feat(copilot): expose server-managed tools over MCP

.husky/pre-commit

@@ -1 +1 @@
-bunx lint-staged
+bunx lint-staged

AGENTS.md

@@ -6,8 +6,7 @@
 - Do not add legacy support; updates should be clean and avoid extra project complexity.
 - We do not need any form of legacy support as the project is under fresh dev, do not add any form of legacy backfill path
 - This project does not support any legacy methods.
-- Ignore all license related issues.
-- Project uses `Bun` pacakge manager with turborepo.
+- Project uses `Bun` pacakge manager with turborepo, find project defined scripts in `/pacakge.json` for testing.
 - Prefer removing lines of code over adding more lines of code to reduce project complexity.
 
 ## Planning

README.md

@@ -48,7 +48,33 @@ It is built for analytics, research, charting, monitoring, and workflow automati
   <img alt="Project Overview" src="apps/tradinggoose/public/static/preview-light.png" width="2559">
 </picture>
 
+---
+
+### Copilot-MCP
+
+You can install TradingGoose MCP to use any local agentic tool like Codex, Claude Code, Cursor, ZCode as Copilot to perform TradingGoose-Studio operations
+
+#### Mac/Linux:
+connect to the hosted instance:
+```
+curl -fsSL https://TradingGoose.ai/mcp/setup | sh
+``` 
 
+connect to self-hosted instance:
+```
+curl -fsSL http://localhost:3000/mcp/setup | sh
+``` 
+
+#### Windows
+connect to the hosted instance:
+```
+irm https://TradingGoose.ai/mcp/setup | iex
+``` 
+
+connect to self-hosted instance:
+```
+irm http://localhost:3000/mcp/setup | iex
+``` 
 
 ## Quick Start
 
@@ -86,12 +112,10 @@ cd ../../packages/db && cp .env.example .env
 
 #### 4. Run database migrations
 ```
-cd packages/db
-bunx drizzle-kit migrate --config=./drizzle.config.ts
+bun run db:migrate
 ```
-#### 5. Start development servers
+#### 5. Start full development servers
 ```
-cd ../..
 bun run dev:full
 ```
 
@@ -101,9 +125,9 @@ If you use Docker Compose, copy `apps/tradinggoose/.env.example.docker` to
 `apps/tradinggoose/.env` and set the required secrets before running the
 compose manifests. The `.env` must include `POSTGRES_*`,
 `NEXT_PUBLIC_APP_URL`, `NEXT_PUBLIC_SOCKET_URL`, `BETTER_AUTH_SECRET`,
-`ENCRYPTION_KEY`, `API_ENCRYPTION_KEY`, and `INTERNAL_API_SECRET`. The
-`ENCRYPTION_KEY` value is shared by both the app and realtime containers, and
-`API_ENCRYPTION_KEY` enables encrypted API-key storage in the app container.
+`ENCRYPTION_KEY`, and `INTERNAL_API_SECRET`. Set `API_ENCRYPTION_KEY` when
+API-key access or MCP token issuance is used; it encrypts API keys at rest in
+the app container.
 `NEXT_PUBLIC_SOCKET_URL` should point at `http://localhost:3002` for local
 Compose runs; production deployments must override it with a browser-reachable
 public URL. The prod and Ollama compose files also require `IMAGE_TAG` and

apps/tradinggoose/.env.example

@@ -43,9 +43,9 @@ BETTER_AUTH_SECRET="replace-with-64-hex-characters"
 # Generate a secure 64-character hex secret.
 ENCRYPTION_KEY="replace-with-64-hex-characters"
 
-# Recommended: dedicated encryption key for stored API credentials.
+# Optional unless API-key access or MCP token issuance is used.
 # Generate a secure 64-character hex secret.
-API_ENCRYPTION_KEY="replace-with-64-hex-characters"
+API_ENCRYPTION_KEY=""
 
 # Required: internal server-to-server auth secret used by app routes, sockets,
 # cron endpoints, and other internal calls.

apps/tradinggoose/.env.example.docker

@@ -25,6 +25,9 @@ OLLAMA_IMAGE_TAG=latest
 # Security (Required)
 # Use `openssl rand -hex 32` to generate, used to encrypt environment variables
 ENCRYPTION_KEY=generate-the-key  
+# Optional unless API-key access or MCP token issuance is used.
+# Use `openssl rand -hex 32` to generate, used to encrypt API keys
+API_ENCRYPTION_KEY=
 # Use `openssl rand -hex 32` to generate, used to encrypt internal api routes
 INTERNAL_API_SECRET=generate-the-secret  
 

apps/tradinggoose/app/[locale]/(auth)/mcp/authorize/page.test.tsx

@@ -0,0 +1,101 @@
+import type React from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockGetSession,
+  mockGetSessionCookie,
+  mockHeaders,
+  mockCreateMcpDeviceLoginApprovalChallenge,
+  mockRedirect,
+} = vi.hoisted(() => ({
+  mockCreateMcpDeviceLoginApprovalChallenge: vi.fn(),
+  mockGetSession: vi.fn(),
+  mockGetSessionCookie: vi.fn(),
+  mockHeaders: vi.fn(),
+  mockRedirect: vi.fn(),
+}))
+
+vi.mock('next/headers', () => ({
+  headers: () => mockHeaders(),
+}))
+
+vi.mock('better-auth/cookies', () => ({
+  getSessionCookie: (...args: unknown[]) => mockGetSessionCookie(...args),
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: (...args: unknown[]) => mockGetSession(...args),
+}))
+
+vi.mock('@/lib/mcp/auth', () => ({
+  createMcpDeviceLoginApprovalChallenge: (...args: unknown[]) =>
+    mockCreateMcpDeviceLoginApprovalChallenge(...args),
+}))
+
+vi.mock('@/app/(auth)/components/auth-page-header', () => ({
+  AuthPageHeader: ({
+    description,
+    eyebrow,
+    title,
+  }: {
+    description: string
+    eyebrow: string
+    title: string
+  }) => (
+    <header>
+      <p>{eyebrow}</p>
+      <h1>{title}</h1>
+      <p>{description}</p>
+    </header>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, ...props }: React.ButtonHTMLAttributes<HTMLButtonElement>) => (
+    <button {...props}>{children}</button>
+  ),
+}))
+
+vi.mock('@/app/fonts/inter', () => ({
+  inter: { className: 'inter' },
+}))
+
+vi.mock('@/i18n/navigation', () => ({
+  redirect: (...args: unknown[]) => mockRedirect(...args),
+}))
+
+describe('MCP authorize page', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.resetModules()
+    mockHeaders.mockResolvedValue(new Headers())
+    mockGetSessionCookie.mockReturnValue(null)
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockCreateMcpDeviceLoginApprovalChallenge.mockResolvedValue({
+      status: 'pending',
+      approvalToken: 'approval-token',
+      expiresAt: '2026-06-19T12:00:00.000Z',
+    })
+  })
+
+  it('renders a confirmation form with a user-bound approval challenge', async () => {
+    const McpAuthorizePage = (await import('./page')).default
+
+    const result = await McpAuthorizePage({
+      params: Promise.resolve({ locale: 'es' }),
+      searchParams: Promise.resolve({ code: 'login-code' }),
+    })
+    const markup = renderToStaticMarkup(result)
+
+    expect(mockCreateMcpDeviceLoginApprovalChallenge).toHaveBeenCalledWith({
+      code: 'login-code',
+      userId: 'user-1',
+    })
+    expect(markup).toContain('Aprobar clave API personal')
+    expect(markup).toContain('method="post"')
+    expect(markup).toContain('action="/api/auth/mcp/authorize"')
+    expect(markup).toContain('name="approvalToken"')
+    expect(markup).toContain('value="approval-token"')
+  })
+})

apps/tradinggoose/app/[locale]/(auth)/mcp/authorize/page.tsx

@@ -0,0 +1,121 @@
+import { getSessionCookie } from 'better-auth/cookies'
+import { headers } from 'next/headers'
+import { Button } from '@/components/ui/button'
+import { getSession } from '@/lib/auth'
+import { createMcpDeviceLoginApprovalChallenge } from '@/lib/mcp/auth'
+import { AuthPageHeader } from '@/app/(auth)/components/auth-page-header'
+import { inter } from '@/app/fonts/inter'
+import { redirect } from '@/i18n/navigation'
+import { getPublicCopy } from '@/i18n/public-copy'
+import { normalizeLocaleCode } from '@/i18n/utils'
+
+export const dynamic = 'force-dynamic'
+
+type SearchParams = Promise<{
+  code?: string | string[]
+  status?: string | string[]
+}>
+
+export default async function McpAuthorizePage({
+  params,
+  searchParams,
+}: {
+  params: Promise<{ locale: string }>
+  searchParams: SearchParams
+}) {
+  const [{ locale: routeLocale }, query, requestHeaders] = await Promise.all([
+    params,
+    searchParams,
+    headers(),
+  ])
+  const locale = normalizeLocaleCode(routeLocale)
+  const mcpCopy = getPublicCopy(locale).auth.mcp
+  const code = Array.isArray(query.code) ? query.code[0] : query.code
+  const rawStatus = Array.isArray(query.status) ? query.status[0] : query.status
+  const statusCopy =
+    rawStatus === 'approved'
+      ? mcpCopy.approved
+      : rawStatus === 'cancelled'
+        ? mcpCopy.cancelled
+        : rawStatus === 'expired'
+          ? mcpCopy.expired
+          : rawStatus === 'invalid'
+            ? mcpCopy.invalid
+            : null
+  const renderStatus = (copy: { title: string; description: string }) => (
+    <div className='space-y-8 text-center'>
+      <AuthPageHeader eyebrow={mcpCopy.eyebrow} title={copy.title} description={copy.description} />
+    </div>
+  )
+
+  if (statusCopy) {
+    return renderStatus(statusCopy)
+  }
+
+  if (!code) {
+    return renderStatus(mcpCopy.invalid)
+  }
+
+  const session = await getSession(requestHeaders)
+  if (!session?.user?.id) {
+    return redirect({
+      href: {
+        pathname: '/login',
+        query: {
+          ...(getSessionCookie(requestHeaders) ? { reauth: '1' } : {}),
+          callbackUrl: `/${locale}/mcp/authorize?code=${encodeURIComponent(code)}`,
+        },
+      },
+      locale,
+    })
+  }
+
+  const approvalStatus = await createMcpDeviceLoginApprovalChallenge({
+    code,
+    userId: session.user.id,
+  })
+
+  if (approvalStatus.status === 'expired') {
+    return renderStatus(mcpCopy.expired)
+  }
+
+  if (approvalStatus.status === 'approved') {
+    return renderStatus(mcpCopy.approved)
+  }
+
+  if (approvalStatus.status !== 'pending') {
+    return renderStatus(mcpCopy.invalid)
+  }
+
+  return (
+    <div className='space-y-8 text-center'>
+      <AuthPageHeader
+        eyebrow={mcpCopy.eyebrow}
+        title={mcpCopy.confirm.title}
+        description={mcpCopy.confirm.description}
+      />
+      <form method='post' action='/api/auth/mcp/authorize' className='space-y-3'>
+        <input type='hidden' name='code' value={code} />
+        <input type='hidden' name='approvalToken' value={approvalStatus.approvalToken} />
+        <input type='hidden' name='locale' value={locale} />
+        <div className='flex flex-col gap-3 sm:flex-row sm:justify-center'>
+          <Button type='submit' name='action' value='approve' className='text-[15px]'>
+            {mcpCopy.confirm.approve}
+          </Button>
+          <Button
+            type='submit'
+            name='action'
+            value='cancel'
+            variant='outline'
+            className='text-[15px]'
+          >
+            {mcpCopy.confirm.cancel}
+          </Button>
+        </div>
+      </form>
+      <p className={`${inter.className} text-muted-foreground text-sm`}>
+        {mcpCopy.confirm.terminalHint}
+      </p>
+    </div>
+  )
+}

apps/tradinggoose/app/[locale]/workspace/page.test.tsx

@@ -7,6 +7,7 @@ const mockRedirect = vi.fn((url: string) => {
 const mockGetSession = vi.fn()
 const mockHeaders = vi.fn()
 const mockGetUserWorkspaces = vi.fn()
+const mockCreateDefaultWorkspaceForUser = vi.fn()
 const mockReadWorkflowAccessContext = vi.fn()
 
 function mockLocalizedRedirect({
@@ -38,6 +39,7 @@ vi.mock('@/lib/auth', () => ({
 }))
 
 vi.mock('@/lib/workspaces/service', () => ({
+  createDefaultWorkspaceForUser: (...args: unknown[]) => mockCreateDefaultWorkspaceForUser(...args),
   getUserWorkspaces: (...args: unknown[]) => mockGetUserWorkspaces(...args),
 }))
 
@@ -72,6 +74,7 @@ describe('Workspace root page access guard', () => {
       },
     })
     mockGetUserWorkspaces.mockResolvedValue([{ id: 'workspace-1' }])
+    mockCreateDefaultWorkspaceForUser.mockResolvedValue({ id: 'workspace-created' })
     mockReadWorkflowAccessContext.mockResolvedValue(null)
   })
 
@@ -146,20 +149,16 @@ describe('Workspace root page access guard', () => {
 
     expect(mockGetUserWorkspaces).toHaveBeenCalledWith({
       userId: 'user-1',
-      userName: 'Ada Lovelace',
     })
   })
 
-  it('bootstraps a workspace on the server when the user has none and redirects to it', async () => {
-    mockGetUserWorkspaces.mockResolvedValue([{ id: 'workspace-bootstrapped' }])
+  it('repairs authenticated users with no workspace from the workspace entrypoint', async () => {
+    mockGetUserWorkspaces.mockResolvedValue([])
 
     await expect(renderWorkspacePage('en')).rejects.toThrow(
-      'redirect:/en/workspace/workspace-bootstrapped/dashboard'
+      'redirect:/en/workspace/workspace-created/dashboard'
     )
 
-    expect(mockGetUserWorkspaces).toHaveBeenCalledWith({
-      userId: 'user-1',
-      userName: 'Ada Lovelace',
-    })
+    expect(mockCreateDefaultWorkspaceForUser).toHaveBeenCalledWith('user-1', 'Ada Lovelace')
   })
 })

apps/tradinggoose/app/[locale]/workspace/page.tsx

@@ -2,7 +2,7 @@ import { getSessionCookie } from 'better-auth/cookies'
 import { headers } from 'next/headers'
 import { getSession } from '@/lib/auth'
 import { readWorkflowAccessContext } from '@/lib/workflows/utils'
-import { getUserWorkspaces } from '@/lib/workspaces/service'
+import { createDefaultWorkspaceForUser, getUserWorkspaces } from '@/lib/workspaces/service'
 import { redirect } from '@/i18n/navigation'
 import { type LocaleCode, normalizeCallbackUrl, requireCanonicalCallbackPath } from '@/i18n/utils'
 
@@ -87,14 +87,9 @@ export default async function WorkspacePage({
     }
   }
 
-  const [workspace] = await getUserWorkspaces({
-    userId,
-    userName: session.user.name,
-  })
+  const [workspace] = await getUserWorkspaces({ userId })
+  const targetWorkspace =
+    workspace ?? (await createDefaultWorkspaceForUser(userId, session.user.name))
 
-  if (!workspace) {
-    throw new Error('Expected workspace bootstrap to return a workspace')
-  }
-
-  return redirect({ href: `/workspace/${workspace.id}/dashboard`, locale })
+  return redirect({ href: `/workspace/${targetWorkspace.id}/dashboard`, locale })
 }