---
kind: task
slug: agent-mcp-starter
title: Agent onboarding and repository bootstrap
plan_slug: automation-foundation
epic_slug: repo-discovery-onboarding
status: ready
priority: P2
tenant_id: global
owner: unassigned
cursor_todo_id: null
updated_at: "2026-09-25"
---

# Task summary

Show client-specific, copyable setup instructions for connecting OpenCode and Cursor to Echodo's supported MCP transport, with an optional repository bootstrap PR only when forge commit primitives exist.

## Description

Generated setup must reflect the actual MCP server contract. A browser-visible snippet must never contain `DATABASE_URL`, forge credentials, or model-provider secrets. Workspace selection should use a non-secret workspace slug/tool argument unless a supported authenticated remote transport defines another mechanism.

## Subtasks

- [ ] Verify and document the supported MCP transport and configuration shape before generating templates.
- [ ] Add a typed onboarding-config endpoint returning only non-secret deployment, workspace, and selected-repo identifiers.
- [ ] Add OpenCode and Cursor tabs with validated configuration examples, prerequisites, copy feedback, and a `query_manifest_status` smoke test.
- [ ] Detect unsupported deployment/client combinations and show actionable guidance instead of fabricated JSON.
- [ ] Determine whether forge adapters support branch creation plus file commits. If not, defer bootstrap PR to a new task.
- [ ] If supported, create an idempotent branch/file/commit/PR flow that never overwrites an existing `.convoys/README.md` without confirmation.

## Security constraints

- Never render `DATABASE_URL`, PAT values, OAuth access tokens, or API-key values.
- Remote-write actions require workspace owner/admin.
- `createPullRequest` alone is insufficient to bootstrap a file; the branch and commit must exist first.

## Estimation

M

## Acceptance criteria

- [ ] OpenCode and Cursor examples are syntactically valid for their actual clients and the deployed transport.
- [ ] Instructions identify the workspace/repo without embedding a secret.
- [ ] Copy success/error feedback works in supported browser contexts.
- [ ] The smoke test confirms the agent can query convoy state.
- [ ] Bootstrap is either implemented end-to-end with an idempotent PR URL or explicitly deferred with a new backlog task.
- [ ] Web lint, type-check, and relevant tests pass.

## Links

- Epic: `./Epic-repo-discovery-onboarding.md`
- Depends on: `./Task-repo-picker-modal.md`, `./Task-repo-doc-ingestion.md`
- Convoy brief: `../../../.convoys/repo-discovery-onboarding/brief-4-agent-mcp.md`