`.
+    pub script_rel_path: Option<String>,
+    /// 'pending' | 'ready' — the interactive-auth gate ('ready' while api-key).
+    pub auth_state:      String,
+    pub enabled:         bool,
+}
+
+impl McpUserServerRow {
+    pub fn args(&self) -> Vec<String> {
+        self.args_json.as_deref()
+            .and_then(|s| serde_json::from_str(s).ok())
+            .unwrap_or_default()
+    }
+
+    pub fn env(&self) -> HashMap<String, String> {
+        self.env_json.as_deref()
+            .and_then(|s| serde_json::from_str(s).ok())
+            .unwrap_or_default()
+    }
+}
+
+const SELECT: &str =
+    "SELECT id, name, catalog_name, source, transport, command, args_json, env_json, url, \
+            api_key, script_rel_path, auth_state, enabled \
+     FROM mcp_user_servers";
+
+// ── Reads ────────────────────────────────────────────────────────────────────
+
+pub async fn all(pool: &SqlitePool) -> Result<Vec<McpUserServerRow>> {
+    let rows = sqlx::query_as::<_, McpUserServerRow>(sqlx::AssertSqlSafe(format!("{SELECT} ORDER BY name")))
+        .fetch_all(pool)
+        .await?;
+    Ok(rows)
+}
+
+/// The enabled, `auth_state='ready'` connectors — the set the per-user runtime
+/// starts at login. A 'pending' one is activated but not yet authenticated.
+pub async fn all_startable(pool: &SqlitePool) -> Result<Vec<McpUserServerRow>> {
+    let rows = sqlx::query_as::<_, McpUserServerRow>(sqlx::AssertSqlSafe(format!(
+        "{SELECT} WHERE enabled = 1 AND auth_state = 'ready' ORDER BY name"
+    )))
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}
+
+pub async fn get(pool: &SqlitePool, id: i64) -> Result<Option<McpUserServerRow>> {
+    let row = sqlx::query_as::<_, McpUserServerRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE id = ?")))
+        .bind(id)
+        .fetch_optional(pool)
+        .await?;
+    Ok(row)
+}
+
+pub async fn get_by_name(pool: &SqlitePool, name: &str) -> Result<Option<McpUserServerRow>> {
+    let row = sqlx::query_as::<_, McpUserServerRow>(sqlx::AssertSqlSafe(format!("{SELECT} WHERE name = ?")))
+        .bind(name)
+        .fetch_optional(pool)
+        .await?;
+    Ok(row)
+}
+
+// ── Writes ───────────────────────────────────────────────────────────────────
+
+pub struct InsertUserServer<'a> {
+    pub name:            &'a str,
+    pub catalog_name:    Option<&'a str>,
+    pub source:          &'a str,
+    pub transport:       &'a str,
+    pub command:         Option<&'a str>,
+    pub args_json:       Option<String>,
+    pub env_json:        Option<String>,
+    pub url:             Option<&'a str>,
+    pub api_key:         Option<&'a str>,
+    pub script_rel_path: Option<&'a str>,
+    pub auth_state:      &'a str,
+}
+
+pub async fn insert(pool: &SqlitePool, s: InsertUserServer<'_>) -> Result<i64> {
+    let id = sqlx::query(
+        "INSERT INTO mcp_user_servers
+            (name, catalog_name, source, transport, command, args_json, env_json, url, api_key, script_rel_path, auth_state, enabled)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, 1)",
+    )
+    .bind(s.name)
+    .bind(s.catalog_name)
+    .bind(s.source)
+    .bind(s.transport)
+    .bind(s.command)
+    .bind(s.args_json)
+    .bind(s.env_json)
+    .bind(s.url)
+    .bind(s.api_key)
+    .bind(s.script_rel_path)
+    .bind(s.auth_state)
+    .execute(pool)
+    .await?
+    .last_insert_rowid();
+    Ok(id)
+}
+
+pub async fn set_enabled(pool: &SqlitePool, id: i64, enabled: bool) -> Result<()> {
+    sqlx::query("UPDATE mcp_user_servers SET enabled = ?1 WHERE id = ?2")
+        .bind(enabled as i64)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+pub async fn set_auth_state(pool: &SqlitePool, id: i64, auth_state: &str) -> Result<()> {
+    sqlx::query("UPDATE mcp_user_servers SET auth_state = ?1 WHERE id = ?2")
+        .bind(auth_state)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+pub async fn delete(pool: &SqlitePool, id: i64) -> Result<()> {
+    sqlx::query("DELETE FROM mcp_user_servers WHERE id = ?")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}

crates/skald-core/src/db/mod.rs

@@ -11,10 +11,14 @@ pub mod job_runs;
 pub mod known_tools;
 pub mod llm_requests;
 pub mod llm_request_payloads;
+pub mod mcp_catalog;
 pub mod mcp_events;
-pub mod mcp_servers;
+pub mod mcp_global_access;
+pub mod mcp_global_servers;
+pub mod mcp_user_servers;
 pub mod memory_docs;
 pub mod plugins;
+pub mod role_capabilities;
 pub mod roles;
 pub mod scheduled_jobs;
 pub mod scratchpad;
@@ -419,6 +423,86 @@ async fn create_registry_tables(pool: &SqlitePool) -> Result<()> {
     .execute(pool)
     .await?;
 
+    // ── MCP catalog + globally-active instances (blueprint §7/§14/§15) ──────────
+    //
+    // Registry tables: instance-wide MCP config, listable without any user key so
+    // the admin can render the "Connectors" catalog. The catalog is the admin's
+    // vetted set of installable connectors; a user later *instantiates* a per-user
+    // one into their own `{userid}.db` (`mcp_user_servers`, owner bucket) or the
+    // admin *enables* a global one here. Per-user credentials never land here — the
+    // catalog holds only the *schema* of what an activation must supply.
+    sqlx::query(
+        "CREATE TABLE IF NOT EXISTS mcp_catalog (
+            id                 INTEGER PRIMARY KEY AUTOINCREMENT,
+            name               TEXT    NOT NULL UNIQUE,
+            scope              TEXT    NOT NULL,                    -- 'per_user' | 'global'
+            source             TEXT    NOT NULL,                    -- 'remote' | 'local_script'
+            transport          TEXT    NOT NULL DEFAULT 'stdio',
+            command            TEXT,
+            args_json          TEXT,
+            env_json           TEXT,
+            url                TEXT,
+            script_path        TEXT,                               -- local_script: source under ./scripts
+            config_schema_json TEXT,                               -- names of env/secret keys the UI must collect
+            auth_kind          TEXT    NOT NULL DEFAULT 'none',    -- 'none'|'api_key'|'oauth'|'qr'|'ssh_key'
+            role_filter        TEXT,                               -- JSON array of role ids; NULL = all
+            friendly_name      TEXT,
+            description        TEXT,
+            created_at         TEXT    NOT NULL DEFAULT (datetime('now'))
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    // Concrete globally-active connectors (shared, stateless — web-search etc.).
+    // They run on the HOST. The global secret (admin's API key) is fine here:
+    // `system.db` is admin-owned (§4/§15b). `catalog_name` is a registry→registry
+    // FK (both in this file) — allowed.
+    sqlx::query(
+        "CREATE TABLE IF NOT EXISTS mcp_global_servers (
+            id            INTEGER PRIMARY KEY AUTOINCREMENT,
+            name          TEXT    NOT NULL UNIQUE,
+            catalog_name  TEXT    REFERENCES mcp_catalog(name),
+            transport     TEXT    NOT NULL DEFAULT 'stdio',
+            command       TEXT,
+            args_json     TEXT,
+            env_json      TEXT,
+            url           TEXT,
+            api_key       TEXT,
+            friendly_name TEXT,
+            description   TEXT,
+            enabled       INTEGER NOT NULL DEFAULT 1,
+            created_at    TEXT    NOT NULL DEFAULT (datetime('now'))
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    // Which users may use each globally-active connector (§15 per-user access).
+    // Mirrors `shared_folder_members`: both FKs are registry→registry, allowed.
+    sqlx::query(
+        "CREATE TABLE IF NOT EXISTS mcp_global_access (
+            server_id INTEGER NOT NULL REFERENCES mcp_global_servers(id) ON DELETE CASCADE,
+            user_id   TEXT    NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            PRIMARY KEY (server_id, user_id)
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    // Capability grants per role (blueprint §14). A single indexed lookup instead
+    // of parsing `roles.attrs`. `admin` implicitly holds every capability (checked
+    // in code), so only non-admin roles need rows here.
+    sqlx::query(
+        "CREATE TABLE IF NOT EXISTS role_capabilities (
+            role_id    TEXT NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
+            capability TEXT NOT NULL,
+            PRIMARY KEY (role_id, capability)
+        )",
+    )
+    .execute(pool)
+    .await?;
+
     Ok(())
 }
 
@@ -626,25 +710,6 @@ pub async fn create_owner_tables(pool: &SqlitePool) -> Result<()> {
     .execute(pool)
     .await?;
 
-    sqlx::query(
-        "CREATE TABLE IF NOT EXISTS mcp_servers (
-            id            INTEGER PRIMARY KEY AUTOINCREMENT,
-            name          TEXT    NOT NULL UNIQUE,
-            transport     TEXT    NOT NULL DEFAULT 'stdio',
-            command       TEXT,
-            args_json     TEXT,
-            env_json      TEXT,
-            url           TEXT,
-            api_key       TEXT,
-            description   TEXT,
-            friendly_name TEXT,
-            enabled       INTEGER NOT NULL DEFAULT 1,
-            created_at    TEXT    NOT NULL DEFAULT (datetime('now'))
-        )",
-    )
-    .execute(pool)
-    .await?;
-
     sqlx::query(
         "CREATE TABLE IF NOT EXISTS mcp_events (
             id           INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -667,6 +732,35 @@ pub async fn create_owner_tables(pool: &SqlitePool) -> Result<()> {
     .execute(pool)
     .await?;
 
+    // A user's activated per-user connectors (blueprint §7/§14). Owner table:
+    // encrypted at rest in `{userid}.db`, so `api_key` (a personal secret / OAuth
+    // refresh token) needs no column-level crypto. `catalog_name` is a BARE `TEXT`
+    // snapshot of `mcp_catalog.name`, never a FK — an owner→registry key would pass
+    // CREATE TABLE and fail every INSERT under `PRAGMA foreign_keys=ON` in an
+    // isolated file (guarded by `owner_tables_stand_alone_with_foreign_keys_on`).
+    // Local-script connectors run INSIDE the user's container against a script
+    // copied into the bind-mounted home (`script_rel_path`).
+    sqlx::query(
+        "CREATE TABLE IF NOT EXISTS mcp_user_servers (
+            id              INTEGER PRIMARY KEY AUTOINCREMENT,
+            name            TEXT    NOT NULL UNIQUE,
+            catalog_name    TEXT,                              -- bare ref to mcp_catalog.name; NULL = self-registered remote
+            source          TEXT    NOT NULL,                  -- 'remote' | 'local_script'
+            transport       TEXT    NOT NULL DEFAULT 'stdio',
+            command         TEXT,
+            args_json       TEXT,
+            env_json        TEXT,
+            url             TEXT,
+            api_key         TEXT,                              -- per-user secret / OAuth refresh token
+            script_rel_path TEXT,                              -- container path for a local_script
+            auth_state      TEXT    NOT NULL DEFAULT 'ready',  -- 'pending' | 'ready'
+            enabled         INTEGER NOT NULL DEFAULT 1,
+            created_at      TEXT    NOT NULL DEFAULT (datetime('now'))
+        )",
+    )
+    .execute(pool)
+    .await?;
+
     sqlx::query(
         "CREATE TABLE IF NOT EXISTS sources (
             id                TEXT    PRIMARY KEY,
@@ -841,7 +935,9 @@ mod tests {
         one("INSERT INTO scheduled_jobs (id, title, cron, prompt, session_id) VALUES (1, 't', '* * * * *', 'p', 1)")
             .await.unwrap();
         one("INSERT INTO job_runs (job_id, started_at, status) VALUES (1, 'now', 'completed')").await.unwrap();
-        one("INSERT INTO mcp_servers (name) VALUES ('srv')").await.unwrap();
+        // Owner table with a BARE `catalog_name` ref — proves it stands alone with
+        // FKs on (an owner→registry FK here would die on this INSERT).
+        one("INSERT INTO mcp_user_servers (name, catalog_name, source) VALUES ('u', 'whatsapp', 'local_script')").await.unwrap();
         one("INSERT INTO mcp_events (source, method, payload) VALUES ('s', 'm', '{}')").await.unwrap();
         one("INSERT INTO sources (id, active_session_id) VALUES ('web', 1)").await.unwrap();
         one("INSERT INTO secrets (key, value) VALUES ('k', 'v')").await.unwrap();

crates/skald-core/src/db/role_capabilities.rs

@@ -0,0 +1,88 @@
+//! Capability grants per role (blueprint §14).
+//!
+//! Registry table in `system.db`. Authorization is a **capability on the role**,
+//! not `if role == admin` (§0.1). The MCP registration axis (§14):
+//!
+//! - [`REGISTER_REMOTE`] / [`REGISTER_LOCAL_FROM_CATALOG`] — self-service, any user
+//!   (egress-only / already-vetted code).
+//! - [`REGISTER_LOCAL_SCRIPT`] / [`MANAGE_CATALOG`] — admin-only (RCE / catalog
+//!   curation).
+//!
+//! The built-in `admin` role implicitly holds every capability — [`has`] short-
+//! circuits on it — so only non-admin roles ever need rows here.
+
+use anyhow::Result;
+use sqlx::SqlitePool;
+
+use super::roles::ADMIN_ROLE_ID;
+
+/// Register a remote MCP into one's own scope (egress-only, self-service).
+pub const REGISTER_REMOTE: &str = "mcp.register_remote";
+/// Instantiate an admin-vetted local-script connector from the catalog.
+pub const REGISTER_LOCAL_FROM_CATALOG: &str = "mcp.register_local_from_catalog";
+/// Add a brand-new local script to the catalog (RCE surface — admin only).
+pub const REGISTER_LOCAL_SCRIPT: &str = "mcp.register_local_script";
+/// Curate the connector catalog (admin only).
+pub const MANAGE_CATALOG: &str = "mcp.manage_catalog";
+
+/// The default capabilities of an ordinary (non-admin) user role.
+pub const DEFAULT_USER_CAPABILITIES: &[&str] = &[REGISTER_REMOTE, REGISTER_LOCAL_FROM_CATALOG];
+
+// ── Reads ────────────────────────────────────────────────────────────────────
+
+/// Whether a role holds a capability. `admin` holds everything by construction.
+pub async fn has(pool: &SqlitePool, role_id: &str, capability: &str) -> Result<bool> {
+    if role_id == ADMIN_ROLE_ID {
+        return Ok(true);
+    }
+    let row = sqlx::query_as::<_, (i64,)>(
+        "SELECT 1 FROM role_capabilities WHERE role_id = ? AND capability = ?",
+    )
+    .bind(role_id)
+    .bind(capability)
+    .fetch_optional(pool)
+    .await?;
+    Ok(row.is_some())
+}
+
+pub async fn list_for_role(pool: &SqlitePool, role_id: &str) -> Result<Vec<String>> {
+    let rows = sqlx::query_as::<_, (String,)>(
+        "SELECT capability FROM role_capabilities WHERE role_id = ? ORDER BY capability",
+    )
+    .bind(role_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows.into_iter().map(|(c,)| c).collect())
+}
+
+// ── Writes ───────────────────────────────────────────────────────────────────
+
+pub async fn grant(pool: &SqlitePool, role_id: &str, capability: &str) -> Result<()> {
+    sqlx::query("INSERT OR IGNORE INTO role_capabilities (role_id, capability) VALUES (?, ?)")
+        .bind(role_id)
+        .bind(capability)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+pub async fn revoke(pool: &SqlitePool, role_id: &str, capability: &str) -> Result<()> {
+    sqlx::query("DELETE FROM role_capabilities WHERE role_id = ? AND capability = ?")
+        .bind(role_id)
+        .bind(capability)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Seeds the standard non-admin capability set for a newly created role.
+/// Idempotent. No-op for `admin` (which holds everything implicitly).
+pub async fn seed_defaults(pool: &SqlitePool, role_id: &str) -> Result<()> {
+    if role_id == ADMIN_ROLE_ID {
+        return Ok(());
+    }
+    for cap in DEFAULT_USER_CAPABILITIES {
+        grant(pool, role_id, cap).await?;
+    }
+    Ok(())
+}

crates/skald-core/src/mcp/mod.rs

@@ -25,6 +25,9 @@ pub use mcp_client::{
 use mcp_client::McpTransport;
 
 mod logs;
+mod provider;
+
+pub use provider::{McpProvider, UserMcpView};
 
 const SERVER_START_TIMEOUT_SECS: u64 = 120;
 
@@ -116,22 +119,6 @@ impl McpManager {
         }
     }
 
-    fn cfg_from_row(row: &crate::db::mcp_servers::McpServerRow) -> McpServerConfig {
-        McpServerConfig {
-            name:      row.name.clone(),
-            transport: match row.transport.as_str() {
-                "http" => McpTransport::Http,
-                "sse"  => McpTransport::Sse,
-                _      => McpTransport::Stdio,
-            },
-            command: row.command.clone(),
-            args:    Some(row.args()).filter(|v| !v.is_empty()),
-            env:     Some(row.env()).filter(|m| !m.is_empty()),
-            url:     row.url.clone(),
-            api_key: row.api_key.clone(),
-        }
-    }
-
     async fn start_one(
         cfg: &McpServerConfig,
         notification_tx: Option<mpsc::UnboundedSender<McpNotification>>,
@@ -154,29 +141,49 @@ impl McpManager {
         }
     }
 
+    /// Connects the GLOBAL runtime at boot: reads the enabled globally-active
+    /// connectors (`mcp_global_servers`, host transport) and connects to them.
+    /// The per-user runtime (blueprint §7/§9) is built separately at login and
+    /// shares [`connect_all`] rather than this table-bound entry point.
     pub async fn initialize(&self) {
-        let rows = match crate::db::mcp_servers::all_enabled(&self.pool).await {
+        let rows = match crate::db::mcp_global_servers::all_enabled(&self.pool).await {
             Ok(r) => r,
             Err(e) => { warn!("McpManager::initialize: failed to read DB: {e}"); return; }
         };
 
         if rows.is_empty() {
-            info!("No enabled MCP servers in DB — MCP disabled.");
+            info!("No enabled global MCP servers in DB — global MCP disabled.");
             crate::boot::section("MCP servers — none enabled");
             return;
         }
 
-        let cfgs: Vec<_> = rows.iter().map(Self::cfg_from_row).collect();
+        let specs = rows.iter().map(global_row_spec).collect();
+        self.connect_all(specs, true).await;
+    }
+
+    /// Connects to a batch of servers in parallel (each bounded by
+    /// `SERVER_START_TIMEOUT_SECS`), recording their tools, errors and prompt
+    /// descriptions. The reusable core shared by the global runtime
+    /// ([`initialize`]) and the per-user runtime (built at login, §7). `boot`
+    /// gates the curated boot-console lines, which only make sense at startup —
+    /// a login-time per-user connect passes `false`.
+    pub async fn connect_all(&self, specs: Vec<McpServerSpec>, boot: bool) {
+        if specs.is_empty() {
+            return;
+        }
         {
             let mut descs = self.descriptions.write().unwrap();
-            for row in &rows {
+            for spec in &specs {
-                descs.insert(row.name.clone(), row.description.clone());
+                descs.insert(spec.config.name.clone(), spec.description.clone());
             }
         }
+        if boot {
             crate::boot::section(format!(
-            "MCP servers — connecting to {} in background", cfgs.len()
+                "MCP servers — connecting to {} in background", specs.len()
             ));
-        let handles: Vec<_> = cfgs.into_iter().map(|cfg| {
+        }
+        let handles: Vec<_> = specs.into_iter().map(|spec| {
+            let cfg    = spec.config;
             let tx     = self.notification_tx.clone();
             let log_tx = self.log_tx.clone();
             let eh = self.elicitation_handler();
@@ -186,30 +193,33 @@ impl McpManager {
                     Duration::from_secs(SERVER_START_TIMEOUT_SECS),
                     Self::start_one(&cfg, Some(tx), Some(log_tx), eh),
                 ).await;
-                (cfg.name, cfg.transport, result)
+                (cfg.name, result)
             })
         }).collect();
 
         for handle in handles {
             match handle.await {
-                Ok((name, _, Ok(Ok(s)))) => {
+                Ok((name, Ok(Ok(s)))) => {
-                    let tool_names: Vec<_> = s.tools().iter().map(|t| t.name.as_str()).collect();
+                    let tool_names: Vec<_> = s.tools().iter().map(|t| t.name.clone()).collect();
-                    info!("MCP server '{}' ready — {} tool(s): {}", name, tool_names.len(), tool_names.join(", "));
                     let n = tool_names.len();
+                    info!("MCP server '{}' ready — {n} tool(s): {}", name, tool_names.join(", "));
+                    if boot {
                         crate::boot::ok(format!("{name} ({n} tool{})", if n == 1 { "" } else { "s" }));
+                    }
                     self.log_lifecycle(&name, format!("connected — {n} tool(s)"));
+                    self.errors.write().unwrap().remove(&name);
                     self.servers.write().unwrap().insert(name, s);
                 }
-                Ok((name, _, Ok(Err(e)))) => {
+                Ok((name, Ok(Err(e)))) => {
                     warn!("MCP server '{}' failed to start: {e}", name);
-                    crate::boot::fail(format!("{name} — {e}"));
+                    if boot { crate::boot::fail(format!("{name} — {e}")); }
                     self.log_lifecycle(&name, format!("failed to start: {e}"));
                     self.errors.write().unwrap().insert(name, e.to_string());
                 }
-                Ok((name, _, Err(_))) => {
+                Ok((name, Err(_))) => {
                     let msg = format!("startup timed out after {SERVER_START_TIMEOUT_SECS}s");
                     warn!("MCP server '{}' {msg}", name);
-                    crate::boot::fail(format!("{name} — {msg}"));
+                    if boot { crate::boot::fail(format!("{name} — {msg}")); }
                     self.log_lifecycle(&name, &msg);
                     self.errors.write().unwrap().insert(name, msg);
                 }
@@ -218,77 +228,38 @@ impl McpManager {
         }
     }
 
-    pub async fn register(&self, p: crate::db::mcp_servers::UpsertParams<'_>) -> Result<Vec<String>> {
+    /// Starts (or restarts) a single server from a spec and records it in the
-        let name = p.name.to_string();
+    /// runtime maps. The DB write is the caller's job (the Connectors activation
-
+    /// API) — this only touches the live connections. Returns the tool names.
-        crate::db::mcp_servers::upsert(&self.pool, p).await?;
+    pub async fn start_server(&self, spec: McpServerSpec) -> Result<Vec<String>> {
-
+        let name = spec.config.name.clone();
-        let rows = crate::db::mcp_servers::all_enabled(&self.pool).await?;
-        let row = rows.into_iter().find(|r| r.name == name)
-            .ok_or_else(|| anyhow::anyhow!("register: server '{}' not found after upsert", name))?;
-        let cfg = Self::cfg_from_row(&row);
-
         let client = tokio::time::timeout(
             Duration::from_secs(SERVER_START_TIMEOUT_SECS),
-            Self::start_one(&cfg, Some(self.notification_tx.clone()), Some(self.log_tx.clone()), self.elicitation_handler()),
+            Self::start_one(&spec.config, Some(self.notification_tx.clone()), Some(self.log_tx.clone()), self.elicitation_handler()),
         ).await
         .map_err(|_| {
             self.log_lifecycle(&name, "timed out during connection");
-            anyhow::anyhow!("MCP server '{}' timed out during connection", name)
+            anyhow::anyhow!("MCP server '{name}' timed out during connection")
         })?
         .map_err(|e| {
             self.log_lifecycle(&name, format!("failed to start: {e}"));
-            anyhow::anyhow!("MCP server '{}' failed to start: {e}", name)
+            anyhow::anyhow!("MCP server '{name}' failed to start: {e}")
         })?;
 
         let tool_names: Vec<String> = client.tools().iter().map(|t| t.name.clone()).collect();
         self.log_lifecycle(&name, format!("connected — {} tool(s)", tool_names.len()));
         self.errors.write().unwrap().remove(&name);
-        self.descriptions.write().unwrap().insert(name.clone(), row.description.clone());
+        self.descriptions.write().unwrap().insert(name.clone(), spec.description);
         self.servers.write().unwrap().insert(name, client);
-
         Ok(tool_names)
     }
 
-    pub async fn unregister(&self, name: &str) -> Result<()> {
+    /// Stops a running server (dropping the client → `kill_on_drop`) and forgets
-        crate::db::mcp_servers::delete(&self.pool, name).await?;
+    /// it. DB removal is the caller's responsibility.
+    pub fn stop_server(&self, name: &str) {
         self.servers.write().unwrap().remove(name);
         self.errors.write().unwrap().remove(name);
         self.descriptions.write().unwrap().remove(name);
-        Ok(())
-    }
-
-    pub async fn set_enabled(&self, name: &str, enabled: bool) -> Result<()> {
-        crate::db::mcp_servers::set_enabled(&self.pool, name, enabled).await
-    }
-
-    pub async fn list(&self) -> Result<Vec<McpServerInfo>> {
-        let rows = crate::db::mcp_servers::all(&self.pool).await?;
-        let servers = self.servers.read().unwrap();
-        let errors  = self.errors.read().unwrap();
-
-        let infos = rows.into_iter().map(|row| {
-            let status = if !row.enabled {
-                McpServerStatus::Disabled
-            } else if let Some(s) = servers.get(&row.name) {
-                McpServerStatus::Running {
-                    tools: s.tools().iter().map(|t| t.name.clone()).collect(),
-                }
-            } else if let Some(e) = errors.get(&row.name) {
-                McpServerStatus::Error { message: e.clone() }
-            } else {
-                McpServerStatus::Error { message: "not connected".to_string() }
-            };
-            McpServerInfo {
-                name: row.name,
-                transport: row.transport,
-                description: row.description,
-                friendly_name: row.friendly_name,
-                status,
-            }
-        }).collect();
-
-        Ok(infos)
     }
 
     pub fn tools(&self) -> Vec<McpTool> {
@@ -405,6 +376,90 @@ impl McpManager {
     }
 }
 
+/// A server to connect: its transport config plus the description shown in the
+/// "Available MCP servers" prompt section. Decouples [`McpManager`] from any DB
+/// table — the global and per-user runtimes each build these from their own rows
+/// (`global_row_spec` / `user_row_spec`).
+pub struct McpServerSpec {
+    pub config:      McpServerConfig,
+    pub description: Option<String>,
+}
+
+fn transport_of(s: &str) -> McpTransport {
+    match s {
+        "http" => McpTransport::Http,
+        "sse"  => McpTransport::Sse,
+        _      => McpTransport::Stdio,
+    }
+}
+
+/// Some remote MCP servers take their key as a **query parameter** rather than the
+/// `Authorization: Bearer` header this client sends by default (Tavily wants
+/// `?tavilyApiKey=…`). Those declare a `{key}` placeholder in their URL, which is
+/// substituted here — at connect time, in memory.
+///
+/// Doing it here rather than at write time keeps the key in its own column (where
+/// it is redacted and, for a per-user connector, encrypted with the rest of
+/// `{userid}.db`) instead of baking a live secret into a stored URL. Once
+/// substituted, the key is cleared so it is not also sent as a bearer header the
+/// server never asked for.
+fn apply_key_placeholder(
+    url:     Option<String>,
+    api_key: Option<String>,
+) -> (Option<String>, Option<String>) {
+    match (url, api_key) {
+        (Some(u), Some(k)) if u.contains("{key}") => (Some(u.replace("{key}", &k)), None),
+        (u, k) => (u, k),
+    }
+}
+
+/// Builds a spec for a globally-active connector — host transport (`launch_in`
+/// = None), so it runs in the Skald process, not in any container (§7).
+pub fn global_row_spec(row: &crate::db::mcp_global_servers::McpGlobalServerRow) -> McpServerSpec {
+    let (url, api_key) = apply_key_placeholder(row.url.clone(), row.api_key.clone());
+    McpServerSpec {
+        config: McpServerConfig {
+            name:      row.name.clone(),
+            transport: transport_of(&row.transport),
+            command:   row.command.clone(),
+            args:      Some(row.args()).filter(|v| !v.is_empty()),
+            env:       Some(row.env()).filter(|m| !m.is_empty()),
+            url,
+            api_key,
+            launch_in: None,
+        },
+        description: row.description.clone(),
+    }
+}
+
+/// Builds a spec for a user's per-user connector — container transport: a
+/// `local_script` (or any stdio server) runs INSIDE the user's container
+/// (`launch_in = Some(container)`), against the script copied into the
+/// bind-mounted home. Remote (HTTP) connectors ignore `launch_in`.
+pub fn user_row_spec(
+    row:       &crate::db::mcp_user_servers::McpUserServerRow,
+    container: &str,
+) -> McpServerSpec {
+    let transport = transport_of(&row.transport);
+    let launch_in = matches!(transport, McpTransport::Stdio).then(|| container.to_string());
+    let (url, api_key) = apply_key_placeholder(row.url.clone(), row.api_key.clone());
+    McpServerSpec {
+        config: McpServerConfig {
+            name:      row.name.clone(),
+            transport,
+            command:   row.command.clone(),
+            args:      Some(row.args()).filter(|v| !v.is_empty()),
+            env:       Some(row.env()).filter(|m| !m.is_empty()),
+            url,
+            api_key,
+            launch_in,
+        },
+        // A per-user connector's description falls back to its catalog name; the
+        // catalog's friendly description can be injected by the caller if richer.
+        description: row.catalog_name.clone(),
+    }
+}
+
 /// Generates a 32-char alphanumeric id for a persisted media filename
 /// (mirrors `ImageGeneratorManager`).
 fn random_id() -> String {

crates/skald-core/src/mcp/provider.rs

@@ -0,0 +1,109 @@
+//! The MCP tool surface a session sees, behind one trait.
+//!
+//! A logged-in user's tools are the union of two runtimes (blueprint §7): the
+//! access-filtered GLOBAL runtime (host, shared) and their own PER-USER runtime
+//! (in their container). [`McpProvider`] is the seam the session code talks to,
+//! so the round-loop (`all_tool_defs`, `render_mcp_list`, `ActivateTools`) never
+//! has to know which runtime owns a server. [`McpManager`] implements it directly
+//! (used as-is for the inert ownerless bundle); [`UserMcpView`] implements it as
+//! the union.
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+use anyhow::Result;
+use async_trait::async_trait;
+use serde_json::Value;
+
+use crate::tools::ToolResult;
+
+use super::{McpManager, McpTool};
+
+#[async_trait]
+pub trait McpProvider: Send + Sync {
+    fn tools(&self) -> Vec<McpTool>;
+    fn tools_for(&self, names: &[String]) -> Vec<McpTool>;
+    fn server_descriptions(&self) -> HashMap<String, Option<String>>;
+    fn server_infos(&self) -> Vec<Value>;
+    async fn call(&self, server: &str, tool: &str, args: Value) -> Result<ToolResult>;
+}
+
+#[async_trait]
+impl McpProvider for McpManager {
+    fn tools(&self) -> Vec<McpTool> { McpManager::tools(self) }
+    fn tools_for(&self, names: &[String]) -> Vec<McpTool> { McpManager::tools_for(self, names) }
+    fn server_descriptions(&self) -> HashMap<String, Option<String>> { McpManager::server_descriptions(self) }
+    fn server_infos(&self) -> Vec<Value> { McpManager::server_infos(self) }
+    async fn call(&self, server: &str, tool: &str, args: Value) -> Result<ToolResult> {
+        McpManager::call(self, server, tool, args).await
+    }
+}
+
+/// One logged-in user's MCP view: the access-filtered global runtime unioned with
+/// their per-user container runtime. A per-user server wins on a name collision
+/// (which activation prevents anyway — see the uniqueness check at activation).
+pub struct UserMcpView {
+    pub global: Arc<McpManager>,
+    pub user:   Arc<McpManager>,
+    /// Names of the global servers this user may use — a snapshot of
+    /// `mcp_global_access`, captured when the user's context is built.
+    pub accessible_global: HashSet<String>,
+}
+
+impl UserMcpView {
+    fn accessible_names(&self) -> Vec<String> {
+        self.accessible_global.iter().cloned().collect()
+    }
+}
+
+#[async_trait]
+impl McpProvider for UserMcpView {
+    fn tools(&self) -> Vec<McpTool> {
+        let mut out = self.global.tools_for(&self.accessible_names());
+        out.extend(self.user.tools());
+        out
+    }
+
+    fn tools_for(&self, names: &[String]) -> Vec<McpTool> {
+        // A granted name belongs to exactly one runtime (unique per user); route
+        // the accessible-global ones to the global runtime and the rest to the
+        // per-user one, which filters to its own server map.
+        let global_names: Vec<String> = names.iter()
+            .filter(|n| self.accessible_global.contains(*n))
+            .cloned()
+            .collect();
+        let mut out = self.global.tools_for(&global_names);
+        out.extend(self.user.tools_for(names));
+        out
+    }
+
+    fn server_descriptions(&self) -> HashMap<String, Option<String>> {
+        let mut m: HashMap<String, Option<String>> = self.global.server_descriptions()
+            .into_iter()
+            .filter(|(name, _)| self.accessible_global.contains(name))
+            .collect();
+        m.extend(self.user.server_descriptions());
+        m
+    }
+
+    fn server_infos(&self) -> Vec<Value> {
+        let mut v: Vec<Value> = self.global.server_infos()
+            .into_iter()
+            .filter(|info| info["name"].as_str()
+                .map(|n| self.accessible_global.contains(n))
+                .unwrap_or(false))
+            .collect();
+        v.extend(self.user.server_infos());
+        v
+    }
+
+    async fn call(&self, server: &str, tool: &str, args: Value) -> Result<ToolResult> {
+        if self.accessible_global.contains(server) {
+            self.global.call(server, tool, args).await
+        } else {
+            // A per-user server, or an unknown/forbidden one — the per-user
+            // runtime returns a "not found" error for the latter.
+            self.user.call(server, tool, args).await
+        }
+    }
+}

crates/skald-core/src/session/handler/interface_tools.rs

@@ -3,7 +3,7 @@ use std::sync::{Arc, RwLock};
 
 use serde_json::Value;
 
-use crate::mcp::McpManager;
+use crate::mcp::McpProvider;
 use crate::tools::Tool;
 use crate::tools::tool_names as tn;
 
@@ -51,8 +51,9 @@ pub struct AgentRunConfig {
     pub memory_tools: Vec<Arc<dyn Tool>>,
     /// Image generation tools — present only when at least one provider is registered.
     pub image_tools: Vec<Arc<dyn Tool>>,
-    /// MCP manager — used by `all_tool_defs()` to resolve which tools to include.
+    /// MCP provider (global ∪ per-user) — used by `all_tool_defs()` to resolve
-    pub mcp: Arc<McpManager>,
+    /// which tools to include.
+    pub mcp: Arc<dyn McpProvider>,
     /// Set of MCP server names currently granted (activated) for this agent run.
     ///
     /// - Root agents: pre-populated from `session_mcp_grants` DB at config-build time;

crates/skald-core/src/session/handler/message_builder.rs

@@ -7,7 +7,7 @@ use sqlx::SqlitePool;
 use crate::compactor::{ContextCompactor, SUMMARY_PREFIX};
 use crate::config::DatetimeConfig;
 use crate::db::{chat_history, chat_llm_tools, chat_summaries};
-use crate::mcp::McpManager;
+use crate::mcp::McpProvider;
 use crate::tools::tool_names as tn;
 
 /// Registry of installed skills, relative to Skald's process cwd. Injected into agents
@@ -38,7 +38,7 @@ pub struct MessageBuilder {
     /// owner `pool` above backs `user-memory/`.
     pub shared_pool:           Arc<SqlitePool>,
     pub session_id:            i64,
-    pub mcp:                   Arc<McpManager>,
+    pub mcp:                   Arc<dyn McpProvider>,
     pub datetime_config:       DatetimeConfig,
     pub max_history_messages:  usize,
     pub max_tool_result_chars: Option<usize>,

crates/skald-core/src/session/handler/mod.rs

@@ -22,7 +22,7 @@ use crate::events::ServerEvent;
 use core_api::message_meta::MessageMetadata;
 use core_api::user_fs::UserFs;
 use crate::llm::LlmManager;
-use crate::mcp::McpManager;
+use crate::mcp::McpProvider;
 use crate::image_generate::ImageGeneratorManager;
 use crate::memory::MemoryManager;
 use crate::tool_discovery::ToolDiscovery;
@@ -292,7 +292,7 @@ pub struct ChatSessionHandler {
     /// True for short-lived automated sessions (cron, tic).
     pub(super) is_ephemeral:     bool,
     pub(super) tools:            Arc<ToolRegistry>,
-    pub(super) mcp:              Arc<McpManager>,
+    pub(super) mcp:              Arc<dyn McpProvider>,
     /// Records tools offered to the LLM each round so the Security-groups UI can
     /// list/gate dynamically-injected tools (interface/plugin/provider tools).
     pub(super) tool_discovery:   Arc<ToolDiscovery>,
@@ -354,7 +354,7 @@ impl ChatSessionHandler {
         is_interactive:        bool,
         is_ephemeral:          bool,
         tools:                 Arc<ToolRegistry>,
-        mcp:                   Arc<McpManager>,
+        mcp:                   Arc<dyn McpProvider>,
         approval:              Arc<ApprovalManager>,
         clarification:         Arc<ClarificationManager>,
         event_bus:             Arc<ChatEventBus>,

crates/skald-core/src/session/manager.rs

@@ -13,7 +13,7 @@ use crate::compactor::ContextCompactor;
 use crate::config::DatetimeConfig;
 use crate::db::{chat_sessions, chat_sessions_stack};
 use crate::llm::LlmManager;
-use crate::mcp::McpManager;
+use crate::mcp::McpProvider;
 use crate::image_generate::ImageGeneratorManager;
 use crate::memory::MemoryManager;
 use crate::run_context::{RunContext, RunContextManager};
@@ -38,7 +38,9 @@ pub struct ChatSessionManager {
     max_tool_result_chars: Option<usize>,
     datetime_config:       DatetimeConfig,
     tools:                 Arc<ToolRegistry>,
-    mcp:                   Arc<McpManager>,
+    /// The MCP tools visible to this owner: the access-filtered global runtime
+    /// unioned with their per-user runtime (blueprint §7), behind one trait.
+    mcp:                   Arc<dyn McpProvider>,
     approval:              Arc<ApprovalManager>,
     clarification:         Arc<ClarificationManager>,
     event_bus:             Arc<ChatEventBus>,
@@ -66,7 +68,7 @@ impl ChatSessionManager {
         max_tool_result_chars: Option<usize>,
         datetime_config:       DatetimeConfig,
         tools:                 Arc<ToolRegistry>,
-        mcp:                   Arc<McpManager>,
+        mcp:                   Arc<dyn McpProvider>,
         approval:              Arc<ApprovalManager>,
         clarification:         Arc<ClarificationManager>,
         event_bus:             Arc<ChatEventBus>,

crates/skald-core/src/skald/bundles.rs

@@ -211,13 +211,13 @@ impl Tools {
         tool_registry.register(crate::tools::exec::ExecuteCmd);
         tool_registry.register(crate::tools::read_notification::ReadNotification);
         tool_registry.register(crate::tools::restart::Restart);
-        // Unified listing / toggling across mcp, plugins, cron (+ agents for list).
+        // Unified listing / toggling across plugins, cron (+ agents for list). MCP
+        // is no longer agent-managed (blueprint §14): connectors are curated by the
+        // admin and activated by the user via the Connectors UI/API, not tools.
         tool_registry.register(crate::tools::list_items::ListItems::new(
-            Arc::clone(&integrations.mcp), Arc::clone(&integrations.plugin_manager), Arc::clone(&tasks.cron)));
+            Arc::clone(&integrations.plugin_manager), Arc::clone(&tasks.cron)));
         tool_registry.register(crate::tools::toggle_item::ToggleItem::new(
-            Arc::clone(&integrations.mcp), Arc::clone(&integrations.plugin_manager), Arc::clone(&tasks.cron)));
+            Arc::clone(&integrations.plugin_manager), Arc::clone(&tasks.cron)));
-        tool_registry.register(crate::tools::register_mcp::RegisterMcp::new(Arc::clone(&integrations.mcp)));
-        tool_registry.register(crate::tools::register_mcp::DeleteMcp::new(Arc::clone(&integrations.mcp)));
         tool_registry.register(crate::tools::cron_jobs::DeleteCronJob);
         tool_registry.register(crate::tools::set_secret::SetSecret(Arc::clone(&models.secrets)));
         tool_registry.register(crate::tools::list_secrets::ListSecrets(Arc::clone(&models.secrets)));
@@ -358,7 +358,9 @@ impl Conversation {
             config.llm.max_tool_result_chars,
             DatetimeConfig { timezone: config.timezone.clone(), ..config.llm.datetime },
             Arc::clone(&tools.tools),
-            Arc::clone(&integrations.mcp),
+            // Inert ownerless bundle (§19): the global runtime as a provider,
+            // unfiltered — never actually exercised (no loops, no consumers).
+            Arc::clone(&integrations.mcp) as Arc<dyn crate::mcp::McpProvider>,
             Arc::clone(&interaction.approval),
             Arc::clone(&interaction.clarification),
             Arc::clone(&rt.event_bus),

crates/skald-core/src/skald/mod.rs

@@ -88,7 +88,7 @@ impl Skald {
         // Per-user context factory: captures the global capability managers, so a
         // per-user chat/hub/cron/interaction stack can be stamped out on demand.
         let user_contexts = UserContextRegistry::new(UserContextFactory::new(
-            &rt, &models, &media, &tools, &integrations, &conversation, config,
+            &rt, &models, &media, &tools, &integrations, &conversation, &container, config,
         ));
 
         // Build the runtime image and reconcile a container for every active user.

crates/skald-core/src/skald/user_context.rs

@@ -43,12 +43,13 @@ use crate::chat_hub::ChatHub;
 use crate::clarification::ClarificationManager;
 use crate::compactor::ContextCompactor;
 use crate::config::{CompactionConfig, CoreConfig, DatetimeConfig};
+use crate::container::ContainerManager;
 use crate::cron::TaskManager;
 use crate::elicitation::ElicitationManager;
 use crate::image_generate::ImageGeneratorManager;
 use crate::inbox::Inbox;
 use crate::llm::LlmManager;
-use crate::mcp::McpManager;
+use crate::mcp::{McpManager, McpProvider, UserMcpView};
 use crate::memory::MemoryManager;
 use crate::projects::tickets::ProjectTicketManager;
 use crate::run_context::RunContextManager;
@@ -76,6 +77,11 @@ pub struct UserContext {
     pub clarification: Arc<ClarificationManager>,
     pub elicitation:   Arc<ElicitationManager>,
     pub inbox:         Inbox,
+    /// This user's own MCP runtime (blueprint §7/§9): connectors that run inside
+    /// their container, started at first login and living until restart. Held
+    /// here so its lifetime equals the pool's; its `docker exec -i` children die
+    /// via `kill_on_drop` when the context is dropped at shutdown.
+    pub user_mcp:      Arc<McpManager>,
     /// Per-user server→client push channel. WS handlers subscribe here (via the
     /// hub) so a user's `ServerEvent`s never reach another user's socket.
     pub global_tx:     broadcast::Sender<GlobalEvent>,
@@ -87,7 +93,12 @@ pub(super) struct UserContextFactory {
     registry_pool:           Arc<SqlitePool>,
     llm_manager:             Arc<LlmManager>,
     tools:                   Arc<ToolRegistry>,
+    /// The GLOBAL MCP runtime (host, shared). Unioned per-user with the per-user
+    /// runtime built at login (`UserMcpView`).
     mcp:                     Arc<McpManager>,
+    /// Container lifecycle — used to ensure a user's container is up before their
+    /// per-user (container-hosted) MCP connectors start.
+    container:               ContainerManager,
     memory_manager:          Arc<MemoryManager>,
     image_generator_manager: Arc<ImageGeneratorManager>,
     run_context_manager:     Arc<RunContextManager>,
@@ -111,6 +122,7 @@ impl UserContextFactory {
         tools:        &Tools,
         integrations: &Integrations,
         conversation: &Conversation,
+        container:    &ContainerManager,
         config:       &CoreConfig,
     ) -> Self {
         let cron_tz = config.timezone.as_deref().and_then(|s| s.parse::<Tz>().ok());
@@ -119,6 +131,7 @@ impl UserContextFactory {
             llm_manager:             Arc::clone(&models.llm_manager),
             tools:                   Arc::clone(&tools.tools),
             mcp:                     Arc::clone(&integrations.mcp),
+            container:               container.clone(),
             memory_manager:          Arc::clone(&models.memory_manager),
             image_generator_manager: Arc::clone(&media.image_generator_manager),
             run_context_manager:     Arc::clone(&conversation.run_context_manager),
@@ -165,6 +178,58 @@ impl UserContextFactory {
             ))
         });
 
+        // Per-user MCP runtime (blueprint §7/§9): the connectors this user has
+        // activated, run INSIDE their container. Started here on first login and
+        // living until restart — its `docker exec -i` children die via
+        // `kill_on_drop` when this context (holding `user_mcp`) is dropped at
+        // shutdown. Ensure the container is up first (idempotent: boot
+        // reconciliation and user-create already do this; the belt-and-braces call
+        // recovers a container stopped since). Non-fatal — a container hiccup
+        // degrades MCP/exec but must not block login.
+        if let Err(e) = self.container.ensure(user_id).await {
+            tracing::warn!(user = %user_id, error = %e, "failed to ensure container before per-user MCP start");
+        }
+        let user_mcp = Arc::new(McpManager::new(
+            Arc::clone(&pool),
+            self.shutdown_token.clone(),
+            "data",
+        ));
+        // NOTE: per-user MCP elicitation (interactive connector login, §15) is
+        // deferred — api-key connectors don't need it. Wire the user's
+        // ElicitationBridge here when interactive auth lands.
+        {
+            let um        = Arc::clone(&user_mcp);
+            let upool     = Arc::clone(&pool);
+            let container = crate::container::container_name(user_id);
+            let mname: &'static str = Box::leak(format!("mcp:{user_id}").into_boxed_str());
+            self.supervisor.adopt_one(mname, tokio::spawn(async move {
+                match crate::db::mcp_user_servers::all_startable(&upool).await {
+                    Ok(rows) => {
+                        let specs = rows.iter()
+                            .map(|r| crate::mcp::user_row_spec(r, &container))
+                            .collect();
+                        um.connect_all(specs, false).await;
+                    }
+                    Err(e) => tracing::warn!(error = %e, "per-user MCP init: failed to read mcp_user_servers"),
+                }
+            }));
+        }
+
+        // The MCP view this user's sessions see: the access-filtered global runtime
+        // unioned with their per-user runtime (§7). `accessible_global` is a
+        // snapshot of `mcp_global_access`, captured at build time like fs membership.
+        let accessible_global: std::collections::HashSet<String> =
+            crate::db::mcp_global_access::server_names_for_user(&self.registry_pool, user_id)
+                .await
+                .unwrap_or_default()
+                .into_iter()
+                .collect();
+        let mcp_view: Arc<dyn McpProvider> = Arc::new(UserMcpView {
+            global: Arc::clone(&self.mcp),
+            user:   Arc::clone(&user_mcp),
+            accessible_global,
+        });
+
         let manager = Arc::new(ChatSessionManager::new(
             Arc::clone(&pool),
             Arc::clone(&self.registry_pool), // shared pool = system.db, for shared-memory injection
@@ -177,7 +242,7 @@ impl UserContextFactory {
             self.max_tool_result_chars,
             self.datetime_config.clone(),
             Arc::clone(&self.tools),
-            Arc::clone(&self.mcp),
+            mcp_view,
             Arc::clone(&approval),
             Arc::clone(&clarification),
             Arc::clone(&event_bus),
@@ -241,6 +306,7 @@ impl UserContextFactory {
             clarification,
             elicitation,
             inbox,
+            user_mcp,
             global_tx,
         }))
     }

crates/skald-core/src/tools/activate_tools.rs

@@ -5,7 +5,7 @@ use anyhow::Result;
 use serde_json::{Value, json};
 use sqlx::SqlitePool;
 
-use crate::mcp::McpManager;
+use crate::mcp::McpProvider;
 use crate::tools::tool_names::CONFIG_GROUP;
 use crate::tools::{Tool, ToolDescriptionLength, truncate_label, MAX_LABEL_SHORT};
 
@@ -37,7 +37,7 @@ pub struct ActivateTools {
     /// `None` for root agents (session-scoped grants).
     /// `Some(stack_id)` for sub-agents (stack-scoped grants, deleted on frame exit).
     pub stack_id:           Option<i64>,
-    pub mcp:                Arc<McpManager>,
+    pub mcp:                Arc<dyn McpProvider>,
     /// Shared in-memory grant set. Updated in-place on every call so subsequent
     /// rounds within the same turn see the new tools via `all_tool_defs()`.
     pub active_mcp_grants:  Arc<RwLock<HashSet<String>>>,

crates/skald-core/src/tools/list_items.rs

@@ -5,7 +5,6 @@ use serde_json::{Value, json};
 
 use crate::agents;
 use crate::cron::TaskManager;
-use crate::mcp::McpManager;
 use crate::plugin::PluginManager;
 use crate::tools::{Tool, ToolDescriptionLength};
 
@@ -19,14 +18,13 @@ use crate::tools::{Tool, ToolDescriptionLength};
 /// the ability to enumerate secret key names) and carries a `pattern` filter
 /// that would only apply to that one type.
 pub struct ListItems {
-    mcp:     Arc<McpManager>,
     plugins: Arc<PluginManager>,
     cron:    Arc<TaskManager>,
 }
 
 impl ListItems {
-    pub fn new(mcp: Arc<McpManager>, plugins: Arc<PluginManager>, cron: Arc<TaskManager>) -> Self {
+    pub fn new(plugins: Arc<PluginManager>, cron: Arc<TaskManager>) -> Self {
-        Self { mcp, plugins, cron }
+        Self { plugins, cron }
     }
 }
 
@@ -36,7 +34,6 @@ impl Tool for ListItems {
 
     fn description(&self) -> &str {
         "List configured items of a given type. Pass `type`:\n\
-         • `mcp` — MCP servers with status (running, error, disabled), description, friendly_name, and exposed tools.\n\
          • `plugins` — plugins with id, name, description, enabled flag (persisted), and running flag (live).\n\
          • `cron` — scheduled tasks/cron jobs with id, title, cron expression, agent_id, enabled, kind, last/next run.\n\
          • `agents` — sub-agents available to delegate to (id, name, description, optional `instructions` on how to call the agent well, optional client). Do NOT invoke the `main` agent.\n\
@@ -50,7 +47,7 @@ impl Tool for ListItems {
             "properties": {
                 "type": {
                     "type": "string",
-                    "enum": ["mcp", "plugins", "cron", "agents"],
+                    "enum": ["plugins", "cron", "agents"],
                     "description": "Which kind of item to list."
                 }
             }
@@ -67,12 +64,6 @@ impl Tool for ListItems {
             .ok_or_else(|| anyhow::anyhow!("list_items: missing required argument `type`"))?;
 
         match kind {
-            "mcp" => {
-                let infos = tokio::task::block_in_place(|| {
-                    tokio::runtime::Handle::current().block_on(self.mcp.list())
-                })?;
-                Ok(serde_json::to_string_pretty(&infos)?)
-            }
             "plugins" => {
                 let plugins = tokio::task::block_in_place(|| {
                     tokio::runtime::Handle::current().block_on(self.plugins.list())
@@ -124,7 +115,7 @@ impl Tool for ListItems {
                     .collect();
                 Ok(serde_json::to_string_pretty(&arr)?)
             }
-            other => anyhow::bail!("list_items: unknown type `{other}` (expected one of: mcp, plugins, cron, agents)"),
+            other => anyhow::bail!("list_items: unknown type `{other}` (expected one of: plugins, cron, agents)"),
         }
     }
 }

crates/skald-core/src/tools/mod.rs

@@ -43,7 +43,6 @@ pub mod list_secrets;
 pub mod notify;
 pub mod set_secret;
 pub mod read_notification;
-pub mod register_mcp;
 pub mod restart;
 pub mod show_file;
 pub mod toggle_item;

crates/skald-core/src/tools/register_mcp.rs

@@ -1,175 +0,0 @@
-use std::sync::Arc;
-
-use anyhow::Result;
-use serde_json::{Value, json};
-
-use crate::db::mcp_servers::UpsertParams;
-use crate::mcp::McpManager;
-use crate::tools::{Tool, ToolDescriptionLength};
-
-pub struct RegisterMcp {
-    mcp: Arc<McpManager>,
-}
-
-impl RegisterMcp {
-    pub fn new(mcp: Arc<McpManager>) -> Self { Self { mcp } }
-}
-
-impl Tool for RegisterMcp {
-    fn name(&self) -> &str { "register_mcp" }
-    fn category(&self) -> crate::tools::ToolCategory { crate::tools::ToolCategory::Config }
-
-    fn description(&self) -> &str {
-        "Register (or update) an MCP server and connect to it immediately. \
-         For stdio servers supply `command` and optionally `args` and `env`. \
-         For HTTP/SSE servers supply `url` and optionally `api_key`. \
-         Optionally provide `description` (what the server does) and `friendly_name` (display name for UI). \
-         Returns the list of tools exposed by the server once connected."
-    }
-
-    fn parameters_schema(&self) -> Value {
-        json!({
-            "type": "object",
-            "properties": {
-                "name": {
-                    "type": "string",
-                    "description": "Unique name for this MCP server (used to reference it in tool calls)."
-                },
-                "transport": {
-                    "type": "string",
-                    "enum": ["stdio", "http", "sse"],
-                    "description": "Connection transport. Use `stdio` for local processes, `http` for remote servers."
-                },
-                "command": {
-                    "type": "string",
-                    "description": "stdio only: executable to spawn (e.g. `npx`, `uvx`, path to binary)."
-                },
-                "args": {
-                    "type": "array",
-                    "items": { "type": "string" },
-                    "description": "stdio only: command-line arguments passed to the executable."
-                },
-                "env": {
-                    "type": "object",
-                    "additionalProperties": { "type": "string" },
-                    "description": "stdio only: extra environment variables. Values support `${VAR}` interpolation."
-                },
-                "url": {
-                    "type": "string",
-                    "description": "http/sse only: base URL of the remote MCP server."
-                },
-                "api_key": {
-                    "type": "string",
-                    "description": "http/sse only: API key sent as `Authorization: Bearer <key>`."
-                },
-                "description": {
-                    "type": "string",
-                    "description": "A short description of what this MCP server provides (shown in list_items type=mcp)."
-                },
-                "friendly_name": {
-                    "type": "string",
-                    "description": "A human-readable display name for this MCP server (e.g. 'Google Calendar')."
-                }
-            },
-            "required": ["name", "transport"]
-        })
-    }
-
-    fn describe(&self, args: &Value, _length: ToolDescriptionLength) -> String {
-        let name = args["name"].as_str().unwrap_or("?");
-        format!("register MCP `{name}`")
-    }
-
-    fn execute(&self, args: Value) -> Result<String> {
-        let name = args["name"].as_str()
-            .ok_or_else(|| anyhow::anyhow!("register_mcp: missing required argument `name`"))?;
-        let transport = args["transport"].as_str()
-            .ok_or_else(|| anyhow::anyhow!("register_mcp: missing required argument `transport`"))?;
-
-        let args_json = args["args"].as_array()
-            .map(|a| serde_json::to_string(a))
-            .transpose()?;
-        let env_json = args["env"].as_object()
-            .map(|o| serde_json::to_string(o))
-            .transpose()?;
-
-        let p = UpsertParams {
-            name,
-            transport,
-            command:       args["command"].as_str(),
-            args_json,
-            env_json,
-            url:           args["url"].as_str(),
-            api_key:       args["api_key"].as_str(),
-            description:   args["description"].as_str(),
-            friendly_name: args["friendly_name"].as_str(),
-        };
-
-        let tool_names = tokio::task::block_in_place(|| {
-            tokio::runtime::Handle::current().block_on(self.mcp.register(p))
-        })?;
-
-        Ok(format!(
-            "MCP server '{}' registered and connected. Tools: {}",
-            name,
-            if tool_names.is_empty() { "(none)".to_string() } else { tool_names.join(", ") },
-        ))
-    }
-}
-
-// ── delete_mcp ────────────────────────────────────────────────────────────────
-//
-// Destructive counterpart to `register_mcp`. Kept separate from `toggle_item`
-// (kind=mcp) for the same reason `delete_cron_job` is: toggling is reversible,
-// deletion is not, so the distinct tool can carry its own approval rule and the
-// LLM can't conflate "disable" with "remove". Both live here because both manage
-// the MCP-server lifecycle and hold only `Arc<McpManager>`.
-
-pub struct DeleteMcp {
-    mcp: Arc<McpManager>,
-}
-
-impl DeleteMcp {
-    pub fn new(mcp: Arc<McpManager>) -> Self { Self { mcp } }
-}
-
-impl Tool for DeleteMcp {
-    fn name(&self) -> &str { "delete_mcp" }
-    fn category(&self) -> crate::tools::ToolCategory { crate::tools::ToolCategory::Config }
-
-    fn description(&self) -> &str {
-        "Permanently delete (unregister) an MCP server by name: removes it from the \
-         database and disconnects it. This is irreversible — to temporarily turn a \
-         server off without losing its configuration, use \
-         `toggle_item(kind=\"mcp\", enabled=false)` instead."
-    }
-
-    fn parameters_schema(&self) -> Value {
-        json!({
-            "type": "object",
-            "required": ["name"],
-            "properties": {
-                "name": {
-                    "type": "string",
-                    "description": "Name of the MCP server to delete (from list_items type=mcp)."
-                }
-            }
-        })
-    }
-
-    fn describe(&self, args: &Value, _length: ToolDescriptionLength) -> String {
-        let name = args["name"].as_str().unwrap_or("?");
-        format!("delete MCP `{name}`")
-    }
-
-    fn execute(&self, args: Value) -> Result<String> {
-        let name = args["name"].as_str()
-            .ok_or_else(|| anyhow::anyhow!("delete_mcp: missing required argument `name`"))?;
-
-        tokio::task::block_in_place(|| {
-            tokio::runtime::Handle::current().block_on(self.mcp.unregister(name))
-        })?;
-
-        Ok(format!("MCP server '{name}' deleted and disconnected."))
-    }
-}

crates/skald-core/src/tools/toggle_item.rs

@@ -4,7 +4,6 @@ use anyhow::Result;
 use serde_json::{Value, json};
 
 use crate::cron::TaskManager;
-use crate::mcp::McpManager;
 use crate::plugin::PluginManager;
 use crate::tools::{Tool, ToolDescriptionLength};
 
@@ -16,14 +15,13 @@ use crate::tools::{Tool, ToolDescriptionLength};
 /// (irreversible) whereas toggling is reversible, and keeping it separate lets
 /// it carry a distinct approval rule.
 pub struct ToggleItem {
-    mcp:     Arc<McpManager>,
     plugins: Arc<PluginManager>,
     cron:    Arc<TaskManager>,
 }
 
 impl ToggleItem {
-    pub fn new(mcp: Arc<McpManager>, plugins: Arc<PluginManager>, cron: Arc<TaskManager>) -> Self {
+    pub fn new(plugins: Arc<PluginManager>, cron: Arc<TaskManager>) -> Self {
-        Self { mcp, plugins, cron }
+        Self { plugins, cron }
     }
 }
 
@@ -33,7 +31,6 @@ impl Tool for ToggleItem {
 
     fn description(&self) -> &str {
         "Enable or disable an item by kind. Pass `kind`, `id`, and `enabled`:\n\
-         • `mcp` — `id` is the server name. NOTE: a restart is required for the change to take full effect on running servers.\n\
          • `plugin` — `id` is the plugin id (e.g. \"telegram\"). Takes effect immediately (the plugin is started/stopped at once).\n\
          • `cron` — `id` is the numeric job id (from `list_items` type=cron). Re-enabling recalculates next_run_at.\n\
          Use `list_items` to find current names/ids and statuses."
@@ -46,12 +43,12 @@ impl Tool for ToggleItem {
             "properties": {
                 "kind": {
                     "type": "string",
-                    "enum": ["mcp", "plugin", "cron"],
+                    "enum": ["plugin", "cron"],
                     "description": "Which kind of item to toggle."
                 },
                 "id": {
                     "type": "string",
-                    "description": "MCP server name | plugin id | numeric cron job id (as a string)."
+                    "description": "plugin id | numeric cron job id (as a string)."
                 },
                 "enabled": {
                     "type": "boolean",
@@ -78,16 +75,6 @@ impl Tool for ToggleItem {
             .ok_or_else(|| anyhow::anyhow!("toggle_item: missing required argument `enabled`"))?;
 
         match kind {
-            "mcp" => {
-                tokio::task::block_in_place(|| {
-                    tokio::runtime::Handle::current().block_on(self.mcp.set_enabled(id, enabled))
-                })?;
-                Ok(format!(
-                    "MCP server '{}' is now {}. Note: a restart is required for the change to take effect on running servers.",
-                    id,
-                    if enabled { "enabled" } else { "disabled" }
-                ))
-            }
             "plugin" => {
                 tokio::task::block_in_place(|| {
                     tokio::runtime::Handle::current().block_on(self.plugins.toggle(id, enabled))
@@ -107,7 +94,7 @@ impl Tool for ToggleItem {
                     Ok(format!("No task with id {job_id}."))
                 }
             }
-            other => anyhow::bail!("toggle_item: unknown kind `{other}` (expected one of: mcp, plugin, cron)"),
+            other => anyhow::bail!("toggle_item: unknown kind `{other}` (expected one of: plugin, cron)"),
         }
     }
 }

default.config.yaml

@@ -15,6 +15,17 @@ server:
 web:
   static_dir: ./web
 
+# ── Connector marketplace ──────────────────────────────────────────────────────
+# The feed of vetted connectors the admin browses under Connectors → Marketplace.
+# It is *consultative*: the feed proposes, the admin installs into the local
+# catalog, and only then can a connector be enabled globally or activated by a
+# user. The trust anchor stays on this box.
+#
+# Point it at a self-hosted mirror or a local copy to run fully offline — the feed
+# is plain static files (`connectors.json` + `<folder>/connector.json`).
+marketplace:
+  url: https://connectors.skaldagent.net
+
 # The database lives at ./database/system.db — fixed, not configurable.
 
 

src/config.rs

@@ -27,6 +27,8 @@ pub struct Config {
     pub web:         WebConfig,
     pub llm:         LlmConfig,
     #[serde(default)]
+    pub marketplace: MarketplaceConfig,
+    #[serde(default)]
     pub tic:      TicConfig,
     #[serde(default)]
     pub cron:     CronConfig,
@@ -47,6 +49,23 @@ pub struct WebConfig {
     pub static_dir: String,
 }
 
+/// The connector marketplace feed (blueprint §14/§15).
+///
+/// Configurable, not hardcoded: an on-premise product must not hard-require
+/// reaching one vendor's host. Point it at a self-hosted mirror, or an offline
+/// copy served locally, and nothing else changes.
+#[derive(Debug, Deserialize)]
+pub struct MarketplaceConfig {
+    /// Base URL serving `connectors.json` and each `<folder>/connector.json`.
+    pub url: String,
+}
+
+impl Default for MarketplaceConfig {
+    fn default() -> Self {
+        Self { url: "https://connectors.skaldagent.net".to_string() }
+    }
+}
+
 impl Config {
     pub fn into_split(self) -> (skald_core::config::CoreConfig, crate::frontend::config::FrontendConfig) {
         let tz = self.timezone.clone();
@@ -60,6 +79,7 @@ impl Config {
             crate::frontend::config::FrontendConfig {
                 server:      self.server,
                 web:         self.web,
+                marketplace: self.marketplace,
                 timezone:    tz,
             },
         )

src/frontend/api/approval.rs

@@ -115,7 +115,7 @@ pub async fn list_tools(
     State(skald): State<Arc<Skald>>,
 ) -> Result<Json<AllTools>, ApiError> {
     let mut tools = skald.catalog().list_all();
-    let server_rows = skald_core::db::mcp_servers::all(skald.db()).await?;
+    let server_rows = skald_core::db::mcp_global_servers::all(skald.db()).await?;
     tools.mcp_servers = server_rows.into_iter()
         .map(|r| (r.name, McpServerMeta { friendly_name: r.friendly_name, description: r.description }))
         .collect();

src/frontend/api/marketplace.rs

@@ -0,0 +1,898 @@
+//! Connector marketplace — a remote feed of vetted connectors (blueprint §14/§15).
+//!
+//! The feed is **consultative, not authoritative**: it *proposes* connectors, the
+//! admin *installs* one into `mcp_catalog`, and only then can it be enabled
+//! globally (`mcp_global_servers`) or activated per-user (`mcp_user_servers`).
+//! The trust anchor stays on the box, so §14's risk axis is untouched — importing
+//! an `mcp_local` entry writes a script that will execute here, and therefore
+//! still demands the admin-only `mcp.register_local_script` on top of
+//! `mcp.manage_catalog`.
+//!
+//! Everything is fetched **server-side**: the feed serves no CORS headers, so a
+//! browser cannot read it directly, and proxying also keeps the household's
+//! browsing pattern off the open web (only the box's IP reaches the feed, and it
+//! pulls the whole index rather than querying per connector).
+//!
+//! ## What the digests do and do not buy
+//!
+//! Each manifest declares a SHA-256 per file, and [`install`] refuses any file
+//! that does not match — fail-closed. That is **pinning**, not authenticity: the
+//! digest arrives over the same channel as the file, so whoever can serve a
+//! modified script can serve its modified digest too. What it buys is that the
+//! hash recorded at install time makes any *later* silent change detectable — no
+//! quiet code update on the box. Real authenticity needs the index signed by a key
+//! that does not live on the web server; the format is ready for it, the check is
+//! not written yet.
+
+use std::collections::HashMap;
+use std::sync::{Arc, LazyLock};
+use std::time::{Duration, Instant};
+
+use axum::extract::{Extension, Path, Query, State};
+use axum::http::header;
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
+use tokio::sync::RwLock;
+
+use skald_core::db::{mcp_catalog, role_capabilities};
+use skald_core::skald::Skald;
+
+use super::guard::AuthUser;
+use super::ApiError;
+
+/// The configured feed URL (`marketplace.url` in `config.yml`), installed by
+/// [`crate::frontend::WebFrontend::new`] at startup.
+static FEED_URL: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+
+/// Installs the feed URL from config. Called once during frontend construction;
+/// later calls are ignored, so tests and the desktop shell cannot race it.
+pub fn set_feed_url(url: String) {
+    let _ = FEED_URL.set(url.trim_end_matches('/').to_string());
+}
+
+/// Where the feed lives. Falls back to the public host when nothing configured it
+/// — a missing `marketplace:` block should degrade to the default, not to a
+/// panic.
+fn base_url() -> String {
+    FEED_URL
+        .get()
+        .cloned()
+        .unwrap_or_else(|| "https://connectors.skaldagent.net".to_string())
+}
+
+/// How long a hydrated feed stays warm. The feed changes rarely; the admin can
+/// force a refetch from the UI.
+const CACHE_TTL: Duration = Duration::from_secs(300);
+
+/// Refuses a file the feed declares as absurdly large before downloading it. Files
+/// are verified in memory, so this also bounds the allocation.
+const MAX_FILE_BYTES: u64 = 8 * 1024 * 1024;
+
+static HTTP: LazyLock<reqwest::Client> = LazyLock::new(|| {
+    reqwest::Client::builder()
+        .timeout(Duration::from_secs(20))
+        .user_agent(concat!("skald/", env!("CARGO_PKG_VERSION")))
+        .build()
+        .expect("marketplace http client")
+});
+
+// ── the feed's wire format ────────────────────────────────────────────────────
+//
+// Deliberately tolerant: the feed evolves alongside this client, so every field
+// the client can derive itself is optional and unknown fields are ignored. The
+// feed's vocabulary is NOT Skald's — see `norm_*` below for the translation.
+
+#[derive(Debug, Clone, Default, Deserialize)]
+struct IndexEntry {
+    id:               String,
+    #[serde(default)] name:             Option<String>,
+    /// The index is the single place that names files and their digests, which is
+    /// what makes it the one document worth signing: verify it, and every artifact
+    /// below is anchored. (A manifest cannot carry its own digest — writing the
+    /// hash into the file changes the file.)
+    #[serde(default)] files:            Vec<FileEntry>,
+    /// `icon_small` is the current spelling; `small_icon` was the earlier one.
+    #[serde(default, alias = "small_icon")] icon_small: Option<String>,
+    #[serde(default, alias = "large_icon")] icon_large: Option<String>,
+    #[serde(default)] user_description: Option<String>,
+    #[serde(default)] requires:         Vec<String>,
+    #[serde(default)] tags:             Vec<String>,
+    #[serde(default)] folder:           Option<String>,
+    /// `user` | `global` — the feed's word for §7 placement.
+    #[serde(default)] scope:            Option<String>,
+    /// `mcp_local` | `mcp_remote` — the §14 risk axis.
+    #[serde(default, rename = "type")] kind: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct Index {
+    #[serde(default)] connectors: Vec<IndexEntry>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+struct FileEntry {
+    path:             String,
+    sha256:           String,
+    #[serde(default)] size: Option<u64>,
+}
+
+/// How a connector authenticates. `delivery` matters because Skald's remote
+/// transport sends a key as `Authorization: Bearer`, while some servers (Tavily)
+/// want it as a query parameter — which they express as a `{key}` placeholder in
+/// the URL that `skald_core::mcp` substitutes at connect time. The placeholder is
+/// what actually drives the substitution, so the feed's `param` name is not read.
+#[derive(Debug, Clone, Default, Deserialize)]
+struct AuthSpec {
+    #[serde(default, rename = "type")] kind: Option<String>,
+    #[serde(default)] delivery: Option<String>,
+    #[serde(default)] scopes:   Vec<String>,
+}
+
+#[derive(Debug, Clone, Default, Deserialize)]
+struct Doc {
+    #[serde(default)] description: Option<String>,
+    /// The text the LLM reads when deciding whether to `activate_tools()` on this
+    /// server (tools are lazy-loaded), so it maps to `mcp_catalog.description` —
+    /// the column that reaches the prompt. The human-facing blurb is
+    /// `IndexEntry::user_description` and stays in the UI.
+    #[serde(default)] llm_short_description: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, Deserialize)]
+struct McpConfigManifest {
+    #[serde(default)] command:   Option<String>,
+    #[serde(default)] args:      Vec<String>,
+    #[serde(default)] env:       HashMap<String, String>,
+    #[serde(default)] url:       Option<String>,
+    #[serde(default)] transport: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, Deserialize)]
+struct Manifest {
+    #[serde(default)] name:               Option<String>,
+    #[serde(default)] version:            Option<String>,
+    #[serde(default, rename = "type")] kind: Option<String>,
+    #[serde(default)] transport:          Option<String>,
+    #[serde(default)] requires:           Vec<String>,
+    #[serde(default)] dependencies:       Vec<String>,
+    #[serde(default)] setup_instructions: Vec<String>,
+    #[serde(default)] docs:               Vec<Doc>,
+    #[serde(default)] mcp_config:         Option<McpConfigManifest>,
+    #[serde(default)] homepage:           Option<String>,
+    /// Digests now live in the index (the signable root); kept here only so an
+    /// older feed still installs.
+    #[serde(default)] files:              Vec<FileEntry>,
+    #[serde(default)] scope:              Option<String>,
+    #[serde(default)] auth:               Option<AuthSpec>,
+}
+
+#[derive(Debug, Clone)]
+struct Hydrated {
+    entry:    IndexEntry,
+    manifest: Manifest,
+}
+
+// ── feed vocabulary → Skald vocabulary ────────────────────────────────────────
+
+/// §7 placement: does this run once for the household (host runtime) or once per
+/// user (inside their container)? The feed says `user`, the catalog says
+/// `per_user`.
+///
+/// Placement is **not** transport: a remote connector can be per-user (a personal
+/// API key — `mcp.register_remote` exists precisely for that), and the inference
+/// from `mcp_remote` → global only happens to hold for today's two entries. So the
+/// feed's explicit `scope` always wins; the inference is a last resort, and it
+/// resolves to `per_user`, the narrower blast radius.
+fn norm_scope(entry: &IndexEntry, manifest: &Manifest) -> String {
+    let declared = manifest.scope.as_deref().or(entry.scope.as_deref());
+    match declared {
+        Some("global") => "global".to_string(),
+        Some("user") | Some("per_user") => "per_user".to_string(),
+        _ => "per_user".to_string(),
+    }
+}
+
+/// §14 risk axis: does installing this write code that will execute on the box?
+/// `mcp_local` does, and that is the gated act — not "remote vs local" as such.
+fn norm_source(entry: &IndexEntry, manifest: &Manifest) -> String {
+    let declared = manifest.kind.as_deref().or(entry.kind.as_deref());
+    match declared {
+        Some("mcp_remote") => "remote".to_string(),
+        Some("mcp_local") => "local_script".to_string(),
+        // The index carries no `type` today. Fall back to the tags it does carry,
+        // then to `local_script` — the answer that demands MORE authority, so a
+        // silent misread cannot under-gate an install.
+        _ if entry.tags.iter().any(|t| t == "remote") => "remote".to_string(),
+        _ => "local_script".to_string(),
+    }
+}
+
+/// `skald_core::mcp::transport_of` maps `http`→Http, `sse`→Sse and **everything
+/// else to Stdio**. The feed says `streamable-http`, which would therefore fall
+/// through to Stdio and try to spawn a command that does not exist — a silent
+/// failure, not an error. Normalise here so only the three understood values are
+/// ever stored.
+fn norm_transport(manifest: &Manifest, source: &str) -> String {
+    let declared = manifest
+        .mcp_config
+        .as_ref()
+        .and_then(|c| c.transport.as_deref())
+        .or(manifest.transport.as_deref());
+    match declared {
+        Some("streamable-http") | Some("http") => "http".to_string(),
+        Some("sse") => "sse".to_string(),
+        Some("stdio") => "stdio".to_string(),
+        _ if source == "remote" => "http".to_string(),
+        _ => "stdio".to_string(),
+    }
+}
+
+/// The catalog's `auth_kind` vocabulary. Prefers the manifest's structured `auth`
+/// block and falls back to the coarse `requires` list.
+///
+/// Only `none` and `api_key` are wired in the activation path today (§15's OAuth /
+/// QR / SSH elicitation flow is deferred), so `oauth` here is an honest label on a
+/// connector that cannot yet complete its login, not a working mode.
+fn norm_auth_kind(entry: &IndexEntry, manifest: &Manifest) -> String {
+    if let Some(k) = manifest.auth.as_ref().and_then(|a| a.kind.as_deref()) {
+        return match k {
+            "oauth2" | "oauth" => "oauth".to_string(),
+            "api_key" => "api_key".to_string(),
+            "qr" => "qr".to_string(),
+            "ssh_key" => "ssh_key".to_string(),
+            _ => "none".to_string(),
+        };
+    }
+    let requires: Vec<&str> = manifest
+        .requires
+        .iter()
+        .chain(entry.requires.iter())
+        .map(|s| s.as_str())
+        .collect();
+    if requires.iter().any(|r| r.eq_ignore_ascii_case("oauth")) {
+        "oauth".to_string()
+    } else if requires.iter().any(|r| r.eq_ignore_ascii_case("api_key")) {
+        "api_key".to_string()
+    } else {
+        "none".to_string()
+    }
+}
+
+/// The files to install, with their digests. The index is authoritative (it is the
+/// document a signature would cover); a manifest-side list is honoured only when
+/// the index carries none.
+fn files_of<'a>(entry: &'a IndexEntry, manifest: &'a Manifest) -> &'a [FileEntry] {
+    if entry.files.is_empty() {
+        &manifest.files
+    } else {
+        &entry.files
+    }
+}
+
+// ── the card the admin UI renders ─────────────────────────────────────────────
+
+/// One marketplace entry, already translated into Skald's vocabulary so the UI
+/// filters on the same words the catalog stores.
+#[derive(Debug, Clone, Serialize)]
+pub struct MarketplaceCard {
+    pub id:                 String,
+    pub name:               String,
+    pub version:            Option<String>,
+    /// `per_user` | `global`
+    pub scope:              String,
+    /// `remote` | `local_script`
+    pub source:             String,
+    pub transport:          String,
+    pub user_description:   Option<String>,
+    pub llm_description:    Option<String>,
+    pub requires:           Vec<String>,
+    pub tags:               Vec<String>,
+    pub homepage:           Option<String>,
+    pub auth_kind:          String,
+    /// `header` | `query` — how the server wants its key. Shown because a `query`
+    /// connector only works via the URL's `{key}` placeholder.
+    pub auth_delivery:      Option<String>,
+    /// The OAuth scopes this connector will ask each user to grant. The admin
+    /// should see the blast radius of a consent before importing it.
+    pub oauth_scopes:       Vec<String>,
+    pub dependencies:       Vec<String>,
+    pub setup_instructions: Vec<String>,
+    pub file_count:         usize,
+    pub has_icon:           bool,
+    /// Already present in `mcp_catalog` under this id.
+    pub installed:          bool,
+}
+
+fn card_of(h: &Hydrated, installed: bool) -> MarketplaceCard {
+    let source = norm_source(&h.entry, &h.manifest);
+    let doc = h.manifest.docs.first().cloned().unwrap_or_default();
+    MarketplaceCard {
+        id:                 h.entry.id.clone(),
+        name:               h.entry.name.clone()
+                                .or_else(|| h.manifest.name.clone())
+                                .unwrap_or_else(|| h.entry.id.clone()),
+        version:            h.manifest.version.clone(),
+        scope:              norm_scope(&h.entry, &h.manifest),
+        transport:          norm_transport(&h.manifest, &source),
+        source,
+        user_description:   h.entry.user_description.clone().or(doc.description.clone()),
+        llm_description:    doc.llm_short_description.clone(),
+        requires:           if h.manifest.requires.is_empty() {
+                                h.entry.requires.clone()
+                            } else {
+                                h.manifest.requires.clone()
+                            },
+        tags:               h.entry.tags.clone(),
+        homepage:           h.manifest.homepage.clone(),
+        auth_kind:          norm_auth_kind(&h.entry, &h.manifest),
+        auth_delivery:      h.manifest.auth.as_ref().and_then(|a| a.delivery.clone()),
+        oauth_scopes:       h.manifest.auth.as_ref().map(|a| a.scopes.clone()).unwrap_or_default(),
+        dependencies:       h.manifest.dependencies.clone(),
+        setup_instructions: h.manifest.setup_instructions.clone(),
+        file_count:         files_of(&h.entry, &h.manifest).len(),
+        has_icon:           h.entry.icon_small.is_some() || h.entry.icon_large.is_some(),
+        installed,
+    }
+}
+
+// ── fetching + cache ──────────────────────────────────────────────────────────
+
+struct Cache {
+    fetched: Instant,
+    feed:    Vec<Hydrated>,
+}
+
+static CACHE: LazyLock<RwLock<Option<Cache>>> = LazyLock::new(|| RwLock::new(None));
+
+fn folder_of(entry: &IndexEntry) -> String {
+    entry.folder.clone().unwrap_or_else(|| entry.id.clone())
+}
+
+/// Pulls the index, then every `connector.json` concurrently. The N+1 is only
+/// tolerable because the index is small and cached — once the index carries `type`
+/// and `scope` for every entry, the listing collapses to a single fetch.
+async fn fetch_feed() -> Result<Vec<Hydrated>, ApiError> {
+    let base = base_url();
+    let index: Index = HTTP
+        .get(format!("{base}/connectors.json"))
+        .send()
+        .await
+        .map_err(|e| ApiError::bad_request(format!("cannot reach the marketplace at {base}: {e}")))?
+        .error_for_status()
+        .map_err(|e| ApiError::bad_request(format!("marketplace returned an error: {e}")))?
+        .json()
+        .await
+        .map_err(|e| ApiError::bad_request(format!("marketplace index is not valid JSON: {e}")))?;
+
+    let mut set = tokio::task::JoinSet::new();
+    for entry in index.connectors {
+        let base = base.clone();
+        set.spawn(async move {
+            let url = format!("{}/{}/connector.json", base, folder_of(&entry));
+            // A manifest that fails to load degrades that one card to whatever the
+            // index said; it never fails the whole listing.
+            let manifest = match HTTP.get(&url).send().await {
+                Ok(r) => r.json::<Manifest>().await.unwrap_or_default(),
+                Err(_) => Manifest::default(),
+            };
+            Hydrated { entry, manifest }
+        });
+    }
+
+    let mut feed = Vec::new();
+    while let Some(joined) = set.join_next().await {
+        if let Ok(h) = joined {
+            feed.push(h);
+        }
+    }
+    feed.sort_by(|a, b| a.entry.id.cmp(&b.entry.id));
+    Ok(feed)
+}
+
+/// The hydrated feed, from cache when warm.
+async fn feed(force: bool) -> Result<Vec<Hydrated>, ApiError> {
+    if !force {
+        if let Some(c) = CACHE.read().await.as_ref() {
+            if c.fetched.elapsed() < CACHE_TTL {
+                return Ok(c.feed.clone());
+            }
+        }
+    }
+    let fresh = fetch_feed().await?;
+    *CACHE.write().await = Some(Cache { fetched: Instant::now(), feed: fresh.clone() });
+    Ok(fresh)
+}
+
+// ── helpers ───────────────────────────────────────────────────────────────────
+
+async fn require_cap(skald: &Skald, user_id: &str, cap: &str) -> Result<(), ApiError> {
+    let user = skald_core::db::users::get(skald.db(), user_id)
+        .await?
+        .ok_or_else(|| ApiError::unauthorized("unknown user"))?;
+    if role_capabilities::has(skald.db(), &user.role_id, cap).await? {
+        Ok(())
+    } else {
+        Err(ApiError::forbidden(format!("your role lacks the capability `{cap}`")))
+    }
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    let mut h = Sha256::new();
+    h.update(bytes);
+    h.finalize().iter().fold(String::with_capacity(64), |mut s, b| {
+        use std::fmt::Write;
+        let _ = write!(s, "{b:02x}");
+        s
+    })
+}
+
+/// Rejects a feed-supplied path that could escape the connector's own folder.
+/// The feed is only semi-trusted (§14) — a hostile or compromised manifest must
+/// not be able to name `../../config.yml` and have us write there.
+fn safe_rel_path(p: &str) -> Result<&str, ApiError> {
+    let bad = p.is_empty()
+        || p.starts_with('/')
+        || p.contains('\\')
+        || p.contains(':')
+        || std::path::Path::new(p)
+            .components()
+            .any(|c| !matches!(c, std::path::Component::Normal(_)));
+    if bad {
+        return Err(ApiError::bad_request(format!(
+            "manifest declares an unsafe file path: `{p}`"
+        )));
+    }
+    Ok(p)
+}
+
+// ── GET /api/mcp/marketplace ──────────────────────────────────────────────────
+
+#[derive(Deserialize)]
+pub struct ListQuery {
+    #[serde(default)]
+    pub refresh: bool,
+}
+
+/// The whole feed, translated and marked with what is already installed. Search
+/// and filtering happen client-side: the list is small, and one payload keeps the
+/// UI responsive without a round trip per keystroke.
+pub async fn list(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Query(q): Query<ListQuery>,
+) -> Result<Json<Value>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    let feed = feed(q.refresh).await?;
+    let installed: std::collections::HashSet<String> = mcp_catalog::list(skald.db())
+        .await?
+        .into_iter()
+        .map(|r| r.name)
+        .collect();
+    let cards: Vec<MarketplaceCard> = feed
+        .iter()
+        .map(|h| card_of(h, installed.contains(&h.entry.id)))
+        .collect();
+    Ok(Json(json!({ "base_url": base_url(), "connectors": cards })))
+}
+
+// ── GET /api/mcp/marketplace/{id}/icon ────────────────────────────────────────
+
+#[derive(Deserialize)]
+pub struct IconQuery {
+    #[serde(default)]
+    pub size: Option<String>,
+}
+
+/// Proxies a connector icon. Needed because the feed sends no CORS headers, so the
+/// page cannot load the image directly.
+pub async fn icon(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Path(id): Path<String>,
+    Query(q): Query<IconQuery>,
+) -> Result<Response, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    let feed = feed(false).await?;
+    let h = feed
+        .iter()
+        .find(|h| h.entry.id == id)
+        .ok_or_else(|| ApiError::not_found(format!("no marketplace connector `{id}`")))?;
+
+    let large = q.size.as_deref() == Some("lg");
+    let rel = if large {
+        h.entry.icon_large.clone().or_else(|| h.entry.icon_small.clone())
+    } else {
+        h.entry.icon_small.clone().or_else(|| h.entry.icon_large.clone())
+    }
+    .ok_or_else(|| ApiError::not_found("connector declares no icon"))?;
+
+    // The index's icon paths are relative to the feed root, not the folder.
+    let url = format!("{}/{}", base_url(), rel.trim_start_matches('/'));
+    let res = HTTP
+        .get(&url)
+        .send()
+        .await
+        .map_err(|e| ApiError::bad_request(format!("cannot fetch icon: {e}")))?
+        .error_for_status()
+        .map_err(|e| ApiError::not_found(format!("icon unavailable: {e}")))?;
+
+    let ct = res
+        .headers()
+        .get(header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("application/octet-stream")
+        .to_string();
+    let bytes = res
+        .bytes()
+        .await
+        .map_err(|e| ApiError::bad_request(format!("cannot read icon: {e}")))?;
+
+    Ok((
+        [
+            (header::CONTENT_TYPE, ct),
+            (header::CACHE_CONTROL, "public, max-age=3600".to_string()),
+        ],
+        bytes,
+    )
+        .into_response())
+}
+
+// ── POST /api/mcp/marketplace/install ─────────────────────────────────────────
+
+#[derive(Deserialize)]
+pub struct InstallBody {
+    pub id: String,
+}
+
+/// Imports a feed entry into `mcp_catalog` — the act that moves a connector from
+/// "someone else vetted this" to "this household's admin accepted it". For an
+/// `mcp_local` entry it first downloads and hash-verifies the scripts into
+/// `./scripts/<id>/`, which is code landing on the box and therefore needs
+/// `mcp.register_local_script` (§14) on top of `mcp.manage_catalog`.
+///
+/// Installing does **not** activate: a global entry still needs the admin to
+/// enable it with a key, a per-user one still needs each user to activate it.
+pub async fn install(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Json(body): Json<InstallBody>,
+) -> Result<Json<Value>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+
+    let feed = feed(false).await?;
+    let h = feed
+        .iter()
+        .find(|h| h.entry.id == body.id)
+        .ok_or_else(|| ApiError::not_found(format!("no marketplace connector `{}`", body.id)))?;
+
+    let source = norm_source(&h.entry, &h.manifest);
+    let scope = norm_scope(&h.entry, &h.manifest);
+    let transport = norm_transport(&h.manifest, &source);
+    let cfg = h.manifest.mcp_config.clone().unwrap_or_default();
+    let doc = h.manifest.docs.first().cloned().unwrap_or_default();
+
+    if source == "local_script" {
+        require_cap(&skald, &auth.user_id, role_capabilities::REGISTER_LOCAL_SCRIPT).await?;
+    }
+
+    // Download + verify before touching the catalog, so a failed digest leaves no
+    // trace of a half-installed connector.
+    let (script_path, verified) = if source == "local_script" {
+        let files = download_verified(&h.entry, &h.manifest).await?;
+        let entry_file = cfg
+            .args
+            .first()
+            .cloned()
+            .ok_or_else(|| ApiError::bad_request(
+                "manifest has no mcp_config.args[0] naming the script to run",
+            ))?;
+        let entry_file = safe_rel_path(&entry_file)?.to_string();
+        (Some(format!("{}/{}", body.id, entry_file)), files)
+    } else {
+        (None, 0)
+    };
+
+    let args_json = if source == "local_script" {
+        // `activate` rewrites args to the in-container path when it copies the
+        // script into the user's home, so what is stored here is only a template.
+        None
+    } else if cfg.args.is_empty() {
+        None
+    } else {
+        serde_json::to_string(&cfg.args).ok()
+    };
+
+    // `requires` is the feed's coarse precondition list; the activation UI needs
+    // the concrete env keys, which only the manifest's mcp_config knows.
+    let config_schema: Vec<String> = cfg.env.keys().cloned().collect();
+
+    let id = mcp_catalog::upsert(
+        skald.db(),
+        mcp_catalog::UpsertCatalog {
+            name:               &h.entry.id,
+            scope:              &scope,
+            source:             &source,
+            transport:          &transport,
+            command:            cfg.command.as_deref(),
+            args_json,
+            env_json:           if cfg.env.is_empty() { None } else { serde_json::to_string(&cfg.env).ok() },
+            url:                cfg.url.as_deref(),
+            script_path:        script_path.as_deref(),
+            config_schema_json: if config_schema.is_empty() { None } else { serde_json::to_string(&config_schema).ok() },
+            auth_kind:          &norm_auth_kind(&h.entry, &h.manifest),
+            role_filter:        None,
+            friendly_name:      h.entry.name.as_deref().or(h.manifest.name.as_deref()),
+            // The LLM-facing blurb — this is the column `render_mcp_list` puts in
+            // the prompt for `activate_tools()`, so the feed's
+            // `llm_short_description` belongs here, not the human `user_description`.
+            description:        doc
+                                    .llm_short_description
+                                    .as_deref()
+                                    .or(h.entry.user_description.as_deref()),
+        },
+    )
+    .await?;
+
+    Ok(Json(json!({
+        "id":             id,
+        "name":           h.entry.id,
+        "scope":          scope,
+        "source":         source,
+        "files_verified": verified,
+    })))
+}
+
+/// Downloads every file the manifest declares into `./scripts/<id>/`, refusing any
+/// whose SHA-256 does not match. All-or-nothing: files are verified in memory and
+/// only written once every digest checks out, so a tampered feed never leaves a
+/// partial connector on disk. Returns how many files were verified.
+async fn download_verified(entry: &IndexEntry, manifest: &Manifest) -> Result<usize, ApiError> {
+    let files = files_of(entry, manifest);
+    if files.is_empty() {
+        return Err(ApiError::bad_request(
+            "the feed declares no `files` with digests for this connector — \
+             refusing to install unverifiable code (§14)",
+        ));
+    }
+
+    let base = base_url();
+    let folder = folder_of(entry);
+    let mut staged: Vec<(String, Vec<u8>)> = Vec::new();
+
+    for f in files {
+        let rel = safe_rel_path(&f.path)?;
+
+        // Defensive: a document can never carry its own digest (writing the hash
+        // changes the file), so a self-entry is unverifiable by construction. The
+        // feed now keeps digests in the index, where this cannot arise.
+        if rel == "connector.json" {
+            continue;
+        }
+
+        if let Some(sz) = f.size {
+            if sz > MAX_FILE_BYTES {
+                return Err(ApiError::bad_request(format!(
+                    "`{rel}` declares {sz} bytes, over the {MAX_FILE_BYTES} limit"
+                )));
+            }
+        }
+
+        let url = format!("{base}/{folder}/{rel}");
+        let bytes = HTTP
+            .get(&url)
+            .send()
+            .await
+            .map_err(|e| ApiError::bad_request(format!("cannot download `{rel}`: {e}")))?
+            .error_for_status()
+            .map_err(|e| ApiError::bad_request(format!("cannot download `{rel}`: {e}")))?
+            .bytes()
+            .await
+            .map_err(|e| ApiError::bad_request(format!("cannot read `{rel}`: {e}")))?;
+
+        let got = sha256_hex(&bytes);
+        if !got.eq_ignore_ascii_case(f.sha256.trim()) {
+            return Err(ApiError::bad_request(format!(
+                "digest mismatch on `{rel}`: the manifest declares {} but the served \
+                 file hashes to {got}. Refusing to install.",
+                f.sha256
+            )));
+        }
+        staged.push((rel.to_string(), bytes.to_vec()));
+    }
+
+    if staged.is_empty() {
+        return Err(ApiError::bad_request(
+            "manifest declares no installable file besides connector.json",
+        ));
+    }
+
+    let wd = std::env::current_dir()
+        .map_err(|e| ApiError::bad_request(format!("cannot resolve working directory: {e}")))?;
+    let dest = wd.join("scripts").join(&entry.id);
+    std::fs::create_dir_all(&dest)
+        .map_err(|e| ApiError::bad_request(format!("cannot create {}: {e}", dest.display())))?;
+
+    let count = staged.len();
+    for (rel, bytes) in staged {
+        let path = dest.join(&rel);
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)
+                .map_err(|e| ApiError::bad_request(format!("cannot create dir for `{rel}`: {e}")))?;
+        }
+        std::fs::write(&path, &bytes)
+            .map_err(|e| ApiError::bad_request(format!("cannot write `{rel}`: {e}")))?;
+    }
+    Ok(count)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn entry(json: &str) -> IndexEntry {
+        serde_json::from_str(json).expect("index entry")
+    }
+    fn manifest(json: &str) -> Manifest {
+        serde_json::from_str(json).expect("manifest")
+    }
+
+    /// A feed-supplied path must never escape the connector's own folder. The feed
+    /// is only semi-trusted (§14) — this is what stops a hostile manifest naming
+    /// `../../config.yml`.
+    #[test]
+    fn rejects_path_traversal_from_the_feed() {
+        for bad in [
+            "../../config.yml",
+            "/etc/passwd",
+            "a/../../b",
+            "..",
+            "",
+            "C:\\evil",
+            "dir\\file.py",
+        ] {
+            assert!(safe_rel_path(bad).is_err(), "should have rejected `{bad}`");
+        }
+        for ok in ["server.py", "pkg/server.py", "requirements.txt"] {
+            assert!(safe_rel_path(ok).is_ok(), "should have accepted `{ok}`");
+        }
+    }
+
+    /// Placement (§7) is not transport: the feed's explicit `scope` decides, and a
+    /// feed that says nothing must fall to the narrower blast radius.
+    #[test]
+    fn scope_comes_from_the_feed_not_from_the_transport() {
+        assert_eq!(
+            norm_scope(&entry(r#"{"id":"t","scope":"global"}"#), &Manifest::default()),
+            "global"
+        );
+        assert_eq!(
+            norm_scope(&entry(r#"{"id":"g","scope":"user"}"#), &Manifest::default()),
+            "per_user"
+        );
+        // A *remote* connector explicitly scoped per-user stays per-user — this is
+        // the case `mcp.register_remote` exists for, and the one an infer-from-
+        // transport shortcut would get wrong.
+        assert_eq!(
+            norm_scope(
+                &entry(r#"{"id":"r","scope":"user","type":"mcp_remote"}"#),
+                &manifest(r#"{"type":"mcp_remote"}"#)
+            ),
+            "per_user"
+        );
+        // Silence → the narrower answer.
+        assert_eq!(norm_scope(&entry(r#"{"id":"x"}"#), &Manifest::default()), "per_user");
+    }
+
+    /// An unreadable `type` must resolve to the answer that demands MORE authority,
+    /// so a misread can never under-gate an install past §14's admin-only check.
+    #[test]
+    fn unknown_source_fails_closed_to_local_script() {
+        assert_eq!(norm_source(&entry(r#"{"id":"x"}"#), &Manifest::default()), "local_script");
+        assert_eq!(
+            norm_source(&entry(r#"{"id":"x","type":"mcp_remote"}"#), &Manifest::default()),
+            "remote"
+        );
+        assert_eq!(
+            norm_source(&entry(r#"{"id":"x","type":"mcp_local"}"#), &Manifest::default()),
+            "local_script"
+        );
+    }
+
+    /// `transport_of` in skald-core maps anything unknown to Stdio, so an unmapped
+    /// `streamable-http` would silently try to spawn a command instead of making an
+    /// HTTP call.
+    #[test]
+    fn streamable_http_normalises_to_http() {
+        let m = manifest(r#"{"mcp_config":{"transport":"streamable-http","url":"https://x/"}}"#);
+        assert_eq!(norm_transport(&m, "remote"), "http");
+        // A remote entry that names no transport still must not become stdio.
+        assert_eq!(norm_transport(&Manifest::default(), "remote"), "http");
+        assert_eq!(norm_transport(&Manifest::default(), "local_script"), "stdio");
+    }
+
+    /// The structured `auth` block wins over the coarse `requires` list.
+    #[test]
+    fn auth_kind_prefers_the_structured_block() {
+        let m = manifest(r#"{"auth":{"type":"oauth2","scopes":["a","b"]},"requires":["API_KEY"]}"#);
+        assert_eq!(norm_auth_kind(&entry(r#"{"id":"x"}"#), &m), "oauth");
+        let m = manifest(r#"{"auth":{"type":"api_key","delivery":"query","param":"k"}}"#);
+        assert_eq!(norm_auth_kind(&entry(r#"{"id":"x"}"#), &m), "api_key");
+        // No auth block → fall back to `requires`.
+        assert_eq!(
+            norm_auth_kind(&entry(r#"{"id":"x","requires":["API_KEY"]}"#), &Manifest::default()),
+            "api_key"
+        );
+    }
+
+    /// Digests live in the index now; a manifest-side list is only a fallback.
+    #[test]
+    fn index_digests_win_over_manifest_digests() {
+        let e = entry(r#"{"id":"x","files":[{"path":"a.py","sha256":"aa"}]}"#);
+        let m = manifest(r#"{"files":[{"path":"b.py","sha256":"bb"}]}"#);
+        assert_eq!(files_of(&e, &m).len(), 1);
+        assert_eq!(files_of(&e, &m)[0].path, "a.py");
+        assert_eq!(files_of(&entry(r#"{"id":"x"}"#), &m)[0].path, "b.py");
+    }
+
+    #[test]
+    fn sha256_matches_a_known_vector() {
+        assert_eq!(
+            sha256_hex(b"abc"),
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+        );
+    }
+
+    /// Hits the real feed. `#[ignore]`d so the suite stays offline-clean; run with
+    /// `cargo test --bin skald -- --ignored live_feed`.
+    #[tokio::test]
+    #[ignore]
+    async fn live_feed_parses_and_verifies() {
+        // `main()` installs the process-wide rustls provider before any handshake;
+        // under the test harness main never runs, so do it here. Ignore the error:
+        // another test may have installed it already.
+        let _ = rustls::crypto::ring::default_provider().install_default();
+
+        let feed = match fetch_feed().await {
+            Ok(f) => f,
+            Err(e) => panic!("feed unreachable: {}", e.message),
+        };
+        assert!(!feed.is_empty(), "feed returned no connectors");
+
+        for h in &feed {
+            let c = card_of(h, false);
+            println!(
+                "{:<8} scope={:<8} source={:<12} transport={:<6} auth={:<7} files={}",
+                c.id, c.scope, c.source, c.transport, c.auth_kind, c.file_count
+            );
+            assert!(matches!(c.scope.as_str(), "per_user" | "global"));
+            assert!(matches!(c.source.as_str(), "remote" | "local_script"));
+            // Anything that is not stdio must have been normalised into a value
+            // `transport_of` actually understands.
+            assert!(matches!(c.transport.as_str(), "stdio" | "http" | "sse"));
+            assert!(
+                c.llm_description.is_some(),
+                "`{}` has no llm_short_description — the agent would see nothing \
+                 when deciding whether to activate_tools() on it",
+                c.id
+            );
+        }
+
+        // Every declared digest must match what the site actually serves.
+        for h in &feed {
+            for f in files_of(&h.entry, &h.manifest) {
+                let url = format!("{}/{}/{}", base_url(), folder_of(&h.entry), f.path);
+                let bytes = HTTP.get(&url).send().await.unwrap().bytes().await.unwrap();
+                assert_eq!(
+                    sha256_hex(&bytes).to_lowercase(),
+                    f.sha256.trim().to_lowercase(),
+                    "digest mismatch for {}/{}",
+                    h.entry.id,
+                    f.path
+                );
+            }
+        }
+    }
+}

src/frontend/api/mcp.rs

@@ -1,11 +1,462 @@
-use axum::Json;
+//! Connectors (MCP) management API (blueprint §14/§15).
-use axum::extract::State;
+//!
-use serde_json::Value;
+//! Two audiences, capability-gated (`role_capabilities`):
+//! - **Admin** curates the catalog (`mcp_catalog`) and enables globally-active
+//!   connectors (`mcp_global_servers` + `mcp_global_access`).
+//! - **Any user** activates per-user connectors from the catalog into their own
+//!   `{userid}.db` (`mcp_user_servers`), started inside their container.
+//!
+//! Registration is UI/API-driven, never agent-driven — the prompt-injection→
+//! local-script→RCE path (§14) is gone with the old `register_mcp` tool.
 
+use std::collections::HashMap;
 use std::sync::Arc;
+
+use axum::extract::{Extension, Path, State};
+use axum::Json;
+use serde::Deserialize;
+use serde_json::{json, Value};
+
+use skald_core::db::{mcp_catalog, mcp_global_access, mcp_global_servers, mcp_user_servers, role_capabilities};
 use skald_core::skald::Skald;
 
-/// Returns the list of running MCP servers and their available tools.
+use super::guard::AuthUser;
+use super::{require_context, ApiError};
+
+// ── helpers ───────────────────────────────────────────────────────────────────
+
+/// Fails with 403 unless the caller's role holds `cap` (admin holds everything).
+async fn require_cap(skald: &Skald, user_id: &str, cap: &str) -> Result<(), ApiError> {
+    let user = skald_core::db::users::get(skald.db(), user_id).await?
+        .ok_or_else(|| ApiError::unauthorized("unknown user"))?;
+    if role_capabilities::has(skald.db(), &user.role_id, cap).await? {
+        Ok(())
+    } else {
+        Err(ApiError::forbidden(format!("your role lacks the capability `{cap}`")))
+    }
+}
+
+fn to_json_opt<T: serde::Serialize>(v: &Option<T>) -> Option<String> {
+    v.as_ref().and_then(|x| serde_json::to_string(x).ok())
+}
+
+/// Copies a vetted catalog script from `./scripts/<script_path>` into the user's
+/// bind-mounted home under `.skald/mcp/<name>/`, and returns the path it will have
+/// INSIDE the container (`/root/.skald/mcp/...`). The home is the only durable
+/// zone (§6), so the script survives a container recreate. Single files only for
+/// now — directory-tree scripts (e.g. whatsapp_mcp/) are a follow-up.
+fn copy_script_into_home(user_id: &str, name: &str, script_path: &str) -> Result<String, ApiError> {
+    let wd = std::env::current_dir()
+        .map_err(|e| ApiError::bad_request(format!("cannot resolve working directory: {e}")))?;
+    let src = wd.join("scripts").join(script_path);
+    if !src.is_file() {
+        return Err(ApiError::bad_request(format!(
+            "catalog script `scripts/{script_path}` not found or not a file \
+             (directory-tree scripts are not supported yet)"
+        )));
+    }
+    let basename = src.file_name()
+        .ok_or_else(|| ApiError::bad_request("invalid script_path"))?
+        .to_string_lossy().to_string();
+    let dest_dir = wd.join(skald_core::container::HOMES_DIR)
+        .join(user_id).join(".skald").join("mcp").join(name);
+    std::fs::create_dir_all(&dest_dir)
+        .map_err(|e| ApiError::bad_request(format!("failed to create script dir: {e}")))?;
+    std::fs::copy(&src, dest_dir.join(&basename))
+        .map_err(|e| ApiError::bad_request(format!("failed to copy script: {e}")))?;
+    Ok(format!("/root/.skald/mcp/{name}/{basename}"))
+}
+
+// ── existing: running-server introspection ────────────────────────────────────
+
+/// The globally-running MCP servers and their tools (host runtime).
 pub async fn list_servers(State(skald): State<Arc<Skald>>) -> Json<Vec<Value>> {
     Json(skald.mcp().server_infos())
 }
+
+// ── admin: catalog CRUD ───────────────────────────────────────────────────────
+
+pub async fn catalog_list(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+) -> Result<Json<Vec<mcp_catalog::McpCatalogRow>>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    Ok(Json(mcp_catalog::list(skald.db()).await?))
+}
+
+#[derive(Deserialize)]
+pub struct CatalogUpsertBody {
+    pub name:          String,
+    pub scope:         String,               // 'per_user' | 'global'
+    pub source:        String,               // 'remote' | 'local_script'
+    #[serde(default = "default_stdio")]
+    pub transport:     String,
+    pub command:       Option<String>,
+    pub args:          Option<Vec<String>>,
+    pub env:           Option<HashMap<String, String>>,
+    pub url:           Option<String>,
+    pub script_path:   Option<String>,
+    pub config_schema: Option<Vec<String>>,
+    #[serde(default = "default_none_auth")]
+    pub auth_kind:     String,
+    pub role_filter:   Option<Vec<String>>,
+    pub friendly_name: Option<String>,
+    pub description:   Option<String>,
+}
+
+fn default_stdio() -> String { "stdio".into() }
+fn default_none_auth() -> String { "none".into() }
+
+pub async fn catalog_upsert(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Json(body): Json<CatalogUpsertBody>,
+) -> Result<Json<Value>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    // Adding a NEW local script to the catalog is the RCE-bearing act (§14): it
+    // needs the admin-only capability on top of catalog management.
+    if body.source == "local_script" {
+        require_cap(&skald, &auth.user_id, role_capabilities::REGISTER_LOCAL_SCRIPT).await?;
+    }
+    let id = mcp_catalog::upsert(skald.db(), mcp_catalog::UpsertCatalog {
+        name:               &body.name,
+        scope:              &body.scope,
+        source:             &body.source,
+        transport:          &body.transport,
+        command:            body.command.as_deref(),
+        args_json:          to_json_opt(&body.args),
+        env_json:           to_json_opt(&body.env),
+        url:                body.url.as_deref(),
+        script_path:        body.script_path.as_deref(),
+        config_schema_json: to_json_opt(&body.config_schema),
+        auth_kind:          &body.auth_kind,
+        role_filter:        to_json_opt(&body.role_filter),
+        friendly_name:      body.friendly_name.as_deref(),
+        description:        body.description.as_deref(),
+    }).await?;
+    Ok(Json(json!({ "id": id })))
+}
+
+pub async fn catalog_delete(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Path(id): Path<i64>,
+) -> Result<Json<Value>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    mcp_catalog::delete(skald.db(), id).await?;
+    Ok(Json(json!({ "ok": true })))
+}
+
+// ── admin: globally-active connectors + access ────────────────────────────────
+
+pub async fn global_list(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+) -> Result<Json<Vec<mcp_global_servers::McpGlobalServerRow>>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    Ok(Json(mcp_global_servers::all(skald.db()).await?))
+}
+
+#[derive(Deserialize)]
+pub struct GlobalEnableBody {
+    /// The catalog entry to enable globally (must be scope='global').
+    pub catalog_name:  String,
+    /// Optional runtime name override (defaults to the catalog name).
+    pub name:          Option<String>,
+    pub api_key:       Option<String>,
+    pub env:           Option<HashMap<String, String>>,
+}
+
+pub async fn global_enable(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Json(body): Json<GlobalEnableBody>,
+) -> Result<Json<Value>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    let entry = mcp_catalog::get_by_name(skald.db(), &body.catalog_name).await?
+        .ok_or_else(|| ApiError::not_found(format!("no catalog entry `{}`", body.catalog_name)))?;
+    if entry.scope != "global" {
+        return Err(ApiError::bad_request("catalog entry is not a global connector"));
+    }
+    let name = body.name.clone().unwrap_or_else(|| entry.name.clone());
+    // Snapshot the concrete config from the catalog; the admin supplies the secret.
+    let id = mcp_global_servers::upsert(skald.db(), mcp_global_servers::UpsertGlobal {
+        name:          &name,
+        catalog_name:  Some(&entry.name),
+        transport:     &entry.transport,
+        command:       entry.command.as_deref(),
+        args_json:     entry.args_json.clone(),
+        env_json:      body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()).or_else(|| entry.env_json.clone()),
+        url:           entry.url.as_deref(),
+        api_key:       body.api_key.as_deref(),
+        friendly_name: entry.friendly_name.as_deref(),
+        description:   entry.description.as_deref(),
+    }).await?;
+
+    // Start it now in the global runtime (host transport).
+    let row = mcp_global_servers::get(skald.db(), id).await?
+        .ok_or_else(|| ApiError::bad_request("global server vanished after upsert"))?;
+    let spec = skald_core::mcp::global_row_spec(&row);
+    match skald.mcp().start_server(spec).await {
+        Ok(tools) => Ok(Json(json!({ "id": id, "tools": tools }))),
+        Err(e)    => Ok(Json(json!({ "id": id, "error": e.to_string() }))),
+    }
+}
+
+pub async fn global_delete(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Path(id): Path<i64>,
+) -> Result<Json<Value>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    if let Some(row) = mcp_global_servers::get(skald.db(), id).await? {
+        skald.mcp().stop_server(&row.name);
+    }
+    mcp_global_servers::delete(skald.db(), id).await?;
+    Ok(Json(json!({ "ok": true })))
+}
+
+#[derive(Deserialize)]
+pub struct GlobalAccessBody {
+    /// The full set of user ids allowed to use this global connector.
+    pub user_ids: Vec<String>,
+}
+
+pub async fn global_get_access(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Path(id): Path<i64>,
+) -> Result<Json<Vec<String>>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    Ok(Json(mcp_global_access::users_for_server(skald.db(), id).await?))
+}
+
+pub async fn global_set_access(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Path(id): Path<i64>,
+    Json(body): Json<GlobalAccessBody>,
+) -> Result<Json<Value>, ApiError> {
+    require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
+    mcp_global_access::set_access(skald.db(), id, &body.user_ids).await?;
+    Ok(Json(json!({ "ok": true })))
+}
+
+// ── user: available catalog + activation ──────────────────────────────────────
+
+/// A globally-active connector as the Connectors page renders it.
+///
+/// Deliberately **not** [`mcp_global_servers::McpGlobalServerRow`]: that row carries
+/// `api_key`, and this view reaches every logged-in user, not just the admin. The
+/// browser has no use for the key, the url or the env here — so they never cross.
+#[derive(serde::Serialize)]
+pub struct GlobalView {
+    pub id:            i64,
+    pub name:          String,
+    /// The catalog entry this instance came from. The UI needs it to tell which
+    /// catalog rows are already enabled — the runtime name can be overridden, so
+    /// matching on `name` alone would miss a renamed one.
+    pub catalog_name:  Option<String>,
+    pub friendly_name: Option<String>,
+    pub description:   Option<String>,
+    pub transport:     String,
+    pub enabled:       bool,
+    /// Whether the caller is actually granted this connector. An admin sees every
+    /// global — including one they enabled for someone else and never granted
+    /// themselves — so this is what separates "I can manage it" from "I can use it".
+    pub can_use:       bool,
+}
+
+/// What the caller can reach or add on the Connectors page: the catalog entries they
+/// may act on, plus the globally-active connectors.
+///
+/// The catalog list mixes both scopes on purpose — enabling a `global` entry is the
+/// admin's counterpart to activating a `per_user` one (§7: one template, two runtimes),
+/// so it is one list with a different verb per row rather than two sections.
+pub async fn available(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+) -> Result<Json<Value>, ApiError> {
+    let user = skald_core::db::users::get(skald.db(), &auth.user_id).await?
+        .ok_or_else(|| ApiError::unauthorized("unknown user"))?;
+    let manages_catalog =
+        role_capabilities::has(skald.db(), &user.role_id, role_capabilities::MANAGE_CATALOG).await?;
+
+    let mut catalog: Vec<_> = mcp_catalog::list_for_scope(skald.db(), "per_user").await?
+        .into_iter()
+        .filter(|e| e.allowed_for_role(&user.role_id))
+        .collect();
+    if manages_catalog {
+        catalog.extend(mcp_catalog::list_for_scope(skald.db(), "global").await?);
+    }
+
+    let granted: std::collections::HashSet<String> =
+        mcp_global_access::server_names_for_user(skald.db(), &auth.user_id).await?
+            .into_iter()
+            .collect();
+
+    let globals: Vec<GlobalView> = mcp_global_servers::all(skald.db()).await?
+        .into_iter()
+        // A catalog manager needs to see globals they cannot themselves use, or an
+        // entry enabled for someone else becomes invisible and unmanageable.
+        .filter(|r| manages_catalog || granted.contains(&r.name))
+        .map(|r| GlobalView {
+            can_use:       granted.contains(&r.name),
+            id:            r.id,
+            name:          r.name,
+            catalog_name:  r.catalog_name,
+            friendly_name: r.friendly_name,
+            description:   r.description,
+            transport:     r.transport,
+            enabled:       r.enabled,
+        })
+        .collect();
+
+    Ok(Json(json!({ "catalog": catalog, "globals": globals })))
+}
+
+/// The connectors this user has already activated (per-user runtime).
+pub async fn activated_list(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+) -> Result<Json<Vec<mcp_user_servers::McpUserServerRow>>, ApiError> {
+    let ctx = require_context(&skald, &auth.user_id).await?;
+    Ok(Json(mcp_user_servers::all(&ctx.pool).await?))
+}
+
+#[derive(Deserialize)]
+pub struct ActivateBody {
+    /// A catalog entry to instantiate (per-user). Omit for a self-registered remote.
+    pub catalog_name: Option<String>,
+    /// Runtime name; defaults to the catalog name. Required for a self-registered remote.
+    pub name:         Option<String>,
+    /// Secrets/env the user supplies for this activation (stored encrypted in {userid}.db).
+    pub env:          Option<HashMap<String, String>>,
+    pub api_key:      Option<String>,
+    // Self-registered remote only:
+    pub url:          Option<String>,
+    #[serde(default = "default_stdio")]
+    pub transport:    String,
+}
+
+pub async fn activate(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Json(body): Json<ActivateBody>,
+) -> Result<Json<Value>, ApiError> {
+    let ctx = require_context(&skald, &auth.user_id).await?;
+    let user = skald_core::db::users::get(skald.db(), &auth.user_id).await?
+        .ok_or_else(|| ApiError::unauthorized("unknown user"))?;
+
+    // Resolve the row to insert from either the catalog or a self-registered remote.
+    let insert = match &body.catalog_name {
+        Some(cat_name) => {
+            let entry = mcp_catalog::get_by_name(skald.db(), cat_name).await?
+                .ok_or_else(|| ApiError::not_found(format!("no catalog entry `{cat_name}`")))?;
+            if entry.scope != "per_user" {
+                return Err(ApiError::bad_request("catalog entry is not a per-user connector"));
+            }
+            if !entry.allowed_for_role(&user.role_id) {
+                return Err(ApiError::forbidden("your role may not activate this connector"));
+            }
+            let cap = if entry.source == "local_script" {
+                role_capabilities::REGISTER_LOCAL_FROM_CATALOG
+            } else {
+                role_capabilities::REGISTER_REMOTE
+            };
+            require_cap(&skald, &auth.user_id, cap).await?;
+
+            let name = body.name.clone().unwrap_or_else(|| entry.name.clone());
+            reject_name_collision(&skald, &ctx.pool, &auth.user_id, &name).await?;
+
+            // For a local script, copy it into the container home and point the
+            // command at the in-container path.
+            let (command, args_json, script_rel_path) = if entry.source == "local_script" {
+                let script = entry.script_path.clone()
+                    .ok_or_else(|| ApiError::bad_request("catalog local_script entry has no script_path"))?;
+                let container_path = copy_script_into_home(&auth.user_id, &name, &script)?;
+                (entry.command.clone(), Some(json!([container_path]).to_string()), Some(container_path))
+            } else {
+                (entry.command.clone(), entry.args_json.clone(), None)
+            };
+
+            mcp_user_servers::insert(&ctx.pool, mcp_user_servers::InsertUserServer {
+                name:            &name,
+                catalog_name:    Some(&entry.name),
+                source:          &entry.source,
+                transport:       &entry.transport,
+                command:         command.as_deref(),
+                args_json,
+                env_json:        body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()).or_else(|| entry.env_json.clone()),
+                url:             entry.url.as_deref(),
+                api_key:         body.api_key.as_deref(),
+                script_rel_path: script_rel_path.as_deref(),
+                auth_state:      "ready",
+            }).await?
+        }
+        None => {
+            // Self-registered remote (egress-only, §14) — needs `register_remote`.
+            require_cap(&skald, &auth.user_id, role_capabilities::REGISTER_REMOTE).await?;
+            let name = body.name.clone()
+                .ok_or_else(|| ApiError::bad_request("a self-registered remote needs a `name`"))?;
+            let url = body.url.clone()
+                .ok_or_else(|| ApiError::bad_request("a self-registered remote needs a `url`"))?;
+            reject_name_collision(&skald, &ctx.pool, &auth.user_id, &name).await?;
+            mcp_user_servers::insert(&ctx.pool, mcp_user_servers::InsertUserServer {
+                name:            &name,
+                catalog_name:    None,
+                source:          "remote",
+                transport:       &body.transport,
+                command:         None,
+                args_json:       None,
+                env_json:        body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()),
+                url:             Some(&url),
+                api_key:         body.api_key.as_deref(),
+                script_rel_path: None,
+                auth_state:      "ready",
+            }).await?
+        }
+    };
+
+    // Start it now in this user's runtime (container transport for stdio).
+    let row = mcp_user_servers::get(&ctx.pool, insert).await?
+        .ok_or_else(|| ApiError::bad_request("user server vanished after insert"))?;
+    let container = skald_core::container::container_name(&auth.user_id);
+    let spec = skald_core::mcp::user_row_spec(&row, &container);
+    match ctx.user_mcp.start_server(spec).await {
+        Ok(tools) => Ok(Json(json!({ "id": insert, "tools": tools }))),
+        Err(e)    => Ok(Json(json!({ "id": insert, "error": e.to_string() }))),
+    }
+}
+
+/// Rejects a per-user connector name that collides with an accessible global one
+/// or an already-activated per-user one — so a bare grant string resolves to
+/// exactly one runtime in `UserMcpView`.
+async fn reject_name_collision(
+    skald:   &Skald,
+    pool:    &sqlx::SqlitePool,
+    user_id: &str,
+    name:    &str,
+) -> Result<(), ApiError> {
+    if mcp_user_servers::get_by_name(pool, name).await?.is_some() {
+        return Err(ApiError::bad_request(format!("a connector named `{name}` is already activated")));
+    }
+    let globals = mcp_global_access::server_names_for_user(skald.db(), user_id).await?;
+    if globals.iter().any(|g| g == name) {
+        return Err(ApiError::bad_request(format!("`{name}` collides with a global connector you can access — choose another name")));
+    }
+    Ok(())
+}
+
+pub async fn deactivate(
+    State(skald): State<Arc<Skald>>,
+    Extension(auth): Extension<AuthUser>,
+    Path(id): Path<i64>,
+) -> Result<Json<Value>, ApiError> {
+    let ctx = require_context(&skald, &auth.user_id).await?;
+    if let Some(row) = mcp_user_servers::get(&ctx.pool, id).await? {
+        ctx.user_mcp.stop_server(&row.name);
+    }
+    mcp_user_servers::delete(&ctx.pool, id).await?;
+    Ok(Json(json!({ "ok": true })))
+}

src/frontend/api/mod.rs

@@ -13,6 +13,7 @@ pub mod image_generate_models;
 pub mod images;
 pub mod inbox;
 pub mod llm;
+pub mod marketplace;
 pub mod mcp;
 pub mod mcp_media;
 pub mod plugins;
@@ -128,8 +129,24 @@ pub fn router() -> Router<Arc<Skald>> {
         .route("/tool-permission-groups/{id}/duplicate",     post(run_context::duplicate_group))
         // Session tool_group assignment (runtime)
         .route("/sessions/{session_id}/run-context", put(run_context::set_session_run_context))
-        // MCP
+        // MCP / Connectors (blueprint §14/§15)
         .route("/mcp/servers",                  get(mcp::list_servers))
+        // admin: the remote marketplace feed (consultative — installing is the
+        // admin's act, and it lands in the catalog below)
+        .route("/mcp/marketplace",              get(marketplace::list))
+        .route("/mcp/marketplace/install",      post(marketplace::install))
+        .route("/mcp/marketplace/{id}/icon",    get(marketplace::icon))
+        // admin: catalog + globally-active connectors
+        .route("/mcp/catalog",                  get(mcp::catalog_list).post(mcp::catalog_upsert))
+        .route("/mcp/catalog/{id}",             delete(mcp::catalog_delete))
+        .route("/mcp/global",                   get(mcp::global_list).post(mcp::global_enable))
+        .route("/mcp/global/{id}",              delete(mcp::global_delete))
+        .route("/mcp/global/{id}/access",       get(mcp::global_get_access).put(mcp::global_set_access))
+        // user: available catalog + per-user activation
+        .route("/mcp/available",                get(mcp::available))
+        .route("/mcp/activate",                 post(mcp::activate))
+        .route("/mcp/activated",                get(mcp::activated_list))
+        .route("/mcp/activated/{id}",           delete(mcp::deactivate))
         // Dev / debug
         .route("/dev/debug_mode",               get(dev::get_debug_mode).post(dev::set_debug_mode).put(dev::set_debug_mode))
         .route("/dev/llm-requests",             get(dev::list_llm_requests))
@@ -179,6 +196,10 @@ impl ApiError {
     pub fn unauthorized(msg: impl Into<String>) -> Self {
         Self { status: StatusCode::UNAUTHORIZED, message: msg.into() }
     }
+
+    pub fn forbidden(msg: impl Into<String>) -> Self {
+        Self { status: StatusCode::FORBIDDEN, message: msg.into() }
+    }
 }
 
 /// Resolves the authenticated caller's per-user runtime context, or `401` when the

src/frontend/api/roles.rs

@@ -34,6 +34,10 @@ pub async fn create(
     }
     roles::insert(skald.db(), id, body.label.trim(), &body.permission_group, body.attrs.as_deref())
         .await?;
+    // Seed the standard self-service Connector capabilities (§14): a new role can
+    // register remote MCPs and activate vetted catalog scripts, but not add new
+    // local scripts or manage the catalog (admin-only).
+    skald_core::db::role_capabilities::seed_defaults(skald.db(), id).await?;
     let role = roles::get(skald.db(), id).await?.ok_or_else(|| ApiError::not_found("role not found after insert"))?;
     Ok(Json(role))
 }

src/frontend/config.rs

@@ -1,9 +1,10 @@
-use crate::config::{ServerConfig, WebConfig};
+use crate::config::{MarketplaceConfig, ServerConfig, WebConfig};
 
 /// Web frontend config — passed to `WebFrontend::new()`.
 /// Derived from `Config` via `Config::into_split()`.
 pub struct FrontendConfig {
     pub server:      ServerConfig,
     pub web:         WebConfig,
+    pub marketplace: MarketplaceConfig,
     pub timezone:    Option<String>,
 }

src/frontend/mod.rs

@@ -22,6 +22,10 @@ pub struct WebFrontend {
 
 impl WebFrontend {
     pub fn new(skald: Arc<Skald>, db: Arc<SqlitePool>, config: &FrontendConfig) -> Self {
+        // The marketplace client reads its feed URL from a process-wide slot: the
+        // API handlers only carry `State<Arc<Skald>>`, and the feed is a frontend
+        // concern the core has no business knowing about.
+        api::marketplace::set_feed_url(config.marketplace.url.clone());
         Self {
             port:       config.server.port,
             static_dir: config.web.static_dir.clone(),

web/app.js

@@ -11,6 +11,9 @@ import { TasksPage }         from './components/tasks/index.js';
 import { AgentsPage }         from './components/agents.js';
 import { UsersPage }          from './components/users-page.js';
 import { RolesPage }          from './components/roles-page.js';
+import { ConnectorsPage }     from './components/connectors.js';
+import { MarketplacePage }    from './components/marketplace.js';
+import { CatalogPage }        from './components/catalog.js';
 import { ProfilePage }        from './components/profile-page.js';
 import { ApprovalGroupsPage } from './components/approval-groups.js';
 import { ApprovalRulesPage }  from './components/approval-rules.js';
@@ -42,6 +45,9 @@ customElements.define('tasks-page',            TasksPage);
 customElements.define('agents-page',          AgentsPage);
 customElements.define('users-page',           UsersPage);
 customElements.define('roles-page',           RolesPage);
+customElements.define('connectors-page',      ConnectorsPage);
+customElements.define('marketplace-page',     MarketplacePage);
+customElements.define('catalog-page',         CatalogPage);
 customElements.define('profile-page',         ProfilePage);
 customElements.define('approval-groups-page', ApprovalGroupsPage);
 customElements.define('approval-rules-page',  ApprovalRulesPage);

web/components/catalog.js

@@ -0,0 +1,321 @@
+import { html, nothing } from 'lit';
+import { LightElement } from '../lib/base.js';
+
+// Connector catalog — blueprint §14/§15. Admin only.
+//
+// One question: **what does this box offer?** The catalog is the shelf; nothing here
+// is running. A `global` entry still needs the admin to enable it and a `per_user`
+// one still needs each user to activate it — both of which happen on the Connectors
+// page, where the runtime lives.
+//
+// Adding is one intent with two sources, so it is one button with two options rather
+// than two distant affordances. Their order mirrors the trust model (§14): the
+// marketplace path is vetted and hash-verified, the manual path is the escape hatch
+// that puts unvetted code on the box — which is why it needs `mcp.register_local_script`
+// and why it sits second.
+//
+// Reuses the shared `um-*` / bootstrap styling (no page-specific CSS).
+
+const ADMIN_ID = 'admin';
+
+async function jf(url, opts) {
+  const res = await fetch(url, opts);
+  if (!res.ok) throw new Error(await res.text() || `HTTP ${res.status}`);
+  const ct = res.headers.get('content-type') || '';
+  return ct.includes('application/json') ? res.json() : null;
+}
+
+export class CatalogPage extends LightElement {
+
+  static get properties() {
+    return {
+      _open:    { state: true },
+      _me:      { state: true },
+      _rows:    { state: true },
+      _addOpen: { state: true },   // the "Add connector" chooser
+      _error:   { state: true },
+      _modal:   { state: true },
+    };
+  }
+
+  constructor() {
+    super();
+    this._open = false;
+    this._reset();
+  }
+
+  _reset() {
+    this._me = null;
+    this._rows = null;
+    this._addOpen = false;
+    this._error = null;
+    this._modal = null;
+  }
+
+  connectedCallback() {
+    super.connectedCallback();
+    window.addEventListener('llm-page-change', (e) => {
+      this._open = e.detail.page === 'catalog';
+      this.style.display = this._open ? 'flex' : 'none';
+      if (this._open) this._load();
+    });
+    // Close the chooser when clicking anywhere else.
+    document.addEventListener('click', () => { if (this._addOpen) this._addOpen = false; });
+  }
+
+  get _isAdmin() { return this._me?.role_id === ADMIN_ID; }
+
+  async _load() {
+    this._error = null;
+    try {
+      this._me = await jf('/api/auth/me');
+      if (!this._isAdmin) return;
+      this._rows = await jf('/api/mcp/catalog');
+    } catch (e) {
+      this._error = e.message;
+    }
+  }
+
+  _goMarketplace() {
+    this._addOpen = false;
+    history.pushState({ page: 'marketplace' }, '', '#marketplace');
+    window.dispatchEvent(new CustomEvent('llm-page-change', { detail: { page: 'marketplace' } }));
+  }
+
+  _goConnectors() {
+    history.pushState({ page: 'connectors' }, '', '#connectors');
+    window.dispatchEvent(new CustomEvent('llm-page-change', { detail: { page: 'connectors' } }));
+  }
+
+  // ── Manual entry ───────────────────────────────────────────────────────────
+
+  _openManual() {
+    this._addOpen = false;
+    this._modal = {
+      form: {
+        name: '', scope: 'per_user', source: 'remote', transport: 'stdio',
+        command: '', args: '', url: '', script_path: '', config_schema: '',
+        auth_kind: 'none', friendly_name: '', description: '',
+      },
+    };
+  }
+
+  _patch(field, value) {
+    this._modal = { ...this._modal, form: { ...this._modal.form, [field]: value } };
+  }
+
+  _closeModal() { this._modal = null; this._error = null; }
+
+  async _saveManual() {
+    const f = this._modal.form;
+    if (!f.name.trim()) { this._error = 'Name is required.'; return; }
+    const listField = (s) => s.split(/[\n,]/).map(x => x.trim()).filter(Boolean);
+    try {
+      await jf('/api/mcp/catalog', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          name: f.name.trim(),
+          scope: f.scope,
+          source: f.source,
+          transport: f.transport,
+          command: f.command.trim() || null,
+          args: f.args.trim() ? listField(f.args) : null,
+          url: f.url.trim() || null,
+          script_path: f.script_path.trim() || null,
+          config_schema: f.config_schema.trim() ? listField(f.config_schema) : null,
+          auth_kind: f.auth_kind,
+          friendly_name: f.friendly_name.trim() || null,
+          description: f.description.trim() || null,
+        }),
+      });
+      this._closeModal();
+      await this._load();
+    } catch (e) { this._error = e.message; }
+  }
+
+  async _delete(row) {
+    if (!confirm(`Remove "${row.name}" from the catalog?\n\nAnything already activated from it keeps running.`)) return;
+    try {
+      await jf(`/api/mcp/catalog/${row.id}`, { method: 'DELETE' });
+      await this._load();
+    } catch (e) { this._error = e.message; }
+  }
+
+  // ── Render ─────────────────────────────────────────────────────────────────
+
+  render() {
+    if (!this._open) return nothing;
+    const rows = this._rows ?? [];
+    const loading = this._rows === null && !this._error && this._isAdmin;
+
+    return html`
+      <div class="um-page">
+        <div class="um-header">
+          <h2 class="um-title"><i class="bi bi-journal-text me-2"></i>Connector Catalog</h2>
+          <div class="um-header-right">
+            ${this._isAdmin ? this._renderAddButton() : nothing}
+          </div>
+        </div>
+
+        ${this._error && !this._modal ? html`
+          <div class="alert alert-danger py-2 mx-4" style="font-size:.85rem">${this._error}</div>` : nothing}
+
+        <div style="padding:0 1.25rem 1.5rem; overflow:auto">
+          ${this._me && !this._isAdmin ? html`
+            <div class="um-empty" style="padding:2rem">
+              <i class="bi bi-shield-lock"></i>
+              <p>The catalog is managed by the admin.</p>
+              <p style="font-size:.8rem;opacity:.7">
+                What you can activate is on the
+                <a href="#connectors" @click=${(e) => { e.preventDefault(); this._goConnectors(); }}>Connectors</a> page.
+              </p>
+            </div>
+          ` : loading ? html`
+            <div class="um-empty" style="padding:1rem"><i class="bi bi-hourglass-split"></i><p>Loading…</p></div>
+          ` : html`
+            <div class="text-muted mt-3 mb-3" style="font-size:.8rem">
+              What this box offers. Nothing here is running — a global entry still needs
+              enabling, a per-user one still needs each user to activate it, both on the
+              <a href="#connectors" @click=${(e) => { e.preventDefault(); this._goConnectors(); }}>Connectors</a> page.
+            </div>
+            ${rows.length === 0 ? this._renderEmpty() : this._renderTable(rows)}
+          `}
+        </div>
+      </div>
+      ${this._renderModal()}`;
+  }
+
+  // Bootstrap's own dropdown classes, not a hand-rolled panel: 5.3 themes
+  // `.dropdown-menu`/`.dropdown-item` from `data-bs-theme`, so this follows the
+  // light/dark switch for free. `.show` opens it — the state is ours, not
+  // Bootstrap's JS.
+  _renderAddButton() {
+    return html`
+      <div class="dropdown" style="position:relative" @click=${(e) => e.stopPropagation()}>
+        <button class="btn btn-sm btn-primary" @click=${() => { this._addOpen = !this._addOpen; }}>
+          <i class="bi bi-plus-lg me-1"></i>Add connector
+          <i class="bi bi-chevron-down ms-1" style="font-size:.7rem"></i>
+        </button>
+        ${this._addOpen ? html`
+          <div class="dropdown-menu show" style="right:0;left:auto;top:calc(100% + .25rem);min-width:280px">
+            <button class="dropdown-item" style="white-space:normal" @click=${() => this._goMarketplace()}>
+              <div style="display:flex;align-items:center;gap:.5rem">
+                <i class="bi bi-shop"></i><strong style="font-size:.85rem">From the marketplace</strong>
+              </div>
+              <div class="text-muted" style="font-size:.7rem;margin-top:.15rem">
+                Vetted connectors, files verified by SHA-256.
+              </div>
+            </button>
+            <div class="dropdown-divider"></div>
+            <button class="dropdown-item" style="white-space:normal" @click=${() => this._openManual()}>
+              <div style="display:flex;align-items:center;gap:.5rem">
+                <i class="bi bi-pencil"></i><strong style="font-size:.85rem">Manually</strong>
+              </div>
+              <div class="text-muted" style="font-size:.7rem;margin-top:.15rem">
+                You supply the config, and vouch for it yourself.
+              </div>
+            </button>
+          </div>` : nothing}
+      </div>`;
+  }
+
+  _renderEmpty() {
+    return html`
+      <div class="um-empty" style="padding:2rem">
+        <i class="bi bi-journal"></i>
+        <p>The catalog is empty.</p>
+        <p style="font-size:.8rem;opacity:.7">Add a connector from the marketplace to get started.</p>
+        <button class="btn btn-sm btn-primary mt-2" @click=${() => this._goMarketplace()}>
+          <i class="bi bi-shop me-1"></i>Browse the marketplace
+        </button>
+      </div>`;
+  }
+
+  _renderTable(rows) {
+    return html`
+      <table class="um-table">
+        <thead><tr><th>Connector</th><th>Scope</th><th>Type</th><th>Auth</th><th></th></tr></thead>
+        <tbody>
+          ${rows.map(r => html`
+            <tr>
+              <td>
+                <strong>${r.friendly_name || r.name}</strong>
+                ${r.friendly_name ? html` <code class="text-muted" style="font-size:.7rem">${r.name}</code>` : nothing}
+                ${r.description ? html`
+                  <div class="text-muted" style="font-size:.75rem;max-width:44ch;overflow:hidden;
+                              text-overflow:ellipsis;white-space:nowrap" title=${r.description}>${r.description}</div>` : nothing}
+              </td>
+              <td><span class="badge ${r.scope === 'global' ? 'bg-info' : 'bg-secondary'}" style="font-size:.65rem">
+                ${r.scope === 'global' ? 'global' : 'per-user'}</span></td>
+              <td><span class="badge ${r.source === 'local_script' ? 'bg-warning text-dark' : 'bg-secondary'}" style="font-size:.65rem">
+                ${r.source === 'local_script' ? 'local script' : 'remote'}</span></td>
+              <td><span class="text-muted" style="font-size:.78rem">${r.auth_kind}</span></td>
+              <td><div class="um-actions">
+                <button class="um-btn-icon" title="Remove from catalog" @click=${() => this._delete(r)}>
+                  <i class="bi bi-trash"></i></button>
+              </div></td>
+            </tr>`)}
+        </tbody>
+      </table>`;
+  }
+
+  _field(label, value, oninput, opts = {}) {
+    return html`<div class="mb-3">
+      <label class="form-label">${label}${opts.hint ? html` <span class="text-muted">(${opts.hint})</span>` : nothing}</label>
+      <input class="form-control ${opts.mono ? 'font-monospace' : ''}" type=${opts.type || 'text'}
+        placeholder=${opts.placeholder || ''} .value=${value} @input=${oninput} />
+    </div>`;
+  }
+
+  _select(label, value, options, onchange) {
+    return html`<div class="mb-3">
+      <label class="form-label">${label}</label>
+      <select class="form-select" @change=${onchange}>
+        ${options.map(o => html`<option value=${o} ?selected=${value === o}>${o}</option>`)}
+      </select>
+    </div>`;
+  }
+
+  _renderModal() {
+    if (!this._modal) return nothing;
+    const f = this._modal.form;
+    const isScript = f.source === 'local_script';
+    return html`
+      <div class="um-modal-overlay" @click=${(e) => { if (e.target.classList.contains('um-modal-overlay')) this._closeModal(); }}>
+        <div class="um-modal">
+          <div class="um-modal-header">
+            <i class="bi bi-pencil"></i><span>Add connector manually</span>
+            <button class="um-btn-icon ms-auto" @click=${() => this._closeModal()}><i class="bi bi-x-lg"></i></button>
+          </div>
+          <div class="um-modal-body">
+            ${this._error ? html`<div class="alert alert-danger py-2 mb-3" style="font-size:.85rem">${this._error}</div>` : nothing}
+            ${isScript ? html`
+              <div class="alert alert-warning py-2 mb-3" style="font-size:.78rem">
+                <i class="bi bi-exclamation-triangle me-1"></i>A local script runs code on this box.
+                Nothing verifies it — unlike the marketplace path, there is no digest to check.
+              </div>` : nothing}
+            ${this._field('Name', f.name, e => this._patch('name', e.target.value), { hint: 'slug', mono: true })}
+            ${this._select('Scope', f.scope, ['per_user', 'global'], e => this._patch('scope', e.target.value))}
+            ${this._select('Type', f.source, ['remote', 'local_script'], e => this._patch('source', e.target.value))}
+            ${this._select('Transport', f.transport, ['stdio', 'http', 'sse'], e => this._patch('transport', e.target.value))}
+            ${isScript
+              ? html`${this._field('Command', f.command, e => this._patch('command', e.target.value), { placeholder: 'python3', mono: true })}
+                     ${this._field('Script path', f.script_path, e => this._patch('script_path', e.target.value), { hint: 'under ./scripts', mono: true })}`
+              : this._field('URL', f.url, e => this._patch('url', e.target.value), { mono: true })}
+            ${this._field('Args', f.args, e => this._patch('args', e.target.value), { hint: 'one per line', mono: true })}
+            ${this._field('Required secret/env keys', f.config_schema, e => this._patch('config_schema', e.target.value), { hint: 'comma/newline', mono: true })}
+            ${this._select('Auth', f.auth_kind, ['none', 'api_key', 'oauth', 'qr', 'ssh_key'], e => this._patch('auth_kind', e.target.value))}
+            ${this._field('Friendly name', f.friendly_name, e => this._patch('friendly_name', e.target.value))}
+            ${this._field('Description', f.description, e => this._patch('description', e.target.value),
+                { hint: 'the LLM reads this when deciding to activate the connector' })}
+          </div>
+          <div class="um-modal-footer">
+            <button class="btn btn-sm btn-outline-secondary" @click=${() => this._closeModal()}>Cancel</button>
+            <button class="btn btn-sm btn-primary" @click=${() => this._saveManual()}>
+              <i class="bi bi-check-lg me-1"></i>Add to catalog</button>
+          </div>
+        </div>
+      </div>`;
+  }
+}

web/components/connectors.js

@@ -0,0 +1,449 @@
+import { html, nothing } from 'lit';
+import { LightElement } from '../lib/base.js';
+
+// Connectors (MCP) — blueprint §7/§14/§15.
+//
+// One question: **what is running, and what can I add?** This is the runtime view —
+// literally `UserMcpView` (global ∪ per-user) plus the actions that create those
+// instances. What this box *offers* is a different question, answered by the
+// Connector Catalog page.
+//
+// The same page serves everyone; the admin just has more verbs. A catalog entry is a
+// template with two runtimes (§7), so "Available" is one list with the verb that fits
+// each row: a `per_user` entry says Activate (anyone), a `global` entry says Enable
+// globally (admin only). Enabling a global is the admin's counterpart to activating a
+// per-user one — which is why they live side by side instead of in an admin dungeon.
+//
+// Reuses the shared `um-*` / bootstrap styling (no page-specific CSS).
+
+const ADMIN_ID = 'admin';
+
+function parseJson(s, fallback) {
+  if (!s) return fallback;
+  try { return JSON.parse(s); } catch { return fallback; }
+}
+
+async function jf(url, opts) {
+  const res = await fetch(url, opts);
+  if (!res.ok) throw new Error(await res.text() || `HTTP ${res.status}`);
+  const ct = res.headers.get('content-type') || '';
+  return ct.includes('application/json') ? res.json() : null;
+}
+
+export class ConnectorsPage extends LightElement {
+
+  static get properties() {
+    return {
+      _open:      { state: true },
+      _me:        { state: true },   // { role_id }
+      _available: { state: true },   // { catalog: [...], globals: [...] }
+      _activated: { state: true },   // my per-user server rows
+      _users:     { state: true },   // admin: user summaries (for the access modal)
+      _error:     { state: true },
+      _modal:     { state: true },
+    };
+  }
+
+  constructor() {
+    super();
+    this._open = false;
+    this._reset();
+  }
+
+  _reset() {
+    this._me = null;
+    this._available = null;
+    this._activated = null;
+    this._users = null;
+    this._error = null;
+    this._modal = null;
+  }
+
+  connectedCallback() {
+    super.connectedCallback();
+    window.addEventListener('llm-page-change', (e) => {
+      this._open = e.detail.page === 'connectors';
+      this.style.display = this._open ? 'flex' : 'none';
+      if (this._open) this._load();
+    });
+  }
+
+  get _isAdmin() { return this._me?.role_id === ADMIN_ID; }
+
+  async _load() {
+    this._error = null;
+    try {
+      this._me = await jf('/api/auth/me');
+      const [available, activated] = await Promise.all([
+        jf('/api/mcp/available'),
+        jf('/api/mcp/activated'),
+      ]);
+      this._available = available;
+      this._activated = activated;
+      // Only the access modal needs the user list, and only an admin opens it.
+      if (this._isAdmin) this._users = await jf('/api/users');
+    } catch (e) {
+      this._error = e.message;
+    }
+  }
+
+  _patch(field, value) {
+    this._modal = { ...this._modal, form: { ...this._modal.form, [field]: value } };
+  }
+
+  _closeModal() { this._modal = null; this._error = null; }
+
+  _goCatalog() {
+    history.pushState({ page: 'catalog' }, '', '#catalog');
+    window.dispatchEvent(new CustomEvent('llm-page-change', { detail: { page: 'catalog' } }));
+  }
+
+  // ── Activate a per-user connector ──────────────────────────────────────────
+
+  _openActivate(entry) {
+    const schema = parseJson(entry.config_schema_json, []) || [];
+    this._modal = {
+      kind: 'activate',
+      entry,
+      form: { name: entry.name, api_key: '', env: Object.fromEntries(schema.map(k => [k, ''])) },
+    };
+  }
+
+  async _activate() {
+    const { entry, form } = this._modal;
+    if (!form.name.trim()) { this._error = 'A name is required.'; return; }
+    const env = {};
+    for (const [k, v] of Object.entries(form.env || {})) if (v !== '') env[k] = v;
+    try {
+      await jf('/api/mcp/activate', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          catalog_name: entry.name,
+          name: form.name.trim(),
+          api_key: form.api_key || null,
+          env: Object.keys(env).length ? env : null,
+        }),
+      });
+      this._closeModal();
+      await this._load();
+    } catch (e) { this._error = e.message; }
+  }
+
+  async _deactivate(row) {
+    if (!confirm(`Deactivate connector "${row.name}"?`)) return;
+    try {
+      await jf(`/api/mcp/activated/${row.id}`, { method: 'DELETE' });
+      await this._load();
+    } catch (e) { this._error = e.message; }
+  }
+
+  // ── Enable a global connector (admin) ──────────────────────────────────────
+
+  // The entry comes from the row the admin clicked, so there is no catalog picker:
+  // the old dropdown existed only because this action lived on a page that did not
+  // show the catalog.
+  _openEnableGlobal(entry) {
+    this._modal = {
+      kind: 'global',
+      entry,
+      form: { name: entry.name, api_key: '' },
+    };
+  }
+
+  async _enableGlobal() {
+    const { entry, form } = this._modal;
+    try {
+      await jf('/api/mcp/global', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          catalog_name: entry.name,
+          name: form.name.trim() || null,
+          api_key: form.api_key || null,
+        }),
+      });
+      this._closeModal();
+      await this._load();
+    } catch (e) { this._error = e.message; }
+  }
+
+  async _deleteGlobal(row) {
+    if (!confirm(`Disable global connector "${row.name}"?\n\nIt stops for everyone who can use it.`)) return;
+    try {
+      await jf(`/api/mcp/global/${row.id}`, { method: 'DELETE' });
+      await this._load();
+    } catch (e) { this._error = e.message; }
+  }
+
+  async _openAccess(server) {
+    this._modal = { kind: 'access', server, selected: new Set() };
+    try {
+      const current = await jf(`/api/mcp/global/${server.id}/access`);
+      // Ignore if the admin already navigated away / opened another modal.
+      if (this._modal?.kind === 'access' && this._modal.server.id === server.id) {
+        this._modal = { ...this._modal, selected: new Set(current || []) };
+      }
+    } catch (e) { this._error = e.message; }
+  }
+
+  _toggleAccess(userId) {
+    const sel = new Set(this._modal.selected);
+    sel.has(userId) ? sel.delete(userId) : sel.add(userId);
+    this._modal = { ...this._modal, selected: sel };
+  }
+
+  async _saveAccess() {
+    const { server, selected } = this._modal;
+    try {
+      await jf(`/api/mcp/global/${server.id}/access`, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ user_ids: [...selected] }),
+      });
+      this._closeModal();
+      await this._load();
+    } catch (e) { this._error = e.message; }
+  }
+
+  // ── Render ─────────────────────────────────────────────────────────────────
+
+  render() {
+    if (!this._open) return nothing;
+    const loading = this._available === null && !this._error;
+
+    return html`
+      <div class="um-page">
+        <div class="um-header">
+          <h2 class="um-title"><i class="bi bi-plug me-2"></i>Connectors</h2>
+          <div class="um-header-right">
+            ${this._isAdmin ? html`
+              <button class="btn btn-sm btn-outline-secondary" @click=${() => this._goCatalog()}>
+                <i class="bi bi-journal-text me-1"></i>Catalog
+              </button>` : nothing}
+          </div>
+        </div>
+
+        ${this._error && !this._modal ? html`
+          <div class="alert alert-danger py-2 mx-4" style="font-size:.85rem">${this._error}</div>` : nothing}
+
+        ${loading ? html`<div class="um-empty"><i class="bi bi-hourglass-split"></i> Loading…</div>` : html`
+          <div style="padding:0 1.25rem 1.5rem; overflow:auto">
+            ${this._renderMine()}
+            ${this._renderGlobals()}
+            ${this._renderAvailable()}
+          </div>`}
+      </div>
+      ${this._renderModal()}`;
+  }
+
+  _section(title, icon, right, body) {
+    return html`
+      <div style="margin-top:1.5rem">
+        <div class="um-header" style="padding:0 0 .5rem">
+          <h3 class="um-title" style="font-size:1rem"><i class="bi ${icon} me-2"></i>${title}</h3>
+          <div class="um-header-right">${right ?? nothing}</div>
+        </div>
+        ${body}
+      </div>`;
+  }
+
+  _renderMine() {
+    const rows = this._activated ?? [];
+    return this._section('My connectors', 'bi-check2-circle', nothing,
+      rows.length === 0
+        ? html`<div class="um-empty" style="padding:1rem"><i class="bi bi-plug"></i>
+                 <p>No per-user connectors activated.</p></div>`
+        : html`
+          <table class="um-table">
+            <thead><tr><th>Name</th><th>Type</th><th>From catalog</th><th></th></tr></thead>
+            <tbody>
+              ${rows.map(r => html`
+                <tr>
+                  <td><strong>${r.name}</strong></td>
+                  <td><span class="badge ${r.source === 'local_script' ? 'bg-warning text-dark' : 'bg-secondary'}"
+                        style="font-size:.65rem">${r.source === 'local_script' ? 'local script' : 'remote'}</span></td>
+                  <td>${r.catalog_name ? html`<code>${r.catalog_name}</code>` : html`<span class="text-muted">—</span>`}</td>
+                  <td><div class="um-actions">
+                    <button class="um-btn-icon" title="Deactivate" @click=${() => this._deactivate(r)}>
+                      <i class="bi bi-trash"></i></button>
+                  </div></td>
+                </tr>`)}
+            </tbody>
+          </table>`);
+  }
+
+  _renderGlobals() {
+    const rows = this._available?.globals ?? [];
+    if (rows.length === 0 && !this._isAdmin) return nothing;
+    return this._section('Global connectors', 'bi-globe', nothing,
+      rows.length === 0
+        ? html`<div class="um-empty" style="padding:1rem"><i class="bi bi-globe"></i>
+                 <p>None enabled. Enable one from Available below.</p></div>`
+        : html`
+          ${this._isAdmin ? html`
+            <div class="text-muted mb-2" style="font-size:.75rem">
+              Shared by the household. You see every one so you can manage it —
+              <span class="badge bg-success" style="font-size:.6rem">yours</span> marks the ones granted to you.
+            </div>` : nothing}
+          <table class="um-table">
+            <thead><tr><th>Name</th><th>Transport</th><th>Status</th><th></th></tr></thead>
+            <tbody>
+              ${rows.map(g => html`
+                <tr>
+                  <td>
+                    <strong>${g.friendly_name || g.name}</strong>
+                    ${this._isAdmin && g.can_use ? html`
+                      <span class="badge bg-success ms-1" style="font-size:.6rem">yours</span>` : nothing}
+                    ${g.description ? html`
+                      <div class="text-muted" style="font-size:.75rem;max-width:44ch;overflow:hidden;
+                                  text-overflow:ellipsis;white-space:nowrap" title=${g.description}>${g.description}</div>` : nothing}
+                  </td>
+                  <td><span class="text-muted" style="font-size:.78rem">${g.transport}</span></td>
+                  <td>${g.enabled
+                    ? html`<span class="badge bg-success" style="font-size:.65rem">on</span>`
+                    : html`<span class="badge bg-secondary" style="font-size:.65rem">off</span>`}</td>
+                  <td><div class="um-actions">
+                    ${this._isAdmin ? html`
+                      <button class="um-btn-icon" title="Manage access" @click=${() => this._openAccess(g)}>
+                        <i class="bi bi-people"></i></button>
+                      <button class="um-btn-icon" title="Disable" @click=${() => this._deleteGlobal(g)}>
+                        <i class="bi bi-trash"></i></button>
+                    ` : nothing}
+                  </div></td>
+                </tr>`)}
+            </tbody>
+          </table>`);
+  }
+
+  _renderAvailable() {
+    const entries = this._available?.catalog ?? [];
+    const enabledGlobals = new Set((this._available?.globals ?? []).map(g => g.catalog_name ?? g.name));
+    const activatedNames = new Set((this._activated ?? []).map(r => r.catalog_name));
+
+    const right = this._isAdmin ? html`
+      <button class="btn btn-sm btn-outline-secondary" @click=${() => this._goCatalog()}>
+        <i class="bi bi-plus-lg me-1"></i>Add to catalog
+      </button>` : nothing;
+
+    if (entries.length === 0) {
+      return this._section('Available', 'bi-plus-square', right, html`
+        <div class="um-empty" style="padding:1rem"><i class="bi bi-journal"></i>
+          <p>${this._isAdmin ? 'The catalog is empty.' : 'Nothing available to you yet.'}</p>
+          ${this._isAdmin ? html`
+            <p style="font-size:.8rem;opacity:.7">Add connectors to the catalog first.</p>` : nothing}
+        </div>`);
+    }
+
+    return this._section('Available', 'bi-plus-square', right, html`
+      <table class="um-table">
+        <thead><tr><th>Connector</th><th>Scope</th><th>Auth</th><th></th></tr></thead>
+        <tbody>
+          ${entries.map(e => {
+            const isGlobal = e.scope === 'global';
+            const already = isGlobal ? enabledGlobals.has(e.name) : activatedNames.has(e.name);
+            return html`
+              <tr>
+                <td><strong>${e.friendly_name || e.name}</strong>
+                  ${e.description ? html`
+                    <div class="text-muted" style="font-size:.75rem;max-width:44ch;overflow:hidden;
+                                text-overflow:ellipsis;white-space:nowrap" title=${e.description}>${e.description}</div>` : nothing}</td>
+                <td><span class="badge ${isGlobal ? 'bg-info' : 'bg-secondary'}" style="font-size:.65rem">
+                  ${isGlobal ? 'global' : 'per-user'}</span></td>
+                <td><span class="text-muted" style="font-size:.78rem">${e.auth_kind}</span></td>
+                <td><div class="um-actions">
+                  ${already
+                    ? html`<span class="badge bg-success">${isGlobal ? 'enabled' : 'active'}</span>`
+                    : isGlobal
+                      ? html`<button class="btn btn-sm btn-primary" @click=${() => this._openEnableGlobal(e)}>
+                               <i class="bi bi-globe me-1"></i>Enable globally</button>`
+                      : html`<button class="btn btn-sm btn-primary" @click=${() => this._openActivate(e)}>
+                               <i class="bi bi-plug me-1"></i>Activate</button>`}
+                </div></td>
+              </tr>`;
+          })}
+        </tbody>
+      </table>`);
+  }
+
+  // ── Modals ─────────────────────────────────────────────────────────────────
+
+  _modalShell(title, icon, body, onSave, saveLabel) {
+    return html`
+      <div class="um-modal-overlay" @click=${(e) => { if (e.target.classList.contains('um-modal-overlay')) this._closeModal(); }}>
+        <div class="um-modal">
+          <div class="um-modal-header">
+            <i class="bi ${icon}"></i><span>${title}</span>
+            <button class="um-btn-icon ms-auto" @click=${() => this._closeModal()}><i class="bi bi-x-lg"></i></button>
+          </div>
+          <div class="um-modal-body">
+            ${this._error ? html`<div class="alert alert-danger py-2 mb-3" style="font-size:.85rem">${this._error}</div>` : nothing}
+            ${body}
+          </div>
+          <div class="um-modal-footer">
+            <button class="btn btn-sm btn-outline-secondary" @click=${() => this._closeModal()}>Cancel</button>
+            <button class="btn btn-sm btn-primary" @click=${onSave}><i class="bi bi-check-lg me-1"></i>${saveLabel}</button>
+          </div>
+        </div>
+      </div>`;
+  }
+
+  _field(label, value, oninput, opts = {}) {
+    return html`<div class="mb-3">
+      <label class="form-label">${label}${opts.hint ? html` <span class="text-muted">(${opts.hint})</span>` : nothing}</label>
+      <input class="form-control ${opts.mono ? 'font-monospace' : ''}" type=${opts.type || 'text'}
+        placeholder=${opts.placeholder || ''} .value=${value} @input=${oninput} />
+    </div>`;
+  }
+
+  _renderModal() {
+    if (!this._modal) return nothing;
+    const m = this._modal;
+
+    if (m.kind === 'activate') {
+      const f = m.form;
+      const schema = parseJson(m.entry.config_schema_json, []) || [];
+      return this._modalShell(`Activate ${m.entry.friendly_name || m.entry.name}`, 'bi-plug', html`
+        ${this._field('Name', f.name, e => this._patch('name', e.target.value), { hint: 'unique for you', mono: true })}
+        ${m.entry.auth_kind === 'api_key' ? this._field('API key', f.api_key, e => this._patch('api_key', e.target.value), { type: 'password', mono: true }) : nothing}
+        ${m.entry.auth_kind === 'oauth' ? html`
+          <div class="alert alert-warning py-2" style="font-size:.78rem">
+            <i class="bi bi-exclamation-triangle me-1"></i>This connector needs an interactive login,
+            which is not wired up yet — it will activate but cannot authenticate.
+          </div>` : nothing}
+        ${schema.map(k => html`<div class="mb-3">
+          <label class="form-label font-monospace" style="font-size:.8rem">${k}</label>
+          <input class="form-control font-monospace" .value=${f.env[k] ?? ''}
+            @input=${e => this._patch('env', { ...f.env, [k]: e.target.value })} />
+        </div>`)}
+      `, () => this._activate(), 'Activate');
+    }
+
+    if (m.kind === 'global') {
+      const f = m.form;
+      return this._modalShell(`Enable ${m.entry.friendly_name || m.entry.name} globally`, 'bi-globe', html`
+        <div class="text-muted mb-3" style="font-size:.78rem">
+          Runs once for the household on the host. Nobody reaches it until you grant access.
+        </div>
+        ${this._field('Name', f.name, e => this._patch('name', e.target.value), { hint: 'runtime name', mono: true })}
+        ${m.entry.auth_kind === 'api_key'
+          ? this._field('API key', f.api_key, e => this._patch('api_key', e.target.value), { type: 'password', mono: true })
+          : nothing}
+      `, () => this._enableGlobal(), 'Enable');
+    }
+
+    if (m.kind === 'access') {
+      const users = this._users ?? [];
+      return this._modalShell(`Access — ${m.server.name}`, 'bi-people', html`
+        <div class="text-muted mb-2" style="font-size:.8rem">Select who may use this global connector. This replaces the current list.</div>
+        ${users.map(u => html`<div class="form-check">
+          <input class="form-check-input" type="checkbox" id=${'acc-' + u.id}
+            .checked=${m.selected.has(u.id)} @change=${() => this._toggleAccess(u.id)} />
+          <label class="form-check-label" for=${'acc-' + u.id}>${u.display_name || u.username} <code class="text-muted">${u.id}</code></label>
+        </div>`)}
+      `, () => this._saveAccess(), 'Save access');
+    }
+
+    return nothing;
+  }
+}

web/components/marketplace.js

@@ -0,0 +1,289 @@
+import { html, nothing } from 'lit';
+import { LightElement } from '../lib/base.js';
+
+// Connector marketplace — blueprint §14/§15.
+//
+// Admin-only: browses the remote feed of vetted connectors and *installs* one into
+// the local catalog. Installing is deliberately not activating — a global entry
+// still needs the admin to enable it with a key, a per-user one still needs each
+// user to activate it from the Connectors page. The feed only ever proposes; the
+// trust anchor stays on this box.
+//
+// Page shell from the shared `um-*` styling; the card grid, chips and filter bar
+// live in `css/connectors.css`. Colours come from the theme's own variables — no
+// literal colour belongs in here.
+
+const ADMIN_ID = 'admin';
+
+async function jf(url, opts) {
+  const res = await fetch(url, opts);
+  if (!res.ok) throw new Error(await res.text() || `HTTP ${res.status}`);
+  const ct = res.headers.get('content-type') || '';
+  return ct.includes('application/json') ? res.json() : null;
+}
+
+export class MarketplacePage extends LightElement {
+
+  static get properties() {
+    return {
+      _open:       { state: true },
+      _me:         { state: true },
+      _cards:      { state: true },
+      _feedErr:    { state: true },   // feed unreachable — scoped, not page-level
+      _error:      { state: true },
+      _q:          { state: true },
+      _scope:      { state: true },   // 'all' | 'per_user' | 'global'
+      _source:     { state: true },   // 'all' | 'remote' | 'local_script'
+      _installing: { state: true },
+    };
+  }
+
+  constructor() {
+    super();
+    this._open = false;
+    this._q = '';
+    this._scope = 'all';
+    this._source = 'all';
+    this._reset();
+  }
+
+  _reset() {
+    this._me = null;
+    this._cards = null;
+    this._feedErr = null;
+    this._error = null;
+    this._installing = null;
+  }
+
+  connectedCallback() {
+    super.connectedCallback();
+    window.addEventListener('llm-page-change', (e) => {
+      this._open = e.detail.page === 'marketplace';
+      this.style.display = this._open ? 'flex' : 'none';
+      if (this._open) this._load();
+    });
+  }
+
+  get _isAdmin() { return this._me?.role_id === ADMIN_ID; }
+
+  async _load() {
+    this._error = null;
+    try {
+      this._me = await jf('/api/auth/me');
+      if (!this._isAdmin) return;
+      await this._loadFeed(false);
+    } catch (e) {
+      this._error = e.message;
+    }
+  }
+
+  async _loadFeed(refresh) {
+    this._feedErr = null;
+    if (refresh) this._cards = null;
+    try {
+      const res = await jf(`/api/mcp/marketplace${refresh ? '?refresh=true' : ''}`);
+      this._cards = res.connectors ?? [];
+    } catch (e) {
+      this._cards = [];
+      this._feedErr = e.message;
+    }
+  }
+
+  async _install(card) {
+    const warn = card.source === 'local_script'
+      ? `\n\nThis puts code on this box:\n  • ${card.file_count} file(s), each verified against its SHA-256\n  • installed into ./scripts/${card.id}/`
+      : '';
+    if (!confirm(`Install "${card.name}" into the catalog?${warn}\n\nInstalling does not activate it.`)) return;
+    this._installing = card.id;
+    this._error = null;
+    try {
+      await jf('/api/mcp/marketplace/install', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ id: card.id }),
+      });
+      await this._loadFeed(false);
+    } catch (e) {
+      this._error = e.message;
+    } finally {
+      this._installing = null;
+    }
+  }
+
+  // Client-side: the feed is small, and one payload keeps typing instant.
+  get _filtered() {
+    const q = this._q.trim().toLowerCase();
+    return (this._cards ?? []).filter((c) => {
+      if (this._scope !== 'all' && c.scope !== this._scope) return false;
+      if (this._source !== 'all' && c.source !== this._source) return false;
+      if (!q) return true;
+      const hay = [c.name, c.id, c.user_description, ...(c.tags ?? []), ...(c.requires ?? [])]
+        .filter(Boolean).join(' ').toLowerCase();
+      return hay.includes(q);
+    });
+  }
+
+  // The marketplace is a destination of the catalog's "Add connector" action, not a
+  // place of its own — so it goes back where it came from.
+  _goCatalog() {
+    history.pushState({ page: 'catalog' }, '', '#catalog');
+    window.dispatchEvent(new CustomEvent('llm-page-change', { detail: { page: 'catalog' } }));
+  }
+
+  render() {
+    if (!this._open) return nothing;
+    const loading = this._cards === null && !this._feedErr && !this._error;
+
+    return html`
+      <div class="um-page">
+        <div class="um-header">
+          <h2 class="um-title"><i class="bi bi-shop me-2"></i>Marketplace</h2>
+          <div class="um-header-right">
+            <button class="btn btn-sm btn-outline-primary" @click=${() => this._goCatalog()}>
+              <i class="bi bi-arrow-left me-1"></i>Catalog
+            </button>
+            ${this._isAdmin ? html`
+              <button class="um-btn-icon ms-1" title="Refetch the feed"
+                @click=${() => this._loadFeed(true)}><i class="bi bi-arrow-clockwise"></i></button>
+            ` : nothing}
+          </div>
+        </div>
+
+        <div style="padding:0 1.25rem 1.5rem; overflow:auto">
+          ${this._error ? html`
+            <div class="alert alert-danger py-2 mt-3" style="font-size:.85rem">${this._error}</div>` : nothing}
+
+          ${this._me && !this._isAdmin ? html`
+            <div class="um-empty" style="padding:2rem">
+              <i class="bi bi-shield-lock"></i>
+              <p>The marketplace is managed by the admin.</p>
+              <p style="font-size:.8rem;opacity:.7">
+                Connectors the admin has installed appear on the
+                <a href="#connectors" @click=${(e) => { e.preventDefault();
+                  history.pushState({ page: 'connectors' }, '', '#connectors');
+                  window.dispatchEvent(new CustomEvent('llm-page-change', { detail: { page: 'connectors' } })); }}>Connectors</a> page.
+              </p>
+            </div>
+          ` : html`
+            <div class="text-muted mt-3 mb-3" style="font-size:.8rem">
+              Vetted connectors you can add to this box's catalog. Installing does not
+              activate anything — it makes a connector <em>available</em>.
+            </div>
+
+            ${this._feedErr ? html`
+              <div class="alert alert-warning py-2" style="font-size:.82rem">
+                <i class="bi bi-wifi-off me-1"></i>Marketplace unreachable — ${this._feedErr}
+              </div>` : nothing}
+
+            ${this._renderFilters()}
+
+            ${loading ? html`<div class="um-empty" style="padding:1rem"><i class="bi bi-hourglass-split"></i><p>Loading feed…</p></div>`
+              : this._renderGrid()}
+          `}
+        </div>
+      </div>`;
+  }
+
+  // A segmented control per axis rather than loose buttons: each row is one choice,
+  // and the grouping says so.
+  _segment(label, current, set, options) {
+    return html`
+      <div class="d-flex align-items-center gap-1">
+        <span class="connector-segment-label">${label}</span>
+        <div class="connector-segment">
+          ${options.map(([text, value]) => html`
+            <button class=${current === value ? 'active' : ''} @click=${() => set(value)}>${text}</button>`)}
+        </div>
+      </div>`;
+  }
+
+  _renderFilters() {
+    return html`
+      <div class="connector-filters">
+        <div class="connector-search">
+          <i class="bi bi-search"></i>
+          <input class="form-control form-control-sm" placeholder="Search connectors…"
+            .value=${this._q} @input=${(e) => { this._q = e.target.value; }} />
+        </div>
+        ${this._segment('Scope', this._scope, (v) => { this._scope = v; },
+          [['All', 'all'], ['Global', 'global'], ['Per-user', 'per_user']])}
+        ${this._segment('Type', this._source, (v) => { this._source = v; },
+          [['All', 'all'], ['Remote', 'remote'], ['Local', 'local_script']])}
+      </div>`;
+  }
+
+  _renderGrid() {
+    const cards = this._filtered;
+    const total = (this._cards ?? []).length;
+    if (cards.length === 0) {
+      return html`
+        <div class="um-empty" style="padding:1rem"><i class="bi bi-search"></i>
+          <p>${total === 0 ? 'The feed is empty.' : 'No connector matches these filters.'}</p></div>`;
+    }
+    return html`
+      <div class="connector-grid">
+        ${cards.map((c) => this._renderCard(c))}
+      </div>`;
+  }
+
+  _renderCard(c) {
+    const busy = this._installing === c.id;
+    const isScript = c.source === 'local_script';
+    // Keywords only. `mcp` is on everything, and scope/type already have their own
+    // chips — repeating them as grey tags is noise.
+    const tags = (c.tags ?? []).filter((t) => !['mcp', 'local', 'remote'].includes(t));
+
+    return html`
+      <div class="connector-card">
+        <div class="connector-card-head">
+          ${c.has_icon
+            ? html`<img class="connector-card-icon" src=${`/api/mcp/marketplace/${c.id}/icon?size=sm`} alt="" />`
+            : html`<div class="connector-card-icon connector-card-icon--empty"><i class="bi bi-plug"></i></div>`}
+          <div class="connector-card-title">
+            <div class="connector-card-name">${c.name}</div>
+            <div class="connector-card-sub">${c.id}${c.version ? ` · v${c.version}` : ''}</div>
+          </div>
+          ${c.installed ? html`<span class="connector-chip connector-chip--ok">installed</span>` : nothing}
+        </div>
+
+        ${c.user_description ? html`<div class="connector-card-desc">${c.user_description}</div>` : nothing}
+
+        <div class="connector-chips">
+          <span class="connector-chip connector-chip--scope">
+            <i class="bi ${c.scope === 'global' ? 'bi-globe' : 'bi-person'}"></i>
+            ${c.scope === 'global' ? 'global' : 'per-user'}
+          </span>
+          <span class="connector-chip ${isScript ? 'connector-chip--script' : ''}">
+            <i class="bi ${isScript ? 'bi-file-earmark-code' : 'bi-cloud'}"></i>
+            ${isScript ? 'local script' : 'remote'}
+          </span>
+          ${c.auth_kind !== 'none' ? html`
+            <span class="connector-chip"><i class="bi bi-key"></i>${c.auth_kind}</span>` : nothing}
+          ${tags.map((t) => html`<span class="connector-chip">${t}</span>`)}
+        </div>
+
+        ${isScript ? html`
+          <div class="connector-card-note">
+            <i class="bi bi-shield-check"></i>${c.file_count} file${c.file_count === 1 ? '' : 's'}, SHA-256 verified on install
+          </div>` : nothing}
+        ${c.oauth_scopes?.length ? html`
+          <details class="connector-card-scopes">
+            <summary>Requests ${c.oauth_scopes.length} OAuth scope${c.oauth_scopes.length === 1 ? '' : 's'}</summary>
+            ${c.oauth_scopes.map((s) => html`<code>${s}</code>`)}
+          </details>` : nothing}
+
+        <div class="connector-card-actions">
+          <button class="btn btn-sm ${c.installed ? 'btn-outline-primary' : 'btn-primary'}"
+            ?disabled=${busy} @click=${() => this._install(c)}>
+            ${busy ? html`<i class="bi bi-hourglass-split me-1"></i>Installing…`
+              : c.installed ? html`<i class="bi bi-arrow-repeat me-1"></i>Reinstall`
+              : html`<i class="bi bi-download me-1"></i>Install`}
+          </button>
+          ${c.homepage ? html`
+            <a class="btn btn-sm btn-outline-primary"
+              href=${c.homepage} target="_blank" rel="noopener noreferrer" title="Homepage">
+              <i class="bi bi-box-arrow-up-right"></i></a>` : nothing}
+        </div>
+      </div>`;
+  }
+}

web/components/sidebar.js

@@ -9,6 +9,7 @@ export class AppSidebar extends LightElement {
     _inboxCount:    { state: true },
     _debugMode:     { state: true },
     _recentProjects: { state: true },
+    _me:            { state: true },
   };
 
   constructor() {
@@ -19,6 +20,7 @@ export class AppSidebar extends LightElement {
     this._pollTimer      = null;
     this._debugMode      = false;
     this._recentProjects = [];
+    this._me             = null;
   }
 
   connectedCallback() {
@@ -50,9 +52,20 @@ export class AppSidebar extends LightElement {
     this._pollTimer = setInterval(() => this._pollInbox(), 10000);
     this._loadDebugMode();
     this._loadRecentProjects();
+    this._loadMe();
     window.addEventListener('project-updated', () => this._loadRecentProjects());
   }
 
+  // Only for deciding which links to draw. Hiding a link is not access control —
+  // every admin route is capability-gated server-side (`require_cap`), so this
+  // only avoids offering a door that would answer 403.
+  async _loadMe() {
+    try {
+      const res = await fetch('/api/auth/me');
+      if (res.ok) this._me = await res.json();
+    } catch { /* ignore */ }
+  }
+
   disconnectedCallback() {
     super.disconnectedCallback();
     clearInterval(this._pollTimer);
@@ -106,7 +119,7 @@ export class AppSidebar extends LightElement {
     // Segment ends at the first `/` (e.g. `#session/123`) or `?` (e.g. `#file_viewer?path=...`).
     const match = hash.match(/^([^/?]+)/);
     const segment = match ? match[1] : '';
-    return ['inbox', 'tasks', 'projects', 'models', 'providers', 'approval', 'agents', 'users', 'roles', 'profile', 'config', 'llm-requests', 'session', 'tic', 'file_viewer'].includes(segment) ? segment : 'home';
+    return ['inbox', 'tasks', 'projects', 'models', 'providers', 'approval', 'agents', 'users', 'roles', 'connectors', 'catalog', 'marketplace', 'profile', 'config', 'llm-requests', 'session', 'tic', 'file_viewer'].includes(segment) ? segment : 'home';
   }
 
   _tasksSectionFromHash() {
@@ -286,6 +299,17 @@ export class AppSidebar extends LightElement {
           <i class="bi bi-tags"></i>
           <span class="sidebar-link-name">Roles</span>
         </a>
+        <a href="#" class="sidebar-link ${this._activePage === 'connectors' ? 'active' : ''}"
+           @click=${(e) => this._togglePage('connectors', e)}>
+          <i class="bi bi-plug"></i>
+          <span class="sidebar-link-name">Connectors</span>
+        </a>
+        ${this._me?.role_id === 'admin' ? html`
+          <a href="#" class="sidebar-link ${this._activePage === 'catalog' || this._activePage === 'marketplace' ? 'active' : ''}"
+             @click=${(e) => this._togglePage('catalog', e)}>
+            <i class="bi bi-journal-text"></i>
+            <span class="sidebar-link-name">Catalog</span>
+          </a>` : nothing}
         <a href="#" class="sidebar-link ${this._activePage === 'config' ? 'active' : ''}"
            @click=${(e) => this._togglePage('config', e)}>
           <i class="bi bi-gear"></i>

web/css/connectors.css

@@ -0,0 +1,272 @@
+/* ── Connector marketplace ──────────────────────────────────────────────────────
+ *
+ * Cards for the marketplace grid. Everything here is theme-driven: the surface
+ * comes from the `--card-*` family and the accents from Bootstrap's own
+ * `--bs-*`, so light/dark follows `data-bs-theme` with no second set of colours.
+ *
+ * Note these are styled directly rather than joining the `!important` card family
+ * in variables.css: that block would win over any hover box-shadow declared here.
+ */
+
+.connector-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
+  gap: 0.75rem;
+}
+
+.connector-card {
+  display: flex;
+  flex-direction: column;
+  gap: 0.55rem;
+  padding: 0.85rem;
+  background:    var(--card-bg);
+  border:        1px solid var(--card-border);
+  border-radius: var(--card-radius);
+  box-shadow:    var(--card-shadow);
+  transition: border-color 0.15s, box-shadow 0.15s;
+}
+
+.connector-card:hover {
+  border-color: var(--bs-primary);
+  box-shadow: 0 0 0 3px rgba(var(--bs-primary-rgb), 0.1);
+}
+
+/* ── Head ─────────────────────────────────────────────────────────────────── */
+
+.connector-card-head {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.6rem;
+}
+
+.connector-card-icon {
+  width: 32px;
+  height: 32px;
+  flex-shrink: 0;
+  object-fit: contain;
+  border-radius: 4px;
+}
+
+/* Icon stand-in when a connector ships none, so the text column still lines up. */
+.connector-card-icon--empty {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: var(--bs-tertiary-bg);
+  color: var(--placeholder-color);
+  font-size: 0.9rem;
+}
+
+.connector-card-title {
+  min-width: 0;
+  flex: 1;
+}
+
+.connector-card-name {
+  font-weight: 600;
+  font-size: 0.9rem;
+  line-height: 1.2;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.connector-card-sub {
+  font-size: 0.7rem;
+  color: var(--placeholder-color);
+  font-family: var(--bs-font-monospace, monospace);
+  margin-top: 0.15rem;
+}
+
+.connector-card-desc {
+  font-size: 0.76rem;
+  line-height: 1.4;
+  color: var(--placeholder-color);
+  /* Two lines keeps every card the same height without truncating mid-thought. */
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+/* ── Chips ────────────────────────────────────────────────────────────────────
+ *
+ * Bootstrap badges are solid pills — too loud for metadata that is read, not
+ * clicked. These are quiet outlines by default; only the two chips that carry
+ * real meaning get colour: placement (§7 global vs per-user) and the §14 risk
+ * axis (a local script runs code on this box). Keywords stay grey, so the eye
+ * lands on what matters.
+ */
+
+.connector-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.3rem;
+}
+
+.connector-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.25rem;
+  padding: 0.18rem 0.4rem;
+  font-size: 0.67rem;
+  line-height: 1.25;
+  border-radius: 3px;
+  border: 1px solid var(--card-border);
+  background: var(--bs-tertiary-bg);
+  color: var(--placeholder-color);
+  white-space: nowrap;
+}
+
+/* The accent chips use Bootstrap 5.3's own subtle triplet
+   (`-bg-subtle` / `-border-subtle` / `-text-emphasis`), which it already re-derives
+   under `data-bs-theme` — so light and dark come for free and no literal colour is
+   spelled out here. */
+
+.connector-chip--scope {
+  border-color: var(--bs-primary-border-subtle);
+  background:   var(--bs-primary-bg-subtle);
+  color:        var(--bs-primary-text-emphasis);
+  font-weight: 500;
+}
+
+/* The one chip that is a warning: code that will execute on this box. */
+.connector-chip--script {
+  border-color: var(--bs-warning-border-subtle);
+  background:   var(--bs-warning-bg-subtle);
+  color:        var(--bs-warning-text-emphasis);
+  font-weight: 500;
+}
+
+.connector-chip--ok {
+  border-color: var(--bs-success-border-subtle);
+  background:   var(--bs-success-bg-subtle);
+  color:        var(--bs-success-text-emphasis);
+  font-weight: 500;
+}
+
+/* ── Footnotes + actions ──────────────────────────────────────────────────── */
+
+.connector-card-note {
+  font-size: 0.68rem;
+  color: var(--placeholder-color);
+  display: flex;
+  align-items: center;
+  gap: 0.3rem;
+}
+
+.connector-card-scopes {
+  font-size: 0.68rem;
+  color: var(--placeholder-color);
+}
+
+.connector-card-scopes summary {
+  cursor: pointer;
+  user-select: none;
+}
+
+.connector-card-scopes code {
+  display: block;
+  font-size: 0.62rem;
+  padding-top: 0.2rem;
+  word-break: break-all;
+  color: var(--placeholder-color);
+}
+
+.connector-card-actions {
+  display: flex;
+  gap: 0.35rem;
+  margin-top: auto;
+  padding-top: 0.2rem;
+}
+
+.connector-card-actions .btn {
+  font-size: 0.75rem;
+}
+
+.connector-card-actions .btn:first-child {
+  flex: 1;
+}
+
+/* ── Filter bar ───────────────────────────────────────────────────────────── */
+
+.connector-filters {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+}
+
+.connector-search {
+  position: relative;
+  flex: 1;
+  min-width: 200px;
+  max-width: 320px;
+}
+
+.connector-search .bi {
+  position: absolute;
+  left: 0.6rem;
+  top: 50%;
+  transform: translateY(-50%);
+  font-size: 0.8rem;
+  color: var(--placeholder-color);
+  pointer-events: none;
+}
+
+/* Bootstrap gives `.form-control` the page background (`--bs-body-bg`), which works
+   inside a modal — a recessed field on a card — but disappears here, where the input
+   sits straight on the page. So it takes the card surface instead. `:focus` needs it
+   too: Bootstrap re-asserts the body background there. */
+.connector-search input,
+.connector-search input:focus {
+  padding-left: 1.9rem;
+  background-color: var(--card-bg);
+  border-color: var(--card-border);
+}
+
+.connector-search input:focus {
+  border-color: var(--bs-primary);
+}
+
+.connector-search input::placeholder {
+  color: var(--placeholder-color);
+  opacity: 1;
+}
+
+/* A segmented control, not a row of loose buttons: these are one choice. */
+.connector-segment {
+  display: inline-flex;
+  border: 1px solid var(--card-border);
+  border-radius: var(--card-radius);
+  overflow: hidden;
+}
+
+.connector-segment button {
+  border: none;
+  background: var(--card-bg);
+  color: var(--placeholder-color);
+  font-size: 0.72rem;
+  padding: 0.25rem 0.55rem;
+  cursor: pointer;
+  transition: background 0.15s, color 0.15s;
+}
+
+.connector-segment button + button {
+  border-left: 1px solid var(--card-border);
+}
+
+.connector-segment button:hover {
+  background: var(--bs-tertiary-bg);
+}
+
+.connector-segment button.active {
+  background: var(--bs-primary);
+  color: #fff;
+}
+
+.connector-segment-label {
+  font-size: 0.7rem;
+  color: var(--placeholder-color);
+}

web/css/page-shell.css

@@ -73,6 +73,9 @@ file-viewer-page {
 
 users-page,
 roles-page,
+connectors-page,
+marketplace-page,
+catalog-page,
 profile-page {
   display: none; /* toggled by JS */
   flex-direction: column;

web/index.html

@@ -47,6 +47,7 @@
   <link rel="stylesheet" href="css/copilot-input.css" />
   <link rel="stylesheet" href="css/dialogs.css" />
   <link rel="stylesheet" href="css/page-shell.css" />
+  <link rel="stylesheet" href="css/connectors.css" />
   <link rel="stylesheet" href="css/models-hub.css" />
   <link rel="stylesheet" href="css/tasks/base.css" />
   <link rel="stylesheet" href="css/tasks/history.css" />
@@ -92,6 +93,9 @@
       <agents-page></agents-page>
       <users-page></users-page>
       <roles-page></roles-page>
+      <connectors-page></connectors-page>
+      <marketplace-page></marketplace-page>
+      <catalog-page></catalog-page>
       <profile-page style="display:none"></profile-page>
       <llm-providers-page></llm-providers-page>
       <models-hub-page></models-hub-page>