connect external tools over MCP

DGC speaks the Model Context Protocol: connect a stdio MCP server and its tools become callable by the agent as mcp__<server>__<tool>.

• /mcp — browse connected servers and their tools, resources, templates and prompts.
• /mcp add docs --url https://mcp.example.com/mcp — connect a remote server. Add --auth-env DOCS_TOKEN to reference a bearer token by its environment variable name.
• /mcp add local-docs --env DOCS_TOKEN -- python /path/to/server.py — configure a local process. Set credential values in those variables before launching DGC; terminal commands accept names, never literal credential arguments. The editor stores the credentials it manages in SecretStorage.
• /mcp edit NAME ... — change an existing definition; add never overwrites a server.
• /mcp disable NAME, /mcp enable NAME — change availability without losing the definition.
• /mcp reconnect NAME — reconnect one server; omit the name to reconnect all enabled servers.
• /mcp remove NAME — disconnect and forget its DGC configuration.

The same commands work outside a chat as dgc mcp .... CLI, TUI and editor share configuration; SecretStorage-only values remain editor-owned, so use an ambient variable reference when a server also needs to start from the terminal.

Choose Resources, Resource templates or Prompts on a connected server, preview its text, and choose Attach to draft. The snapshot stays in a removable chip; reopening management keeps existing text and selections. Templates take a concrete server URI, and prompts accept only their declared arguments.

Terminal examples:

/mcp resources docs
/mcp templates docs
/mcp prompts docs
/mcp read docs docs://api/reference
/mcp prompt docs inspect topic="request validation"
/mcp context
/mcp clear-context

Interactive read and prompt stage a snapshot for the next prompt or goal. dgc mcp read ... prints the result instead. Loading another chat clears terminal staging. Resource URIs belong to the selected server: even a file:// URI is fetched from that server, not opened as a local file. Catalogs and text have explicit bounds; binary/media omissions are reported. Reference text cannot activate skills or grant tool access. Native reads use normal permissions, hooks and redaction; plan mode permits attached snapshots but does not execute live MCP tools.

Remote entries use the pinned [email protected] bridge and require Node/npm. Explicit reconnects allow a cancellable browser sign-in window. Decline stops the connection; use Reconnect to retry an expired login or cold-start failure. OAuth tokens live in the bridge's private user cache, separate from bearer tokens managed by the editor.

For desktop SSH/remote editors, DGC requests callback forwarding before opening sign-in. If the editor changes the callback port or address, forward the remote callback port to the same local port in the Ports panel and reconnect. This bridge cannot use browser-only remote editors that require another callback origin. Terminal SSH needs equivalent forwarding. Device-code support belongs to the provider. See MCP authentication details for verified flows and current bridge limits.

DGC probes the stateless MCP 2026 protocol (server/discover plus self-describing requests). If a handshake-era server rejects that probe, DGC discards the probe process and reconnects cleanly with the legacy initialize lifecycle. Long-running tools update the same tool card with correlated progress and warning/error logs; /mcp reports the negotiated era and connection failures. Per-server config may set log_level to debug, info, notice, warning (default), error, critical, alert, emergency, or off.

Inbound and outbound stdio frames are bounded. If a server stops reading its pipe, the request write remains cancellable, the poisoned process is reaped, and /mcp reports the disconnected state instead of freezing the agent.

Modern roots, elicitation, and tools-free sampling inputs are answered through bounded multi-round-trip requests; legacy elicitation/sampling callbacks are accepted only while exactly one originating tool request is active. Every frontend makes the requesting server visible. Forms reject credential/payment fields and are type-checked again before sharing. URL requests show the exact host and URL, never prefetch, require consent, and allow remote HTTPS or loopback HTTP only. Every frontend asks, the editor included, and the card carries the requesting server, the host, the whole URL, and a warning when the host contains Punycode. The one URL that still opens without a card is the sign-in you started yourself by clicking Connect. Sampling has no tools, MCP context, or project transcript and requires approval before generation and again before its response is disclosed. Unsupported modes are not advertised and fail closed.

Servers are stored in your config under mcp_servers, so they reconnect on the next launch. Treat every configured server command as a trusted executable: its process starts unsandboxed in the workspace, and DGC cannot mediate that process's own filesystem or network activity through tool permissions or the workspace lease.

Headless controllers can enumerate them with the typed list_mcp_tools command and invoke one exact returned route with call_mcp_tool. Calls still pass through permission requests, lifecycle hooks, the workspace lease, cancellation, progress/input consent, redaction, and output bounds.