mcp: catalog of public MCP servers + install-by-name

[FMXExpress]

Adds two subcommands to pasclaw mcp so users can preload remote MCP servers from a curated catalog without having to look up the URL + bearer-header shape themselves.

pasclaw mcp catalog               # list known public MCP servers
pasclaw mcp install <name>        # add one from the catalog

Not preloaded — picoclaw seeds nothing, and the same rule fits PasClaw. No MCP server reaches a remote endpoint until the operator opts in. The catalog just removes the "look up the URL and the bearer shape" step that's the #1 way remote MCPs end up "broken on arrival" in someone's config.

Catalog entries

name	env var	provider
replicate	REPLICATE_API_TOKEN	Run AI models on Replicate.
digitalocean-apps	DIGITALOCEAN_TOKEN	DigitalOcean App Platform.
digitalocean-databases	DIGITALOCEAN_TOKEN	DigitalOcean Managed Databases.
runpod-docs	(none)	Search RunPod documentation.
huggingface	HF_TOKEN	Search models / datasets / papers / Spaces.

Each catalog row carries Name + URL + EnvVar + AuthFmt (Bearer %s) + Desc + Docs. ResolveAuthHeader formats the literal Authorization-header value from EnvVar + AuthFmt at install time. Stored as the args field on the mcp_servers entry — the exact shape the existing HTTP MCP client expects (PasClaw.MCP.HttpClient.pas line 11-13: "Auth tokens come from the configured args slot, shaped as 'Bearer ...'").

Install behavior

• Idempotent — running install again refreshes the args slot in place rather than appending a duplicate row.
• Env unset — warns clearly, installs anyway with empty Authorization, suggests "set <ENV_VAR> and re-run pasclaw mcp install <name>" so the user can refresh after fixing the env.
• No auth (e.g. runpod-docs) — installs immediately.
• Unknown name — errors with hint to run pasclaw mcp catalog.

list / remove / test / show / edit all work normally afterwards since the installed entry is just a regular mcp_servers row.

Verification (live smoke)

PASCLAW_HOME=/tmp/x

$ pasclaw mcp catalog
name                       env var               status
               replicate   REPLICATE_API_TOKEN   unset
       digitalocean-apps   DIGITALOCEAN_TOKEN    unset
  digitalocean-databases   DIGITALOCEAN_TOKEN    unset
             runpod-docs                         (no auth)
             huggingface             HF_TOKEN    unset

$ pasclaw mcp install replicate
! env var REPLICATE_API_TOKEN is not set. Installing anyway with empty Auth…

$ REPLICATE_API_TOKEN=r8_FAKE12345 pasclaw mcp install replicate
✓ installed MCP server replicate

$ cat $PASCLAW_HOME/config.json | jq .mcp_servers
[
  {
    "name": "replicate",
    "cmd": "https://mcp.replicate.com",
    "args": "Bearer r8_FAKE12345",
    "env": "",
    "enabled": true
  }
]

Adding more providers

Append a TMCPCatalogEntry record to KnownMCPServers in PasClaw.MCP.Catalog. No other code touches the catalog data; list / install / show / test paths need no changes.

https://claude.ai/code/session_01TBcLtmpj7dqA5tyFbGnQon

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 537198363b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".