feat(mcp): add user-scope MCP install pipeline

I needed a single source of truth for MCP server registration so a fresh machine boots with the full set instead of being rebuilt by hand. install.py decrypts mcp/secrets.env.gpg, expands ${VAR} placeholders in mcp/servers.json, and runs claude mcp add --scope user for anything not already registered. Idempotent.

The encrypted bundle carries six values: the Google client id and secret, the Figma API key, the GCP OAuth keys JSON (base64), and the two @a-bonus/google-docs-mcp token caches (personal and work, base64). install.py writes the keys file and the two token files to the paths each package reads at startup, all mode 600.

Bundling the Google Docs tokens lets a new machine connect google-docs-personal and google-docs-work without the interactive OAuth flow. Without the cached token, the package falls back to a browser-redirect flow that Claude Code's stdio MCP loader can't drive, so it shows "Failed to connect" until the user runs the npx command manually.

Make target: install-mcp. Plaintext secrets and the decrypted keys file are gitignored.

1 files changed, 6 insertions, 1 deletions

diff --git a/Makefile b/Makefile
index c69cef0..c14f22b 100644
--- a/Makefile
+++ b/Makefile
@@ -62,7 +62,7 @@ endef
 
 .PHONY: help install uninstall list install-hooks uninstall-hooks \
         install-lang install-elisp install-python list-languages \
-        diff lint deps
+        install-mcp diff lint deps
 
 ##@ General
 
@@ -337,6 +337,11 @@ install-elisp: ## Install Elisp bundle ([PROJECT=<path>] [FORCE=1])
 install-python: ## Install Python bundle ([PROJECT=<path>] [FORCE=1])
 	@$(MAKE) install-lang LANG=python PROJECT="$(PROJECT)" FORCE="$(FORCE)"
 
+##@ MCP servers (user scope)
+
+install-mcp: ## Decrypt mcp/secrets.env.gpg and register MCP servers at user scope (idempotent)
+	@python3 mcp/install.py
+
 ##@ Compare & validate
 
 diff: ## Show drift between installed ruleset and repo source ([LANG=<lang>] [PROJECT=<path>])