fix: prevent builtin MCPs from overwriting user MCP configs

[Peterrallojay]

Summary

• Fix builtin MCP configs (context7, websearch, grep_app) overwriting user-defined MCP configs
• User's custom headers (e.g., API keys) are now preserved instead of being replaced by plugin defaults

Changes

• Reordered spread operators in src/plugin-handlers/config-handler.ts so plugin builtin MCPs are applied first, allowing user configs to override them
  config.mcp = {

• ...createBuiltinMcps(pluginConfig.disabled_mcps),
  ...(config.mcp as Record<string, unknown>),
  

• ...createBuiltinMcps(pluginConfig.disabled_mcps),
  ...mcpResult.servers,
  ...pluginComponents.mcpServers,
  

};

Testing
bun run typecheck
bun run build

Manual verification:

1. Add custom headers to an MCP in ~/.config/opencode/opencode.json:
   {
   mcp: {
   context7: {
   type: remote,
   url: https://mcp.context7.com/mcp,
   headers: { CONTEXT7_API_KEY: your-key }
   }
   }
   }
2. Run opencode debug config
3. Verify context7 config includes your headers field (previously it was stripped)

Related Issues

---

Summary by cubic

Prevent built-in MCP configs (context7, websearch, grep_app) from overwriting user MCP settings so custom headers and other overrides are preserved.

^{Written for commit 7b41d4a. Summary will update on new commits.}

[github-actions]

Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement (CLA).

To sign the CLA, please comment on this PR with:

I have read the CLA Document and I hereby sign the CLA

This is a one-time requirement. Once signed, all your future contributions will be automatically accepted.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.