DevOS v1 + Phase 2: unified resource model, infra ops, website deployment, AI chat ops

- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages
- PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs)
- Auth/RBAC/workspace isolation, credential vault (AES-256-GCM)
- Servers/SSH, Docker discovery & lifecycle, Job Center
- Websites & deployments (git provider credential clone, env, health verification)
- Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring
- Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools)
- AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals)
- Notes: Vditor WYSIWYG markdown editor, non-blocking autosave
- Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)

Docs/devos-v1/09-MCP-SPEC.md

@@ -0,0 +1,54 @@
+# DevOS v1 MCP Specification
+
+## 1. Purpose
+DevOS should expose its capabilities as an MCP Server so external Agents such as ChatGPT, Claude, Cursor, Codex and other compatible agents can operate the developer infrastructure layer.
+
+## 2. Conceptual Interface
+
+```text
+External Agent
+      |
+      v
+  DevOS MCP
+      |
+      +-- Servers
+      +-- Websites
+      +-- Git
+      +-- Domains
+      +-- Email
+      +-- Notes
+      +-- Tasks
+      +-- Automation
+```
+
+## 3. Tool Design Rules
+Tools should:
+- have narrow, explicit responsibilities
+- declare structured input/output schemas
+- be workspace-aware
+- enforce authorization server-side
+- expose risk classification
+- return stable machine-readable results
+- never return raw secrets
+
+## 4. Initial Tool Set
+```text
+devos.server.list
+devos.server.status
+devos.server.exec
+devos.website.list
+devos.website.deploy
+devos.website.logs
+devos.deployment.get
+devos.domain.list
+devos.domain.records
+devos.task.create
+devos.note.create
+devos.automation.run
+```
+
+## 5. Safety
+MCP is not a bypass around DevOS security. All requests must pass the same permission, credential, risk and audit layers as first-party UI/API actions.
+
+## 6. Resource Exposure
+Prefer references and summarized metadata. Secrets and unnecessary infrastructure internals must not be exposed by default.