feat(mcp): distribute team MCP servers as a seventh resource type

[jeff-r2026]

Summary

Closes #251. Adds mcp as a seventh resource type: declare servers once in mcp/mcp.yaml, and teamai pull writes each installed tool's native config.

# mcp/mcp.yaml
servers:
  - name: gpu-analysis
    transport: http
    url: https://gpubiz.woa.com/api/ai/mcp
    headers:
      Authorization: Bearer ${GPU_ANALYSIS_TOKEN}
  - name: context7
    transport: stdio
    command: npx
    args: ['-y', '@upstash/context7-mcp']
    requires: [npx]

Why teamai rather than a committed .mcp.json

A committed .mcp.json only covers Claude Code at project scope, and cannot hold a secret. Other tools each want a different file shape; two of them are files teamai does not own (~/.claude.json, ~/.codex/config.toml).

The engine never rewrites a whole file. It edits only the server keys it installed (~/.teamai/managed-mcp.json), writes atomically, and patches Codex at the text level so comments survive. Name collisions with hand-added servers skip unless --force.

Secrets

Write ${VAR}, never a literal. Resolve from the environment, then from env/env.yaml → ~/.teamai/env.

Where a tool can keep secrets off its own file, teamai does:

• Claude project .mcp.json keeps the placeholder (Claude expands it).
• Codex names the variable (bearer_token_env_var / env_http_headers) instead of storing the value.

Anything else gets a resolved value at 0600. In project scope, tools that cannot expand ${VAR} skip secret-bearing servers rather than writing plaintext into a committed file.

Fixes from end-to-end runs

Unit tests passed; these came from real tools:

1. Project scope secret leak — resolving ${VAR} for tools that cannot expand it wrote plaintext into repo-tracked files. Now fail-closed.
2. Project scope dead paths — no fallback from mcpProject to the user-scope path; absent mcpProject means no project-scope support.
3. Codex HTTP — Codex supports streamable HTTP (--url / bearer_token_env_var); only sse is skipped. The old “skip http” test encoded the wrong assumption.

Paths

Tool	User scope	Project scope
claude	~/.claude.json	<root>/.mcp.json
cursor	~/.cursor/mcp.json	<root>/.cursor/mcp.json
codebuddy / workbuddy	~/.<tool>/mcp.json	<root>/.<tool>/mcp.json
codex	~/.codex/config.toml	not supported

Test plan

1808 unit tests, tsc --noEmit, and npm run build pass. Items below were run against a real team repo and a live HTTP MCP server, using each tool's own command.

• User scope: teamai pull → Connected via claude / codebuddy mcp list
• Codex: codex exec listed tools from the http server; no plaintext token in config.toml; inject-then-remove restores the file byte-for-byte
• Project scope: .mcp.json keeps ${VAR}; Connected in Claude; appears only inside the project (user scope cleared)
• Unsetting the token → HTTP 401 (proves expansion)
• Project-scope secret policy: cursor/codebuddy skip with a reason; no plaintext in the project
• sse still skipped for Codex
• teamai mcp remove / uninstall leave hand-added servers alone

Claude may show project .mcp.json servers as pending approval until accepted once interactively — documented, not bypassed.

Docs

README kept short; usage-guide (both languages) covers the matrix, secrets, and project-scope policy.