-- The company's own MCP servers, served through llmgw's /mcp: registered
-- once by an administrator, their credentials kept here rather than in every
-- client. headers are sent as written; header_refs name a secret to read for
-- each (a file, env:, vault: or store:), so a token is never in this table.
CREATE TABLE mcp_servers (
  name        TEXT PRIMARY KEY,
  url         TEXT NOT NULL,
  description TEXT NOT NULL DEFAULT '',
  headers     TEXT NOT NULL DEFAULT '{}',
  header_refs TEXT NOT NULL DEFAULT '{}',
  enabled     INTEGER NOT NULL DEFAULT 1,
  timeout_ms  INTEGER NOT NULL DEFAULT 0,
  created_at  INTEGER NOT NULL,
  created_by  TEXT NOT NULL DEFAULT ''
);

-- Which of those servers' tools a scope may call, as patterns (jira.*,
-- db.query). Unlike allowed_models, none set anywhere means none: a tool
-- reaches into a company system, so it is granted, never assumed.
ALTER TABLE limits ADD COLUMN allowed_tools TEXT;