feat: MCP server + in-repo skills (agent-friendly platform) (#2269)

* feat(api): support global API key from config.yaml (api.global_api_key)

Accept a config-defined global API key anywhere a web-UI key is accepted
(X-API-Key / Bearer), with no login session and no DB record. Useful for
automated deployments and AI agents (HTTP API + MCP). Defaults to empty
(disabled); does not require the lbk_ prefix.

- templates/config.yaml: add api.global_api_key with security notes
- service/apikey.py: verify_api_key checks global key first (constant-time)
- docs/API_KEY_AUTH.md: document the global key + security guidance
- tests: cover global-key match, prefix-free, fallback-to-db, disabled

* feat(mcp): expose LangBot management as an MCP server at /mcp

Add an MCP (Model Context Protocol) server so external AI agents can manage a
LangBot instance. Reuses the same API-key auth as the HTTP API (including the
config.yaml global API key).

- pkg/api/mcp/server.py: FastMCP server wrapping the service layer; 21 curated
  tools across system/bots/pipelines/models/knowledge/mcp-servers/skills
- pkg/api/mcp/mount.py: ASGI dispatcher fronting Quart; authenticates /mcp
  requests with an API key, runs the streamable-HTTP session manager lifespan
- controller/main.py: serve the wrapped ASGI app via hypercorn (was run_task)
- web: new 'MCP' tab in the API integration dialog showing endpoint, auth, and
  client config; i18n for 8 locales
- tests/manual/mcp_smoke.py: e2e check (401 unauth, list tools, call tools)

Tool surface is intentionally curated (not all ~25 route groups) to keep the
agent surface small, safe, and maintainable. Extend deliberately.

* feat(skills): add in-repo skills/ as the single source of truth

Migrate the agent skills + QA/e2e test harness from the (now archived)
langbot-app/langbot-skills repo into LangBot/skills/, and add four new skills.

Migrated:
- langbot-plugin-dev, langbot-testing (e2e), langbot-env-setup,
  langbot-skills-maintenance, langbot-eba-adapter-dev
- the bin/lbs CLI (src/, test/, scripts/, schemas/, qa-agent-docs/)

New:
- langbot-dev      core backend + web development
- langbot-deploy   Docker/K8s deployment + config.yaml + global API key
- langbot-mcp-ops  operating the LangBot MCP server (/mcp)
- langbot-space-ops operating the Space marketplace MCP server

- src/cli.ts repoRoot(): recognize the skills assets root (skills.index.json +
  bin/lbs) so the CLI works when nested inside the LangBot repo
- README.md: unified skill catalog; skills.index.json regenerated

Parity with source verified: bin/lbs validate + node test suite match the
source repo (only the uncommitted .lbpkg build-artifact fixture differs).

* docs(agents): document agent-facing surfaces + API/MCP/skills sync rule

* docs(readme): add 'Built for AI Agents' section across all locales

Highlight MCP server, in-repo skills (single source of truth), AGENTS.md
sync rule, and llms.txt. Cross-link LangBot Space MCP marketplace.

* style(mcp): fix ruff format + prettier lint in MCP server and API panel

* style(web): prettier format MCP i18n locale entries

* docs(skills): note MCP instance control in dev/testing skills

All development-guidance skills now point to the LangBot instance MCP
server (/mcp) and the Space marketplace MCP server, reusing API keys.

web/src/app/home/components/api-integration-dialog/ApiIntegrationPanel.tsx

@@ -86,6 +86,11 @@ export default function ApiIntegrationPanel({
   );
   const [copiedKey, setCopiedKey] = useState<string | null>(null);
 
+  // MCP server endpoint, derived from the current origin. The backend serves
+  // the MCP server at /mcp on the same host/port as the HTTP API + web UI.
+  const mcpEndpoint =
+    typeof window !== 'undefined' ? `${window.location.origin}/mcp` : '/mcp';
+
   // 清理 body 样式，防止嵌套对话框关闭后页面无法交互
   useEffect(() => {
     if (!deleteKeyId && !deleteWebhookId) {
@@ -262,6 +267,7 @@ export default function ApiIntegrationPanel({
           <TabsList>
             <TabsTrigger value="apikeys">{t('common.apiKeys')}</TabsTrigger>
             <TabsTrigger value="webhooks">{t('common.webhooks')}</TabsTrigger>
+            <TabsTrigger value="mcp">{t('common.mcpTab')}</TabsTrigger>
           </TabsList>
           {activeTab === 'apikeys' ? (
             <Button
@@ -272,7 +278,7 @@ export default function ApiIntegrationPanel({
               <Plus className="h-4 w-4" />
               {t('common.createApiKey')}
             </Button>
-          ) : (
+          ) : activeTab === 'webhooks' ? (
             <Button
               onClick={() => setShowCreateWebhookDialog(true)}
               size="sm"
@@ -281,7 +287,7 @@ export default function ApiIntegrationPanel({
               <Plus className="h-4 w-4" />
               {t('common.createWebhook')}
             </Button>
-          )}
+          ) : null}
         </PanelToolbar>
 
         {/* API Keys Tab */}
@@ -455,6 +461,71 @@ export default function ApiIntegrationPanel({
             </div>
           )}
         </TabsContent>
+
+        {/* MCP Tab */}
+        <TabsContent
+          value="mcp"
+          className="min-h-0 flex-1 space-y-4 overflow-auto px-6 py-5"
+        >
+          <p className="text-sm text-muted-foreground">{t('common.mcpHint')}</p>
+
+          <div className="space-y-2">
+            <label className="text-sm font-medium">
+              {t('common.mcpEndpoint')}
+            </label>
+            <div className="flex items-center gap-2">
+              <code className="flex-1 truncate rounded bg-muted px-3 py-2 text-sm">
+                {mcpEndpoint}
+              </code>
+              <Button
+                variant="ghost"
+                size="sm"
+                type="button"
+                onClick={() => handleCopyKey(mcpEndpoint)}
+                title={t('common.copy')}
+              >
+                {copiedKey === mcpEndpoint ? (
+                  <Check className="h-4 w-4 text-green-600" />
+                ) : (
+                  <Copy className="h-4 w-4" />
+                )}
+              </Button>
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <label className="text-sm font-medium">
+              {t('common.mcpAuthTitle')}
+            </label>
+            <p className="text-sm text-muted-foreground">
+              {t('common.mcpAuthDesc')}
+            </p>
+            <pre className="overflow-auto rounded bg-muted px-3 py-2 text-xs">
+              {`X-API-Key: <your-api-key>
+# or
+Authorization: Bearer <your-api-key>`}
+            </pre>
+            <p className="text-sm text-muted-foreground">
+              {t('common.mcpGlobalKeyNote')}
+            </p>
+          </div>
+
+          <div className="space-y-2">
+            <label className="text-sm font-medium">
+              {t('common.mcpClientConfigTitle')}
+            </label>
+            <pre className="overflow-auto rounded bg-muted px-3 py-2 text-xs">
+              {`{
+  "mcpServers": {
+    "langbot": {
+      "url": "${mcpEndpoint}",
+      "headers": { "X-API-Key": "<your-api-key>" }
+    }
+  }
+}`}
+            </pre>
+          </div>
+        </TabsContent>
       </Tabs>
 
       {/* Create API Key Dialog */}

web/src/i18n/locales/en-US.ts

@@ -140,6 +140,16 @@ const enUS = {
     noApiKeys: 'No API keys configured',
     apiKeyHint:
       'API keys allow external systems to access LangBot Service APIs',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot exposes an MCP (Model Context Protocol) server so AI agents can manage this instance. It uses the same API keys as the Service API.',
+    mcpEndpoint: 'MCP Endpoint',
+    mcpAuthTitle: 'Authentication',
+    mcpAuthDesc:
+      'Authenticate with any API key from the API Keys tab, sent as a header:',
+    mcpGlobalKeyNote:
+      'You can also set a global API key in config.yaml (api.global_api_key) to use without logging in.',
+    mcpClientConfigTitle: 'Example MCP client config',
     webhooks: 'Webhooks',
     createWebhook: 'Create Webhook',
     webhookName: 'Webhook Name',

web/src/i18n/locales/es-ES.ts

@@ -144,6 +144,16 @@ const esES = {
     noApiKeys: 'No hay claves API configuradas',
     apiKeyHint:
       'Las claves API permiten a sistemas externos acceder a las API del servicio LangBot',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot exposes an MCP (Model Context Protocol) server so AI agents can manage this instance. It uses the same API keys as the Service API.',
+    mcpEndpoint: 'MCP Endpoint',
+    mcpAuthTitle: 'Authentication',
+    mcpAuthDesc:
+      'Authenticate with any API key from the API Keys tab, sent as a header:',
+    mcpGlobalKeyNote:
+      'You can also set a global API key in config.yaml (api.global_api_key) to use without logging in.',
+    mcpClientConfigTitle: 'Example MCP client config',
     webhooks: 'Webhooks',
     createWebhook: 'Crear Webhook',
     webhookName: 'Nombre del Webhook',

web/src/i18n/locales/ja-JP.ts

@@ -142,6 +142,16 @@ const jaJP = {
     noApiKeys: 'API キーが設定されていません',
     apiKeyHint:
       'API キーを使用すると、外部システムが LangBot Service API にアクセスできます',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot は MCP（Model Context Protocol）サーバーを提供し、AI エージェントがこのインスタンスを管理できます。Service API と同じ API キーを使用します。',
+    mcpEndpoint: 'MCP エンドポイント',
+    mcpAuthTitle: '認証',
+    mcpAuthDesc:
+      '「API キー」タブの任意のキーを、ヘッダーで送信して認証します：',
+    mcpGlobalKeyNote:
+      'config.yaml にグローバル API キー（api.global_api_key）を設定すると、ログインなしで使用できます。',
+    mcpClientConfigTitle: 'MCP クライアント設定の例',
     webhooks: 'Webhooks',
     createWebhook: 'Webhook を作成',
     webhookName: 'Webhook 名',

web/src/i18n/locales/ru-RU.ts

@@ -140,6 +140,16 @@ const ruRU = {
     noApiKeys: 'API-ключи не настроены',
     apiKeyHint:
       'API-ключи позволяют внешним системам получать доступ к API сервисов LangBot',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot exposes an MCP (Model Context Protocol) server so AI agents can manage this instance. It uses the same API keys as the Service API.',
+    mcpEndpoint: 'MCP Endpoint',
+    mcpAuthTitle: 'Authentication',
+    mcpAuthDesc:
+      'Authenticate with any API key from the API Keys tab, sent as a header:',
+    mcpGlobalKeyNote:
+      'You can also set a global API key in config.yaml (api.global_api_key) to use without logging in.',
+    mcpClientConfigTitle: 'Example MCP client config',
     webhooks: 'Вебхуки',
     createWebhook: 'Создать вебхук',
     webhookName: 'Имя вебхука',

web/src/i18n/locales/th-TH.ts

@@ -138,6 +138,16 @@ const thTH = {
     noApiKeys: 'ยังไม่มีคีย์ API ที่กำหนดค่า',
     apiKeyHint:
       'คีย์ API ช่วยให้ระบบภายนอกสามารถเข้าถึง API บริการของ LangBot ได้',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot exposes an MCP (Model Context Protocol) server so AI agents can manage this instance. It uses the same API keys as the Service API.',
+    mcpEndpoint: 'MCP Endpoint',
+    mcpAuthTitle: 'Authentication',
+    mcpAuthDesc:
+      'Authenticate with any API key from the API Keys tab, sent as a header:',
+    mcpGlobalKeyNote:
+      'You can also set a global API key in config.yaml (api.global_api_key) to use without logging in.',
+    mcpClientConfigTitle: 'Example MCP client config',
     webhooks: 'Webhooks',
     createWebhook: 'สร้าง Webhook',
     webhookName: 'ชื่อ Webhook',

web/src/i18n/locales/vi-VN.ts

@@ -141,6 +141,16 @@ const viVN = {
     noApiKeys: 'Chưa cấu hình khóa API nào',
     apiKeyHint:
       'Khóa API cho phép các hệ thống bên ngoài truy cập API dịch vụ LangBot',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot exposes an MCP (Model Context Protocol) server so AI agents can manage this instance. It uses the same API keys as the Service API.',
+    mcpEndpoint: 'MCP Endpoint',
+    mcpAuthTitle: 'Authentication',
+    mcpAuthDesc:
+      'Authenticate with any API key from the API Keys tab, sent as a header:',
+    mcpGlobalKeyNote:
+      'You can also set a global API key in config.yaml (api.global_api_key) to use without logging in.',
+    mcpClientConfigTitle: 'Example MCP client config',
     webhooks: 'Webhooks',
     createWebhook: 'Tạo Webhook',
     webhookName: 'Tên Webhook',

web/src/i18n/locales/zh-Hans.ts

@@ -132,6 +132,15 @@ const zhHans = {
     apiKeyCopied: 'API 密钥已复制到剪贴板',
     noApiKeys: '暂无 API 密钥',
     apiKeyHint: 'API 密钥允许外部系统访问 LangBot 的 Service API',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot 提供 MCP（Model Context Protocol）服务，让 AI Agent 管理本实例，复用与 Service API 相同的 API 密钥。',
+    mcpEndpoint: 'MCP 接入地址',
+    mcpAuthTitle: '鉴权方式',
+    mcpAuthDesc: '使用「API 密钥」标签页中的任意密钥，通过请求头传入：',
+    mcpGlobalKeyNote:
+      '也可在 config.yaml 中设置全局 API 密钥（api.global_api_key），无需登录即可使用。',
+    mcpClientConfigTitle: 'MCP 客户端配置示例',
     webhooks: 'Webhooks',
     createWebhook: '创建 Webhook',
     webhookName: 'Webhook 名称',

web/src/i18n/locales/zh-Hant.ts

@@ -132,6 +132,15 @@ const zhHant = {
     apiKeyCopied: 'API 金鑰已複製到剪貼簿',
     noApiKeys: '暫無 API 金鑰',
     apiKeyHint: 'API 金鑰允許外部系統訪問 LangBot 的 Service API',
+    mcpTab: 'MCP',
+    mcpHint:
+      'LangBot 提供 MCP（Model Context Protocol）服務，讓 AI Agent 管理本實例，複用與 Service API 相同的 API 金鑰。',
+    mcpEndpoint: 'MCP 接入位址',
+    mcpAuthTitle: '驗證方式',
+    mcpAuthDesc: '使用「API 金鑰」標籤頁中的任意金鑰，透過請求標頭傳入：',
+    mcpGlobalKeyNote:
+      '也可在 config.yaml 中設定全域 API 金鑰（api.global_api_key），無需登入即可使用。',
+    mcpClientConfigTitle: 'MCP 用戶端設定範例',
     webhooks: 'Webhooks',
     createWebhook: '建立 Webhook',
     webhookName: 'Webhook 名稱',