Let operators route T3's built-in MCP tools through a local stdio wrapper

[luckyPipewrench]

I build Pipelock, an open-source local proxy for AI agent traffic, and use T3 daily. T3 passes its built-in MCP endpoint directly to providers. An operator can't currently put a local stdio proxy in front of those tools through T3's configuration.

The proposal is one optional setting, T3CODE_MCP_STDIO_WRAPPER: an absolute executable path plus fixed arguments. The wrapper receives the session endpoint in T3_MCP_URL and the full Authorization header value in T3_MCP_AUTHORIZATION. Those values go in its environment, never its arguments. Nothing changes with the setting unset. Any compatible stdio wrapper can use it; there's no Pipelock dependency. OS-level isolation remains outside T3.

#18257, the rebuild of #15273, reached 807 changed lines across 26 files. Maria closed it and asked for an Ideas discussion and agreement on a smaller scope before resubmitting. That's what I'm asking for here.

The live-test report on #18257 covers isolated full server turns calling t3_thread_list through the wrapper with Claude, Codex, Grok over ACP, and managed OpenCode on Linux. It also covers Codex with a native Windows server bundle and an explicit Node interpreter. Each reported run checked the tool response and confirmed that the bearer credential wasn't in the wrapper's arguments. Cursor stopped at its SDK sign-in requirement; Pi, Muse, and the remaining provider/platform combinations weren't tested live. CodeRabbit's one minor finding on that rebuild, preserving the command-resolution error as its cause, was fixed, and CodeRabbit then approved.

Would a maintainer approve a first cut limited to the setting and validation, Claude and Codex wrapper support, focused tests, and a short operator guide? With the setting enabled, providers outside that first cut would run without T3's built-in tools, including HTTP-only providers, so they couldn't silently route around the wrapper. Other provider support can come later or never.

Josh

[bomtobe-hgkim]

I'd validate the absolute wrapper path and reject files writable by untrusted users; also redact T3_MCP_URL and Authorization from logs/errors. I work at BOMTOBE, behind Orke.