[Taskmaster-1]

What

An App directory on the Connections page: 41 remote MCP servers that connect in one click. Sign-in happens on the app's own site, and every tool falls under the usual effects and approval rules.

• Projects: Jira & Confluence, Asana, monday.com, ClickUp, Todoist, Linear (MCP)
• Docs: Notion, Miro
• Meetings: Granola, Fireflies, Krisp, Cal.com
• Sales & support: Intercom, Attio, Close
• Payments: Stripe, PayPal, Square, Ramp, Mercury
• Design & sites: Canva, Webflow, Wix, Jotform
• Engineering: Sentry, Netlify, Cloudflare, Supabase, Neon, GitLab, Semgrep, plus Context7, DeepWiki and Microsoft Learn (no sign-in)
• Data: Airtable, PostHog, Amplitude
• Research: Exa and Hugging Face (no sign-in), plus Tavily and Apify

Each card shows a starter ask. Once an app is connected, its ask appears among the home page suggestions. The directory has search and category filters. "Add a connection" links now land on the directory, and Add custom server remains for any other MCP server.

GET /api/connections/catalog lists the directory. POST /api/connections/catalog/:id connects one app; the URL and name come from the server-side list, so a click can't point anywhere else. It returns 409 if that server is already connected (ignoring host case and trailing slashes). Connections now carry title and examples from the directory.

DeepWiki's tools don't say they're read-only, so the directory marks them as reads when connected. They are listed by name, so any tool the server adds later still asks first.

Bug fix: sign-in for OAuth MCP servers

McpSession.check created the OAuth provider inside open(). When the server asked for sign-in, open() threw before returning the provider, so the authorization URL the SDK put on it was lost. The connection then stayed at "needs authorization" with no URL to open. This affected every OAuth server, including the old presets and custom servers. The provider is now created before connecting. A new test uses a local server with OAuth discovery and dynamic client registration, and asserts that the URL comes back. It fails without the fix.

How each app was checked

Every server in the list was connected live through the real endpoint:

• the 36 OAuth apps returned a real authorization URL from their own sign-in page
• the 5 no-sign-in apps connected and listed their tools

Left out because they can't connect in one click: Figma and Dropbox (approved partners only), HubSpot, Box and Asana's newer server (no dynamic registration), Vercel (connect times out), and GitHub's MCP (no dynamic registration; the built-in GitHub covers it). No sign-in was completed on any app, since that needs real accounts.

Tests

• bun test: 386 pass
• typecheck and biome are clean
• In the browser: search, category filters, a live one-click connect of DeepWiki, the detail sheet, the home suggestion and the ?add=1 jump, at 1440 px and 390 px. No console errors.

🤖 Generated with Claude Code