The agent can propose a tool server; a human has to plug it in

The coding agent finds a Postgres MCP server in a README and wants it. It can ask. It cannot install it.

POST /api/v1/agent/mcp/import takes the pasted mcpServers block, validates the whole batch: one bad entry aborts everything: and writes the servers disabled. Nothing starts. Turning one on is POST /api/v1/agent/mcp/servers/enable, and that write needs a nonce from write-intents minted for exactly that operation, plus an expect_hash of the current config, so a concurrent edit is a conflict rather than a silent overwrite.

The probe is the sharp edge. POST /api/v1/agent/mcp/probe starts a process or reaches out to a caller-chosen URL, so the gateway refuses it for every machine caller with 403 human_only. The agent cannot self-approve a connection to something it found on the internet. Only a person in an interactive session can.

The tool registry has a door, and the agent is on the outside of it.