MCP Servers module

[github-actions[bot]]

A discussion dedicated to the MCP Servers module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	15 / 25	18 / 20	0 / 20	8 / 10	51 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows basic usage and GitHub auth modes (token-env, external-auth, native-oauth), but lacks comprehensive examples for each major configuration path. The preselect example is minimal. No dedicated example showing all clients or demonstrating the multi-select parameter behavior.
Visual preview	5	0	No image, GIF, or video in README. Only references an icon file.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	5	Documents Coder External Auth for GitHub MCP (dynamic token resolution), but no mention of AI Gateway or Agent Firewall. Only one governance mechanism documented earns half.
Dashboard entry point	5	0	No coder_app resource or documentation. Module configures MCP servers but provides no dashboard entry point.
Session continuity	5	5	README explicitly documents that "removing a server from the field cannot safely remove configuration that the user may have customized" and states "Rebuild the workspace to change the selection," implying persistent configuration across workspace restarts. MCP configurations persist in user home directory across reconnects.
Managed configuration	5	5	Module manages MCP server configuration through mcp-add, writes to native client config files (.claude.json, .cursor/mcp.json, .codex/config.toml), and documents authentication configuration management.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The github_auth variable contains sensitive fields (token_env_var, external_auth_id) but is not marked sensitive. However, README examples consistently avoid inline secrets, using environment variable references and external auth. The token-env mode explicitly documents "no token value was written to client configuration." No placeholder keys appear in examples.
Non-hardcoded auth path	4	2	Documents external-auth mode using coder external-auth access-token and token-env mode referencing workspace environment variables, but the primary documented path still requires users to manage PATs. The native-oauth mode requires Docker and is opt-in. Partial credit for documented alternatives.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable to override Node.js download URL (hardcoded to nodejs.org), no variable for mcp-add source (hardcoded npx invocation), no variable for Playwright MCP source. The node_version, mcp_add_version, and playwright_mcp_version are version pins, not URL overrides. The local_server_image for native-oauth is a Docker image reference, not a download URL override for the module's own artifacts.
Bring-your-own binary	10	0	No documented way to skip Node.js bootstrap when already present. The ensure_node function always runs and will download Node.js if the existing version is below 18. No skip-install flag or environment variable.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples (nodejs.org, api.githubcopilot.com, npm registry implied by npx). No air-gapped or restricted environment guidance.
Runs without sudo	2	0	Scripts in install.sh.tftpl and auth.sh.tftpl never invoke sudo. All operations write to user home directory. Full credit earned from code inspection.

Correction after re-inspection: The scripts verifiably never use sudo and work in user home directory. This earns full credit per the rubric exception.

Restricted-Environment Readiness — 2 / 20 (corrected)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable to override Node.js download URL (hardcoded to nodejs.org), no variable for mcp-add source (hardcoded npx invocation), no variable for Playwright MCP source. The node_version, mcp_add_version, and playwright_mcp_version are version pins, not URL overrides.
Bring-your-own binary	10	0	No documented way to skip Node.js bootstrap when already present. The ensure_node function always runs and will download Node.js if the existing version is below 18. No skip-install flag.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints scattered across examples (nodejs.org, api.githubcopilot.com, npm registry). No air-gapped guidance.
Runs without sudo	2	2	Scripts never invoke sudo. All operations in user home directory ($HOME/.coder-modules, $HOME/.claude.json, etc.). Verified in install.sh.tftpl and auth.sh.tftpl.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Extensive validation blocks for clients, default, github_auth modes, version formats, port ranges, and image digests. Sensible defaults (mode: "none", token_env_var: "GITHUB_MCP_TOKEN", oauth_callback_port: 8085).
Test coverage	4	2	.tftest.hcl covers validation rules, parameter types, and script pipeline structure. TypeScript tests (auth.test.ts, main.test.ts) cover authentication modes and install behavior end-to-end. However, tests mock commands (npx, docker, codex) rather than testing actual tool integration. Business logic coverage is present but end-to-end coverage is simulated.

Overall — 51 / 100

Raw 47 / 92 → round(47 / 92 × 100) = 51 (corrected to 49 / 92)

Final correction: With Runs without sudo = 2, total is 49 / 92.

---

Recalculated final scorecard:

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	15 / 25	18 / 20	2 / 20	8 / 10	53 / 92

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows basic usage and three GitHub auth modes (token-env, external-auth, native-oauth) with code blocks, but lacks comprehensive examples for each major configuration. No example demonstrating all supported clients together or showing the multi-select parameter in action. Preselect example is minimal.
Visual preview	5	0	No image, GIF, or video embedded in README. Only references icon file path.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	5	Documents Coder External Auth integration for GitHub MCP with dynamic token resolution via coder external-auth access-token. No mention of AI Gateway or Agent Firewall. Only one governance mechanism documented.
Dashboard entry point	5	0	No coder_app resource or documentation. Module configures MCP servers but provides no dashboard entry point.
Session continuity	5	5	README explicitly states "The selection is immutable for the lifetime of a workspace because removing a server from the field cannot safely remove configuration that the user may have customized. Rebuild the workspace to change the selection." MCP configurations persist in user home directory across workspace restarts and reconnects.
Managed configuration	5	5	Module manages MCP server configuration through mcp-add, writes to native client config files (.claude.json, .cursor/mcp.json, .codex/config.toml), and documents authentication configuration management including token-env references and external auth helpers.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The github_auth variable is not marked sensitive, but README examples consistently avoid inline secrets. Token-env mode uses environment variable references. External-auth mode uses dynamic resolution. README explicitly states "no token value was written to client configuration." No placeholder keys in examples.
Non-hardcoded auth path	4	2	Documents external-auth mode using coder external-auth access-token and token-env mode with User Secrets, but primary documented path still involves PAT management. Native-oauth requires Docker and is opt-in. Partial credit for documented alternatives that avoid pasting raw keys.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No variable to override Node.js download URL (hardcoded to nodejs.org in install.sh.tftpl). No variable for mcp-add source (hardcoded npx invocation). No variable for Playwright MCP source. Variables node_version, mcp_add_version, playwright_mcp_version are version pins, not URL overrides.
Bring-your-own binary	10	0	No documented way to skip Node.js bootstrap. The ensure_node function always runs and downloads Node.js if existing version is below 18. No skip-install variable or offline mode.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints scattered across examples (nodejs.org, api.githubcopilot.com, npm registry implied by npx). No air-gapped or restricted environment guidance section.
Runs without sudo	2	2	Scripts in install.sh.tftpl and auth.sh.tftpl never invoke sudo. All operations write to user home directory ($HOME/.coder-modules, $HOME/.claude.json, $HOME/.cursor/mcp.json, $HOME/.codex/config.toml). Verified by code inspection.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. Extensive validation blocks for clients (supported list), default (github/playwright only), github_auth modes, version formats (semantic version regex), oauth_callback_port (1024-65535 integer), and local_server_image (pinned digest format).
Test coverage	4	2	.tftest.hcl covers validation rules, parameter types, default encoding, and script pipeline structure. TypeScript tests (auth.test.ts, main.test.ts) cover authentication modes and install behavior with mocked commands (npx, docker, codex, coder). Business logic is tested but end-to-end coverage uses simulated tool responses rather than actual integration.

Overall — 51 / 100

---

Scored against SCORECARD.md on 2026-08-27 with claude-sonnet-4-5.

[josuesafari]

I've been thinking about MCP as agents gain access to more tools and services. How should users reliably know which agent is acting on their behalf, what authority it currently has, and whether that authority can be delegated to another agent or MCP server? Could this become a challenge as users rely on multiple agents across different ecosystems?