Document connecting external MCP servers - #4
Conversation
The MCP client feature (Settings > MCP tab) shipped across PicoServer PRs #14/#15/#16 but was undocumented. Add a user-guide page covering adding external MCP servers, authentication (none/bearer/OAuth), server instructions, and how their tools are injected into generation. Also correct enable-built-in-tools.md: the 'Expose enabled tools to MCP clients' toggle moved from the Tools tab to the MCP tab. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WJW8qS7XGnJ71MSvKTm23p
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new user guide for connecting external Model Context Protocol (MCP) servers to Pico AI Server, updates the built-in tools documentation to clarify the distinction between built-in tools and external MCP servers, and adds the new guide to the sidebar. Feedback was provided to improve the phrasing of a sentence in the new guide to clarify that newly added servers are enabled by default.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Address review feedback: reword the awkward 'A new server is added enabled' to 'A newly added server is enabled by default.' Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WJW8qS7XGnJ71MSvKTm23p
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff4d49ba9c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Replace the backwards mcp-remote example: mcp-remote bridges a stdio client to a remote HTTP server, not the reverse. Describe a generic HTTP/SSE gateway in front of a stdio-only server instead. - Note that OAuth sign-in relies on dynamic client registration, and document the failure when a server advertises no registration endpoint (verified against MCPOAuthEngine). - Add a Troubleshooting section and Next steps, as AGENTS.md requires for Manual/task pages. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WJW8qS7XGnJ71MSvKTm23p
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 609d378001
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… Desktop claim - Make the 'Try it now' request verify tool injection: use explicit YOUR_QUESTION/MODEL_NAME placeholders with a concrete DeepWiki example that can only be answered via a tool call. - Drop 'such as Claude Desktop' from the exposure note. Claude Desktop is a stdio client that can't directly reach a private /mcp endpoint without a bridge (not surfaced in the MCP UI); describe the reachability requirement generically instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WJW8qS7XGnJ71MSvKTm23p
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 854d34e417
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Specify the Streamable HTTP transport for stdio gateways (Pico's client uses HTTPClientTransport; legacy SSE-only endpoints may not connect). - Warn that server Instructions steer the model as prompt content — paste only trusted, reviewed notes. - Warn that an enabled server's tools run for any client that can prompt Pico (incl. LAN) using stored credentials; require an API key when shared. - Point exposed-tools clients at the /mcp endpoint (per endpoint-summary), not the base URL. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WJW8qS7XGnJ71MSvKTm23p
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7eeeae2e8b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex flagged that the credential mitigation relied on auth the docs said wasn't enforced. Verified against current PicoServer source (HTTPServer.swift): AuthMiddleware IS attached (userAccountService is wired in PicoServerApp) and enforces bearer-token auth when user accounts are enabled, short-circuiting when off. - endpoint-summary.md: the auth-middleware note was stale (integration landed via PicoServer #6/#8/#17); it now says the middleware is attached and enforces when user accounts are enabled. - connect page: tie the mitigation to enabling user accounts, and note bearer-token enforcement is off by default. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WJW8qS7XGnJ71MSvKTm23p
1 participant
Summary
Fills the MCP & Tools documentation gap (Part IV of the docs map, previously a TODO) by documenting the MCP client feature and correcting a stale UI reference. Both changes reflect features already merged in the source repositories.
Changes
New page: Connect External MCP Servers
docs/user-guide/connect-external-mcp-servers.mddocuments Pico AI Server acting as an MCP client — the feature shipped across PicoServer #14 (MCP settings tab), #15 (external server tool injection), and #16 (OAuth callback). It covers:Authorization: Bearer), and OAuth (browser sign-in, OAuth 2.1 + PKCE, sign in/out)Fix: exposure toggle location
docs/user-guide/enable-built-in-tools.mdsaid the Expose enabled tools to MCP clients toggle lives in the Tools tab. It moved to the MCP tab (MCPSettingsView.swift: "moved here from the Tools tab"). Corrected the toggle location and the intro sentence, and added a cross-link to the new page.Sidebar
Added the new page to the MCP & Tools category in
sidebars.ts.Notes
PicoMCPClient/MCPSettingsView.swiftand PicoServer'sSettingsView.swift), not point-in-time PR descriptions.check_markdown.py --strictpasses with 0 errors / 0 warnings.🤖 Generated with Claude Code
https://claude.ai/code/session_01WJW8qS7XGnJ71MSvKTm23p
Generated by Claude Code