Release v0.1.13 · generoi/gds-assistant

Remote MCP servers

Pull tools from external MCP servers (Asana, Figma, in-house) alongside the built-in gds-mcp abilities
Three auth modes: none, bearer (static token), and OAuth 2.1 + PKCE with RFC 9728 discovery + RFC 7591 dynamic client registration
OAuth tokens are per-user and encrypted at rest (AES-256-GCM keyed from `wp_salt('auth')`)
New MCP Servers admin page with DataView — add servers from the UI, not just code. Origin badges (code/env/admin/builtin) show which are UI-editable
Built-in gds-mcp shown as a read-only synthetic row so admins see all tool sources in one place
Connect / Disconnect per-user; disconnect wipes tokens cleanly
Configuration still works via the `gds-assistant/mcp_servers` filter or `GDS_ASSISTANT_MCP_SERVERS` env var — those take precedence over UI-added entries

Gemini: `google_search` grounding disabled by default — breaks multi-tool payloads on 2.5-flash/flash-lite with "Multiple tools are supported only when they are all search tools." Re-enable via `gds-assistant/gemini_web_tools` filter if running exclusively on Pro
Tool name fallback: when LLMs normalize hyphens to underscores (e.g. calling `gds__mail_send` instead of `gds__mail-send`), the ability resolver now tries the hyphen variant so the call succeeds

Destructive-annotated tools that explicitly opt in via `min_tier` are no longer filtered out of lower-tier models (web-fetch, mail-send). Existing risk-based filtering preserved for other dangerous tools (terms-delete, cache-clear)

Skills panel closes when you pick a skill (was staying open)
Default skill prompts rewritten in first-person imperative — reads as a natural user request rather than meta-instructions to the assistant
Modal backdrops now dim correctly on MCP Servers / Skills / Memory pages (z-index collision with the admin page wrap resolved)