feat: support standard MCP JSON formats

[RomneyDa]

Description

Adds support for loading MCP servers from .json files containing MCP config(s) in .continue/mcpServers folder(s). Files can be either:

1. A singular JSON config object, in which the name of the file is used as the MCP server name
2. A common format where mcpServers contains a record serverName: config (claude-like)

• Goal: lower friction from using claude-like formats
• Most of the changes in this PR are due to the schema changes required to allow only specifying a url and the associated http -> sse fallback logic
• Templated JSON env vars using ${VAR_NAME} are converted to ${{ secrets.VAR_NAME }} and vice versa
• Loading errors are passed up as nonfatal config validation errors

---

Summary by cubic

Adds support for loading MCP servers from standard JSON configs in .continue/mcpServers (single-file or Claude-style) with automatic HTTP→SSE fallback and OAuth. Refactors MCP types and transport setup, and updates protocol to pass serverId/serverUrl for auth.

• New Features

  • Load MCP servers from JSON files in workspace/global .continue/mcpServers; supports single config or mcpServers record formats.
  • Added YAML↔JSON conversion utilities and schemas in @continuedev/config-yaml, with comprehensive tests.
  • Automatic transport selection (stdio/websocket/streamable-http/sse) with HTTP→SSE fallback when type isn’t specified.
  • Merged requestOptions per server, including headers and verifySsl; OAuth headers added for SSE servers.

• Refactors

  • Replaced MCPOptions with InternalMcpOptions (discriminated unions) and split transport constructors for clarity.
  • Updated MCP Manager comparison logic and improved stdio error output.
  • Protocol change: mcp/startAuthentication and mcp/removeAuthentication now take { serverId, serverUrl }; GUI/CLI/IntelliJ updated. Config package bumped to @continuedev/[email protected].

[cubic-dev-ai]

12 issues found across 27 files

Prompt for AI agents (all 12 issues)

Understand the root cause of the following 12 issues and fix them.


<file name="core/context/mcp/MCPOauth.vitest.ts">

<violation number="1" location="core/context/mcp/MCPOauth.vitest.ts:145">
removeMCPAuth is called with a server ID, but the function expects a URL and keys storage by URL; this will not clear the intended entry.</violation>
</file>

<file name=".continue/mcpServers/DeepWiki.json">

<violation number="1" location=".continue/mcpServers/DeepWiki.json:2">
&#39;type&#39; is an array mixing strings and an object, which is ambiguous for a configuration field and likely to cause parsing/validation issues. Use a single, well-defined value or omit the field if only &#39;url&#39; is needed.</violation>
</file>

<file name="packages/config-yaml/src/browser.ts">

<violation number="1" location="packages/config-yaml/src/browser.ts:17">
Misspelled public API name will be exposed via this re-export; consider aliasing to the correct name convertMcpServersJsonConfigFileToYamlBlocks or renaming at the source.</violation>
</file>

<file name="packages/config-yaml/src/schemas/mcp/index.ts">

<violation number="1" location="packages/config-yaml/src/schemas/mcp/index.ts:2">
Circular dependency introduced by importing from browser.ts which re-exports this module; import requestOptionsSchema directly from schemas/models.js to avoid the cycle.</violation>

<violation number="2" location="packages/config-yaml/src/schemas/mcp/index.ts:21">
url is not validated as a URL; use z.string().url() to ensure correct format and catch misconfigurations early.</violation>

<violation number="3" location="packages/config-yaml/src/schemas/mcp/index.ts:25">
SseMcpServer and HttpMcpServer both alias the same schema, so neither narrows the type discriminator; consider distinct schemas or branded/narrowed types for clarity.</violation>
</file>

<file name="core/protocol/core.ts">

<violation number="1" location="core/protocol/core.ts:163">
Use a consistent property name for the server identifier across MCP protocol messages; align with &quot;id&quot; used by mcp/reloadServer.</violation>
</file>

<file name="extensions/cli/src/services/MCPService.ts">

<violation number="1" location="extensions/cli/src/services/MCPService.ts:391">
Misleading error message: it claims no URL and type specified even when a URL may be present; clarify to reflect actual failure context.</violation>
</file>

<file name="packages/config-yaml/src/schemas/index.ts">

<violation number="1" location="packages/config-yaml/src/schemas/index.ts:135">
override should be optional to match existing wrapper patterns and avoid forcing an override field in MCP server config wrappers.</violation>
</file>

<file name="core/context/mcp/json/loadJsonMcpConfigs.ts">

<violation number="1" location="core/context/mcp/json/loadJsonMcpConfigs.ts:23">
Comment incorrectly describes YAML/Markdown files; update to reflect JSON MCP configs in .continue/mcpServers.</violation>

<violation number="2" location="core/context/mcp/json/loadJsonMcpConfigs.ts:130">
Warnings from convertJsonMcpConfigToYamlMcpConfig are dropped; surface them to users via errors to avoid silent configuration issues.</violation>
</file>

<file name="core/context/mcp/MCPConnection.ts">

<violation number="1" location="core/context/mcp/MCPConnection.ts:190">
Transport is not assigned to this.transport after SSE connect, leading to potential crash in disconnect().</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[RomneyDa]

@Patrick-Erichsen the CodeQL failure is talking about code that was already there to allow e.g. to allow folks to configure ignoring SSL. Feedback is valid but intentional feature and unrelated to this PR

[Patrick-Erichsen]

Beautiful 👌 only thought is we should mention this in the docs somewhere.

[sestinj]

🎉 This PR is included in version 1.1.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[sestinj]

🎉 This PR is included in version 1.22.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀