feat(plugins): add GitHub plugin import backend

[reachjalil]

Goal

Add the Den API backend path for importing MCP servers and skills from a public GitHub plugin URL into Den-owned resources.

This branch answers: "Can Den parse a plugin URL, persist its remote MCPs as External MCP Connections, persist selected skills into Skill Hub storage, and publish a marketplace plugin that references those Den resources?"

What Changed

Area	Added / Changed
Import API	Adds preview and import routes under POST /v1/plugins/import-mcps-from-github-url.
GitHub discovery	Parses public GitHub repo/tree URLs and discovers plugin manifests, .mcp.json, and skill files from the plugin root.
MCP import	Creates Den External MCP Connections for supported remote HTTP MCP servers. Local/stdio servers are reported as skipped.
Connection reuse	Reuses an existing connection only when URL, access audience, authType, and credentialMode match the requested import config. Existing grants are not overwritten.
Plugin config	Stores plugin config objects that reference Den resources by metadata, including externalMcpConnectionId and denSkillId.
Skill import	Persists selected plugin skills into Den SkillTable / Skill Hub storage using the current org/member access model.
Plugin cleanup	Tracks plugin-owned connection resources so archive/delete can remove only connections created for that plugin, without deleting reused connections.

API Shape

Endpoint	Purpose
POST /v1/plugins/import-mcps-from-github-url/preview	Returns discovered MCPs and skills with stable selection keys and skip reasons.
POST /v1/plugins/import-mcps-from-github-url	Imports selected supported resources, creates/publishes the plugin, and returns imported/skipped resources.

Security / Trust Boundary

Boundary	Choice
Credentials	OAuth/API key material stays owned by External MCP Connections. Plugin config objects store references and metadata only.
Existing connections	Import never rewrites existing connection grants or credential configuration. A mismatch returns a clear conflict.
Private GitHub repos	Not added here. This path is public GitHub URL import only.
Local MCP execution	Not added here. Local/stdio MCP declarations are skipped for this path.

Not Included

Not in this branch	Why
Den Web import UI	Separate admin/desktop UX branch.
Desktop marketplace install behavior	Separate admin/desktop UX branch.
Skill capability search/execution	Separate skill capability branch.
/dashboard/connections route rename	Walked back; the existing /dashboard/mcp-connections route remains the surface.
Automatic access sync after import	Separate future policy decision.

Validation

Command	Result
pnpm --filter @openwork-ee/den-api build	Passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 8, 2026 4:06am

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.