Merge pull request #67 from openagentlock/codex/oal43-mcp-pins-list

Add MCP pins list

Author: knhn1004

control-plane/api/openapi.yaml

@@ -111,7 +111,17 @@ paths:
           description: verdict
           content:
             application/json:
-              schema: { $ref: '#/components/schemas/GateCheckResponse' }
+              schema: { $ref: '#/components/schemas/McpPinCheckResponse' }
+
+  /v1/mcp/pins:
+    get:
+      summary: List pinned MCP server fingerprints.
+      responses:
+        "200":
+          description: current pins
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/McpPinsResponse' }
 
   /v1/mcp/pin/accept:
     post:
@@ -121,7 +131,9 @@ paths:
         content:
           application/json:
             schema: { $ref: '#/components/schemas/McpPinAccept' }
-      responses: { "204": { description: pinned } }
+      responses:
+        "200":
+          description: pinned
 
   /v1/ledger/tail:
     get:
@@ -300,20 +312,44 @@ components:
 
     McpPinCheck:
       type: object
-      required: [server_label, fingerprint]
+      required: [server, fingerprint]
       properties:
-        server_label: { type: string }
+        server: { type: string }
         fingerprint: { type: string }
 
+    McpPinCheckResponse:
+      type: object
+      required: [status, server, fingerprint]
+      properties:
+        status: { type: string, enum: [unknown, known, changed] }
+        server: { type: string }
+        fingerprint: { type: string }
+        known_fingerprint: { type: string }
+
     McpPinAccept:
       type: object
-      required: [server_label, fingerprint, server_info, signature]
+      required: [server, fingerprint]
       properties:
-        server_label: { type: string }
+        server: { type: string }
         fingerprint: { type: string }
         server_info: { type: object, additionalProperties: true }
         signature: { type: string }
 
+    McpPin:
+      type: object
+      required: [server, fingerprint]
+      properties:
+        server: { type: string }
+        fingerprint: { type: string }
+
+    McpPinsResponse:
+      type: object
+      required: [pins]
+      properties:
+        pins:
+          type: array
+          items: { $ref: '#/components/schemas/McpPin' }
+
     LedgerRoot:
       type: object
       required: [root, seq, genesis_pubkey, computed_at]

control-plane/dashboard-ui/src/hooks/usePoll.ts

@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { apiJSON, apiSend } from "@/lib/api";
-import type { ModeInfo, PolicyView, RootInfo, SessionsResponse } from "@/lib/types";
+import type { MCPPinsResponse, ModeInfo, PolicyView, RootInfo, SessionsResponse } from "@/lib/types";
 
 export function usePoll(fn: () => void | Promise<void>, intervalMs: number, paused = false): void {
   const fnRef = useRef(fn);
@@ -136,3 +136,26 @@ export function useSessions(active: boolean): {
 
   return { data, error, refresh };
 }
+
+export function useMCPPins(active: boolean): {
+  data: MCPPinsResponse | null;
+  error: string | null;
+  refresh: () => Promise<void>;
+} {
+  const [data, setData] = useState<MCPPinsResponse | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  const refresh = useCallback(async () => {
+    try {
+      const pins = await apiJSON<MCPPinsResponse>("/v1/mcp/pins");
+      setData(pins);
+      setError(null);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  }, []);
+
+  usePoll(refresh, 5000, !active);
+
+  return { data, error, refresh };
+}

control-plane/dashboard-ui/src/lib/types.ts

@@ -58,6 +58,15 @@ export interface SessionsResponse {
   sessions: SessionRow[];
 }
 
+export interface MCPPinRow {
+  server: string;
+  fingerprint: string;
+}
+
+export interface MCPPinsResponse {
+  pins: MCPPinRow[];
+}
+
 export interface RootInfo {
   root: string;
   seq: number;

control-plane/dashboard-ui/src/routeTree.gen.ts

@@ -11,6 +11,7 @@
 import { Route as rootRouteImport } from './routes/__root'
 import { Route as SessionsRouteImport } from './routes/sessions'
 import { Route as RulesRouteImport } from './routes/rules'
+import { Route as McpRouteImport } from './routes/mcp'
 import { Route as EventsRouteImport } from './routes/events'
 import { Route as IndexRouteImport } from './routes/index'
 
@@ -24,6 +25,11 @@ const RulesRoute = RulesRouteImport.update({
   path: '/rules',
   getParentRoute: () => rootRouteImport,
 } as any)
+const McpRoute = McpRouteImport.update({
+  id: '/mcp',
+  path: '/mcp',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const EventsRoute = EventsRouteImport.update({
   id: '/events',
   path: '/events',
@@ -38,33 +44,37 @@ const IndexRoute = IndexRouteImport.update({
 export interface FileRoutesByFullPath {
   '/': typeof IndexRoute
   '/events': typeof EventsRoute
+  '/mcp': typeof McpRoute
   '/rules': typeof RulesRoute
   '/sessions': typeof SessionsRoute
 }
 export interface FileRoutesByTo {
   '/': typeof IndexRoute
   '/events': typeof EventsRoute
+  '/mcp': typeof McpRoute
   '/rules': typeof RulesRoute
   '/sessions': typeof SessionsRoute
 }
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
   '/': typeof IndexRoute
   '/events': typeof EventsRoute
+  '/mcp': typeof McpRoute
   '/rules': typeof RulesRoute
   '/sessions': typeof SessionsRoute
 }
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
-  fullPaths: '/' | '/events' | '/rules' | '/sessions'
+  fullPaths: '/' | '/events' | '/mcp' | '/rules' | '/sessions'
   fileRoutesByTo: FileRoutesByTo
-  to: '/' | '/events' | '/rules' | '/sessions'
-  id: '__root__' | '/' | '/events' | '/rules' | '/sessions'
+  to: '/' | '/events' | '/mcp' | '/rules' | '/sessions'
+  id: '__root__' | '/' | '/events' | '/mcp' | '/rules' | '/sessions'
   fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
   IndexRoute: typeof IndexRoute
   EventsRoute: typeof EventsRoute
+  McpRoute: typeof McpRoute
   RulesRoute: typeof RulesRoute
   SessionsRoute: typeof SessionsRoute
 }
@@ -85,6 +95,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof RulesRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/mcp': {
+      id: '/mcp'
+      path: '/mcp'
+      fullPath: '/mcp'
+      preLoaderRoute: typeof McpRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/events': {
       id: '/events'
       path: '/events'
@@ -105,6 +122,7 @@ declare module '@tanstack/react-router' {
 const rootRouteChildren: RootRouteChildren = {
   IndexRoute: IndexRoute,
   EventsRoute: EventsRoute,
+  McpRoute: McpRoute,
   RulesRoute: RulesRoute,
   SessionsRoute: SessionsRoute,
 }

control-plane/dashboard-ui/src/routes/__root.tsx

@@ -14,6 +14,7 @@ function RootLayout() {
           { to: "/events", label: "Events" },
           { to: "/rules", label: "Rules" },
           { to: "/sessions", label: "Sessions" },
+          { to: "/mcp", label: "MCP" },
         ]}
       />
       <main className="p-5">

control-plane/dashboard-ui/src/routes/mcp.tsx

@@ -0,0 +1,54 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { useMCPPins } from "@/hooks/usePoll";
+import { shortHash } from "@/lib/filters";
+
+function MCPTab() {
+  const { data, error } = useMCPPins(true);
+  const pins = data?.pins ?? [];
+
+  return (
+    <div className="space-y-4">
+      <section className="oal-panel">
+        <div className="flex items-center gap-3 mb-3">
+          <div className="text-[11px] uppercase tracking-wider text-muted">MCP pins</div>
+          <div className="text-[11px] text-muted font-mono ml-2">{pins.length} pinned</div>
+        </div>
+
+        {error && <div className="text-xs text-deny mb-2">{error}</div>}
+
+        <div className="overflow-x-auto">
+          <table className="oal-table">
+            <thead>
+              <tr>
+                <th>server</th>
+                <th>fingerprint</th>
+              </tr>
+            </thead>
+            <tbody>
+              {pins.length === 0 ? (
+                <tr>
+                  <td colSpan={2} className="text-center text-muted py-4">
+                    no MCP pins
+                  </td>
+                </tr>
+              ) : (
+                pins.map((pin) => (
+                  <tr key={pin.server}>
+                    <td className="font-mono">{pin.server}</td>
+                    <td className="font-mono text-muted" title={pin.fingerprint}>
+                      {shortHash(pin.fingerprint, 24)}
+                    </td>
+                  </tr>
+                ))
+              )}
+            </tbody>
+          </table>
+        </div>
+      </section>
+    </div>
+  );
+}
+
+export const Route = createFileRoute("/mcp")({
+  component: MCPTab,
+});

control-plane/internal/api/mcp.go

@@ -38,6 +38,15 @@ type pinCheckResponse struct {
 	KnownFingerprint string `json:"known_fingerprint,omitempty"`
 }
 
+type mcpPinRow struct {
+	Server      string `json:"server"`
+	Fingerprint string `json:"fingerprint"`
+}
+
+type mcpPinsResponse struct {
+	Pins []mcpPinRow `json:"pins"`
+}
+
 func mcpPinCheckHandler(d Deps) http.HandlerFunc {
 	if d.Store == nil || d.PinStorePath == "" {
 		return todo("mcp.pin.check")
@@ -68,6 +77,32 @@ func mcpPinCheckHandler(d Deps) http.HandlerFunc {
 	}
 }
 
+func mcpPinsListHandler(d Deps) http.HandlerFunc {
+	if d.PinStorePath == "" {
+		return todo("mcp.pins.list")
+	}
+	return func(w http.ResponseWriter, r *http.Request) {
+		pins, err := readPins(d.PinStorePath)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, "storage_error", err.Error())
+			return
+		}
+		servers := make([]string, 0, len(pins))
+		for server := range pins {
+			servers = append(servers, server)
+		}
+		sort.Strings(servers)
+		rows := make([]mcpPinRow, 0, len(servers))
+		for _, server := range servers {
+			rows = append(rows, mcpPinRow{
+				Server:      server,
+				Fingerprint: pins[server],
+			})
+		}
+		writeJSON(w, http.StatusOK, mcpPinsResponse{Pins: rows})
+	}
+}
+
 func mcpPinAcceptHandler(d Deps) http.HandlerFunc {
 	if d.Store == nil || d.PinStorePath == "" {
 		return todo("mcp.pin.accept")