Add connection-backed plugin imports

[reachjalil]

Goal

Make plugin-provided MCPs and skills usable through the same Den connection/capability path that already exposes org MCP tools.

Admins should be able to paste a public Claude-compatible GitHub plugin URL, preview the plugin's remote MCPs and skills, import selected components, and publish one marketplace plugin. Desktop members then install that plugin, while Den-hosted MCP tools and imported skills are discovered through:

• search_capabilities
• execute_capability

Example target URL:

https://github.com/anthropics/knowledge-work-plugins/tree/main/sales

End-to-End Flow Added

Step	User/System	Behavior
1	Admin	Opens Den Web Connections at /dashboard/connections.
2	Admin	Chooses Plugin bundle instead of MCP server.
3	Admin	Pastes a public GitHub plugin URL.
4	Den API	Resolves repo/ref/path and discovers plugin MCP/skill components.
5	Admin	Selects supported remote MCPs and skills, then imports.
6	Den API	Creates/reuses External MCP Connections for remote MCPs.
7	Den API	Persists selected SKILL.md content into org skill storage.
8	Den API	Publishes one marketplace plugin containing connection/skill references.
9	Desktop	Shows the plugin as a normal marketplace plugin.
10	Desktop	Installs the plugin without writing Den-hosted MCPs to local mcpServers.
11	Member	Uses Connect account for per-member OAuth when needed.
12	Den MCP	Returns imported MCP tools and skills through capability search/execute.

What Changed By Area

Area	Files	What changed
Den API: GitHub import	ee/apps/den-api/src/routes/org/plugin-system/*	Added preview/import routes for GitHub plugin MCPs and skills; parses repo/tree URLs; discovers .mcp.json and plugin manifests; imports selected supported components.
Den API: External MCP reuse	store.ts, external-mcp-connections.ts usage	Existing connections are reused by normalized URL only when access, auth type, and credential mode match. Reuse does not overwrite grants.
Den API: Skills as capabilities	ee/apps/den-api/src/mcp/skill-capabilities.ts, agent.ts	Imported org skills are searchable as skill:<skillId> and executable as stored SKILL.md content through /mcp/agent.
Den Web: Connections route	den-org.ts, dashboard/(admin)/connections/page.tsx, dashboard/(admin)/mcp-connections/page.tsx	Adds /dashboard/connections as the primary route and keeps /dashboard/mcp-connections as a compatibility redirect.
Den Web: Connections UI	mcp-connections-screen.tsx	Adds Add a connection chooser with MCP server and Plugin bundle; plugin bundle supports GitHub preview/import and plugin library links.
Den Web: Plugin editor	plugin-editor-screen.tsx	Pasted GitHub URL now drives preview/import instead of triggering the manual empty-component validation.
Desktop marketplace	cloud-marketplaces-view.tsx, extension-items.ts, extensions-store.ts, import-state.ts, settings-route.tsx	Connection-backed plugins render/install as marketplace plugins; Den-hosted MCPs are recorded without local mcpServers; Den skills are recorded without local skill files; setup state is shown correctly.

Data And Ownership Choices

Decision	Choice made	Reason
Credential ownership	External MCP Connections own OAuth/API key/no-auth connection state. Plugin imports may own the connection record lifecycle only when the import created that connection.	Keeps credentials in the existing security-sensitive connection tables and makes plugin removal clean for imported bundles.
Plugin object contents	Plugin/config objects store connection IDs, skill IDs, ownership markers, and metadata only.	Avoids plugin-hosted secrets, keeps plugin objects portable, and lets plugin archive clean up connections created by that import.
Existing connection reuse	Reuse only if normalized URL, access grants, auth type, and credential mode match. Reused connections are not marked plugin-owned.	Prevents imports from silently broadening/changing an existing connection and prevents plugin archive from deleting a pre-existing shared connection.
Selection identity	Import selection uses stable server/skill keys instead of display names.	Avoids collisions when plugin entries share names.
Local MCP materialization	Den-hosted org MCP connections are not written to local mcpServers.	Tools should run through Den MCP search_capabilities / execute_capability.
Skill materialization	Imported Den skills are stored in Den skill storage, not local skill files.	Skills become available through the org skill capability path and current access model.
Access default	Initial UI defaults to org-wide sharing.	Matches the current Connections UI default and keeps the first flow simple.

API Surface Added

Endpoint	Purpose
POST /v1/plugins/import-mcps-from-github-url/preview	Resolve a public GitHub plugin URL and return previewable MCP/skill components.
POST /v1/plugins/import-mcps-from-github-url	Import selected remote MCPs/skills, create/reuse connections, create plugin resources, and publish to a marketplace.

Selection now supports:

Field	Use
selectedServerKeys	Stable MCP server selection.
selectedSkillKeys	Stable skill selection.
selectedServerNames	Backwards-compatible fallback for older callers.

Capability Behavior

Capability source	Search result name	Execute behavior
Native Den REST capability	Existing native names	Existing REST capability execution.
External MCP connection tool	mcp:<connectionId>:<toolName>	Executes through Den-hosted External MCP connection client.
Marketplace/plugin capability	Existing marketplace capability names	Preserved existing marketplace capability behavior.
Imported org skill	skill:<skillId>	Returns stored SKILL.md content as skillText.

Initial Scope

This first scoped pass is centered around:

Included	Details
Public GitHub plugin URLs	Repo/tree URLs, including plugin roots below repo root.
Remote HTTP MCP servers	Supported MCP entries are imported as External MCP Connections.
Plugin skills	Primary SKILL.md content is imported into Den org skill storage.
Marketplace plugin publication	One plugin is published with MCP connection resources and imported skill references.
Desktop install path	Marketplace plugin installs without localizing Den-hosted MCPs or Den skills.
Per-member setup UX	Desktop shows Needs setup / View setup and keeps the Connect account path.

Follow-Up Scope

Follow-up	Notes
Local/stdio MCP import	Not handled in this pass; local MCPs are skipped during GitHub import preview/import.
Private GitHub URLs	Should use or extend existing GitHub connector-backed flows.
Plugin-hosted secrets	Not introduced here; would need a separate credential ownership design.
Automatic access sync	Plugin access and connection grants are matched at import time, not continuously synced.
Full blocked-state projection	Desktop still does not fully solve every grant mismatch state.
Skill references/resources	Only primary SKILL.md is imported for now.
Row-level overrides	Current import applies shared auth/credential/access settings to selected rows.

Delete / Remove Semantics

User action	What is removed	What is preserved
Remove a standalone connection from /dashboard/connections	The External MCP Connection, grants, OAuth client, and connected accounts for that connection.	Plugin records/config objects are not cascade-deleted by the connection button.
Archive a plugin imported by this flow	Plugin-owned External MCP Connections created during that import, plus normal plugin archive behavior.	Pre-existing/reused connections are preserved. Connections still referenced by another active plugin are preserved.
Remove a plugin from Desktop Marketplace	Local installed plugin materialization only.	Den org connections and Den plugin records remain managed by Den Web/Admin flows.

Security / Trust Boundary

Boundary	Handling
OAuth tokens	Stored only in existing External MCP Connection / connected account storage.
API keys	Not stored in plugin/config objects.
Plugin imports	Store references and metadata, not credentials.
Existing connections	Reuse refuses mismatched access/auth/credential mode instead of mutating grants.
Per-member OAuth	Members still connect their own account through the existing connection flow.

Validation

Ran from a clean worktree based on latest upstream/dev:

Command	Result
pnpm typecheck	✅ Passed
pnpm --filter @openwork-ee/den-api build	✅ Passed
pnpm --filter @openwork-ee/den-web build	✅ Passed

Proof Still Needed

I have not attached a fraimz/video proof yet. Recommended proof flow:

1. Admin opens /dashboard/connections.
2. Admin chooses Plugin bundle.
3. Admin imports https://github.com/anthropics/knowledge-work-plugins/tree/main/sales.
4. Den previews selected MCPs and skills.
5. Import creates/reuses External MCP Connections and creates SkillTable rows.
6. Member sees the plugin in Desktop Marketplace.
7. Member installs the plugin.
8. Per-member OAuth shows Connect account until connected.
9. /mcp/agent search_capabilities returns both mcp:<connectionId>:<toolName> and skill:<skillId>.
10. /mcp/agent execute_capability works for both an imported MCP tool and imported skill.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 8, 2026 3:51am

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[reachjalil]

Superseded by smaller feature branches: #2567, #2568, and #2569.