MCP servers#

DGC speaks the Model Context Protocol: connect a stdio MCP server and its tools become callable by the agent as mcp__<server>__<tool>.

/mcp — list connected servers and their tools.
/mcp add — connect one: give it a name, a command, args, and any env vars.
/mcp remove <name> — disconnect it.

DGC probes the stateless MCP 2026 protocol (server/discover plus self-describing requests). If a handshake-era server rejects that probe, DGC discards the probe process and reconnects cleanly with the legacy initialize lifecycle. Long-running tools update the same tool card with correlated progress and warning/error logs; /mcp reports the negotiated era and connection failures. Per-server config may set log_level to debug, info, notice, warning (default), error, critical, alert, emergency, or off.

Inbound and outbound stdio frames are bounded. If a server stops reading its pipe, the request write remains cancellable, the poisoned process is reaped, and /mcp reports the disconnected state instead of freezing the agent.

Modern roots, elicitation, and tools-free sampling inputs are answered through bounded multi-round-trip requests; legacy elicitation/sampling callbacks are accepted only while exactly one originating tool request is active. Every frontend makes the requesting server visible. Forms reject credential/payment fields and are type-checked again before sharing. URL requests show the exact host and URL, never prefetch, require consent, and allow remote HTTPS or loopback HTTP only. Sampling has no tools, MCP context, or project transcript and requires approval before generation and again before its response is disclosed. Unsupported modes are not advertised and fail closed.

Servers are stored in your config under mcp_servers, so they reconnect on the next launch.

Headless controllers can enumerate them with the typed list_mcp_tools command and invoke one exact returned route with call_mcp_tool. Calls still pass through permission requests, lifecycle hooks, the workspace lease, cancellation, progress/input consent, redaction, and output bounds.