feat(mcp): MCP server for AI agents, agent scopes on API keys, switches in settings

MindSift now speaks MCP (Streamable HTTP, stateless JSON-RPC) at POST /api/v1/mcp so
Claude Code, Codex, Claude Desktop, Cursor and custom agents can read, create and
complete tasks and keep shared lists. API keys get the scopes tasks:read/write and
lists:read/write; tools/list only shows what the key may call and every tool checks
its scope. Task and list write paths are shared helpers (updateTask, createTask,
addListItem, setListItemDone) used by REST and MCP alike.

Settings: scope selection and the SectionPicker (import, restore) use ToggleSwitch
rows instead of checkbox-like buttons; new MCP section with connection snippets for
Claude Code, Codex and JSON configs. Docs, README, help and changelog updated; v0.28.0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/api/handlers_integrations.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/sandrodach/mindsift/internal/auth"
+	"github.com/sandrodach/mindsift/internal/domain"
 	"github.com/sandrodach/mindsift/internal/storage"
 )
 
@@ -187,49 +188,72 @@ func (s *Server) handleWebhookIngest(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
-// ingestTask creates a task directly (scope webhook:task), optionally in a task list the owner of
-// the key may write to.
-func (s *Server) ingestTask(w http.ResponseWriter, userID, content, priority, source, dueDate, taskListID string) {
+// createTask creates a task directly (webhook scope webhook:task, MCP tool create_task), optionally in
+// a task list the user may write to (otherwise storage.ErrTaskListReadOnly).
+func (s *Server) createTask(userID, content, priority, source, dueDate, taskListID, notes string) (*domain.Thought, error) {
 	if priority == "" {
 		priority = "normal"
 	}
 	if taskListID != "" && !s.store.CanEditTaskList(userID, taskListID) {
-		writeError(w, http.StatusForbidden, storage.ErrTaskListReadOnly.Error())
-		return
+		return nil, storage.ErrTaskListReadOnly
 	}
-	thought, err := s.store.CreateThoughtWithDetails(userID, content, priority, source, dueDate, taskListID, "todo", "")
+	thought, err := s.store.CreateThoughtWithDetails(userID, content, priority, source, dueDate, taskListID, "todo", notes)
 	if err != nil {
-		writeStoreError(w, http.StatusBadRequest, err)
-		return
+		return nil, err
 	}
 	task, err := s.store.UpdateThoughtTriage(userID, thought.ID, "keep", "task", "", dueDate, taskListID)
+	if err != nil {
+		return nil, err
+	}
+	s.wsHub.BroadcastToUsers(s.taskAudience(task), "TASK_CREATED", task)
+	return task, nil
+}
+
+func (s *Server) ingestTask(w http.ResponseWriter, userID, content, priority, source, dueDate, taskListID string) {
+	task, err := s.createTask(userID, content, priority, source, dueDate, taskListID, "")
+	if errors.Is(err, storage.ErrTaskListReadOnly) {
+		writeError(w, http.StatusForbidden, err.Error())
+		return
+	}
 	if err != nil {
 		writeStoreError(w, http.StatusBadRequest, err)
 		return
 	}
-	s.wsHub.BroadcastToUsers(s.taskAudience(task), "TASK_CREATED", task)
 	writeJSON(w, http.StatusCreated, map[string]interface{}{"status": "ingested", "task": task})
 }
 
+var errListIDRequired = errors.New("Feld 'listId' ist für Listeneinträge erforderlich")
+
+// addListItem appends an item to a list the user may write to; the error is storage.ErrListReadOnly for
+// viewers and "not found" for lists the user cannot see.
+func (s *Server) addListItem(userID, listID, content, category, quantity string) (*domain.ListItem, error) {
+	if strings.TrimSpace(listID) == "" {
+		return nil, errListIDRequired
+	}
+	if err := s.store.EnsureListItemsWritable(userID, listID, ""); err != nil {
+		return nil, err
+	}
+	item, err := s.store.CreateListItem(listID, content, category, quantity, 0, userID)
+	if err != nil {
+		return nil, err
+	}
+	s.wsHub.BroadcastListEvent(listID, "ITEM_CREATED", item)
+	return item, nil
+}
+
 // ingestListItem adds an item to a list (scope webhook:list) the owner of the key may write to.
 func (s *Server) ingestListItem(w http.ResponseWriter, userID, listID, content, category, quantity string) {
-	if strings.TrimSpace(listID) == "" {
-		writeError(w, http.StatusBadRequest, "Feld 'listId' ist für Listeneinträge erforderlich")
-		return
-	}
-	if err := s.store.EnsureListItemsWritable(userID, listID, ""); err != nil {
+	item, err := s.addListItem(userID, listID, content, category, quantity)
+	if err != nil {
 		status := http.StatusNotFound
-		if errors.Is(err, storage.ErrListReadOnly) {
+		switch {
+		case errors.Is(err, storage.ErrListReadOnly):
 			status = http.StatusForbidden
+		case errors.Is(err, errListIDRequired):
+			status = http.StatusBadRequest
 		}
 		writeError(w, status, err.Error())
 		return
 	}
-	item, err := s.store.CreateListItem(listID, content, category, quantity, 0, userID)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	s.wsHub.BroadcastListEvent(listID, "ITEM_CREATED", item)
 	writeJSON(w, http.StatusCreated, map[string]interface{}{"status": "ingested", "item": item})
 }