Implement the local RuDS MCP server and desktop approval flow specified by specs/mcp.allium.
Current state
MCP behavior is specified but no server exists.
The Settings MCP section is a placeholder.
Core query and mutation engines already exist.
This issue should reuse the shared headless application context and domain events established for the CLI.
Required behavior
Expose the project, posts, media, tags, categories, statistics, post-media, and image resources from specs/mcp.allium.
Implement the specified read/search/count/check tools through core queries.
Convert every write request into a proposal; no content mutation occurs until the user explicitly approves it in the desktop UI.
Persist enough proposal state for review, rejection, approval, expiry, and result reporting without creating an alternative content model.
Bind HTTP transport to localhost only and keep request handling stateless as specified.
Replace the MCP settings placeholder with localized enablement/status, endpoint information, proposal controls, and configured-agent toggles.
Generate/update Claude Code and Copilot MCP configuration only when the corresponding user setting requests it.
Emit normal domain events after approved writes.
Apply airplane-mode gating to any MCP operation that invokes AI or external network access.
Implementation notes
Read docs/UI_STYLE_GUIDE.md before UI work.
Reuse core engines and secure settings. Do not let MCP bypass confirmations, sidecar writes, metadata diff, or rebuild behavior.
Follow red/green TDD and treat specs/mcp.allium as the complete public contract.
Acceptance criteria
Every resource and tool in mcp.allium has protocol-level tests.
Read operations cannot mutate state.
Write proposals are inert before approval and execute exactly once after approval.
Rejection, expiry, invalid IDs, unavailable projects, and concurrent proposal handling are tested.
The server is unreachable on non-loopback interfaces.
Agent configuration generation is opt-in and tested without exposing secrets.
The Settings placeholder is gone and the proposal UI is localized.
cargo fmt --all -- --check, cargo build --workspace, and cargo test --workspace pass.
## Goal
Implement the local RuDS MCP server and desktop approval flow specified by specs/mcp.allium.
## Current state
- MCP behavior is specified but no server exists.
- The Settings MCP section is a placeholder.
- Core query and mutation engines already exist.
- This issue should reuse the shared headless application context and domain events established for the CLI.
## Required behavior
- Expose the project, posts, media, tags, categories, statistics, post-media, and image resources from specs/mcp.allium.
- Implement the specified read/search/count/check tools through core queries.
- Convert every write request into a proposal; no content mutation occurs until the user explicitly approves it in the desktop UI.
- Persist enough proposal state for review, rejection, approval, expiry, and result reporting without creating an alternative content model.
- Bind HTTP transport to localhost only and keep request handling stateless as specified.
- Replace the MCP settings placeholder with localized enablement/status, endpoint information, proposal controls, and configured-agent toggles.
- Generate/update Claude Code and Copilot MCP configuration only when the corresponding user setting requests it.
- Emit normal domain events after approved writes.
- Apply airplane-mode gating to any MCP operation that invokes AI or external network access.
## Implementation notes
- Read docs/UI_STYLE_GUIDE.md before UI work.
- Reuse core engines and secure settings. Do not let MCP bypass confirmations, sidecar writes, metadata diff, or rebuild behavior.
- Follow red/green TDD and treat specs/mcp.allium as the complete public contract.
## Acceptance criteria
- Every resource and tool in mcp.allium has protocol-level tests.
- Read operations cannot mutate state.
- Write proposals are inert before approval and execute exactly once after approval.
- Rejection, expiry, invalid IDs, unavailable projects, and concurrent proposal handling are tested.
- The server is unreachable on non-loopback interfaces.
- Agent configuration generation is opt-in and tested without exposing secrets.
- The Settings placeholder is gone and the proposal UI is localized.
- cargo fmt --all -- --check, cargo build --workspace, and cargo test --workspace pass.
Implemented in commit fb5cae2. Added the complete project/posts/media/tags/categories/stats/post-media/image MCP resource surface; 12 read and inert-write tools over shared engines; stateless localhost HTTP with Host/Origin/CORS/protocol validation; packaged stdio transport; persisted exactly-once proposal approval, rejection, expiry, concurrency and result handling; normal domain events; localized Settings review controls; and opt-in Claude Code/GitHub Copilot configuration. Neutral review compared the implementation with issue #20, specs/mcp.allium, bDS2 MCP behavior and tests, and current official MCP/axum transport guidance. Verified with protocol tests for every resource and tool, proposal/UI/process/migration/i18n/packaging tests, allium check/analyse, cargo fmt --check, cargo build --workspace, cargo test --workspace, strict clippy, and packaged macOS visual QA. All gates pass.
Implemented in commit fb5cae2. Added the complete project/posts/media/tags/categories/stats/post-media/image MCP resource surface; 12 read and inert-write tools over shared engines; stateless localhost HTTP with Host/Origin/CORS/protocol validation; packaged stdio transport; persisted exactly-once proposal approval, rejection, expiry, concurrency and result handling; normal domain events; localized Settings review controls; and opt-in Claude Code/GitHub Copilot configuration. Neutral review compared the implementation with issue #20, specs/mcp.allium, bDS2 MCP behavior and tests, and current official MCP/axum transport guidance. Verified with protocol tests for every resource and tool, proposal/UI/process/migration/i18n/packaging tests, allium check/analyse, cargo fmt --check, cargo build --workspace, cargo test --workspace, strict clippy, and packaged macOS visual QA. All gates pass.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Implement the local RuDS MCP server and desktop approval flow specified by specs/mcp.allium.
Current state
Required behavior
Implementation notes
Acceptance criteria
Implemented in commit
fb5cae2. Added the complete project/posts/media/tags/categories/stats/post-media/image MCP resource surface; 12 read and inert-write tools over shared engines; stateless localhost HTTP with Host/Origin/CORS/protocol validation; packaged stdio transport; persisted exactly-once proposal approval, rejection, expiry, concurrency and result handling; normal domain events; localized Settings review controls; and opt-in Claude Code/GitHub Copilot configuration. Neutral review compared the implementation with issue #20, specs/mcp.allium, bDS2 MCP behavior and tests, and current official MCP/axum transport guidance. Verified with protocol tests for every resource and tool, proposal/UI/process/migration/i18n/packaging tests, allium check/analyse, cargo fmt --check, cargo build --workspace, cargo test --workspace, strict clippy, and packaged macOS visual QA. All gates pass.