MCP Configurator

Use this skill when the task is to add, remove, or update MCP access in a holaOS workspace.

Core Rules

1. Edit workspace.yaml at the workspace root. Do not create mcp.json, .cursor/mcp.json, claude_desktop_config.json, or another generic MCP config unless the user explicitly asks for that format.
2. Workspace-level MCP lives under mcp_registry.
3. Tool ids in mcp_registry.allowlist.tool_ids must use strict server.tool syntax.
4. Omitting mcp_registry.allowlist.tool_ids or setting it to [] means all discovered tools from enabled configured servers stay available for that run.
5. Mixed mode is valid: some servers can be constrained by explicit allowlisted tool ids while other enabled servers stay discover-all.
6. This embedded skill is guidance only. When the user asks to add MCP to a workspace, update the target workspace config instead of writing new files under runtime/harnesses/src/embedded-skills/.

Remote Server Shape

Use this shape for remote HTTP MCP servers:

mcp_registry:
  servers:
    context7:
      type: remote
      url: https://mcp.context7.com/mcp
      enabled: true
      timeout_ms: 30000
      headers:
        CONTEXT7_API_KEY: "{env:CONTEXT7_API_KEY}"
  allowlist:
    tool_ids:
      - context7.lookup
      - context7.search

Header values must be either:

• a literal secret value
• or {env:ENV_VAR_NAME}

This is invalid:

headers:
  CONTEXT7_API_KEY: "{env:ctx7sk-live-abc123}"

That is a placeholder-shaped literal secret, not an environment-variable reference.

Local Server Shape

Use this shape for local stdio MCP servers:

mcp_registry:
  servers:
    my_server:
      type: local
      command:
        - npx
        - -y
        - "@acme/my-mcp"
      enabled: true
      timeout_ms: 30000
      environment:
        MY_SERVER_API_KEY: "{env:MY_SERVER_API_KEY}"

Local MCP commands must be a non-empty list of command tokens.

Workspace Tool Catalog Shape