diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/direct_tools_mcp.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/direct_tools_mcp.rs
index b12fe889a..f277713a8 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/direct_tools_mcp.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/direct_tools_mcp.rs
@@ -1,7 +1,13 @@
 use super::*;
+use axum::extract::{DefaultBodyLimit, State as AxumState};
+use axum::http::{HeaderMap, StatusCode};
+use axum::routing::post;
+use axum::{Json, Router};
 use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
 use std::io::{BufRead, BufReader, Write};
 use std::path::{Path, PathBuf};
+use std::sync::{Mutex, OnceLock};
 
 pub(crate) const DIRECT_TOOLS_MCP_MODE_FLAG: &str = "--agc-direct-tools-mcp";
 pub(crate) const DIRECT_TOOLS_MCP_CONTROLLED_WEB_SEARCH_ENV: &str =
@@ -14,6 +20,32 @@ const DIRECT_TOOLS_MCP_MAX_RESOURCE_PROMPT_CHARS: usize = 4_000;
 const DIRECT_TOOLS_MCP_MAX_RESOURCE_NAME_CHARS: usize = 120;
 const DIRECT_TOOLS_MCP_MAX_WRITE_CONTENT_BYTES: usize = 1_500_000;
 const DIRECT_TOOLS_MCP_MAX_BRIDGE_RESPONSE_BYTES: usize = 32 * 1024 * 1024;
+const EXTERNAL_MCP_RESPONSE_MAX_CHARS: usize = 256 * 1024;
+const EXTERNAL_MCP_RESPONSE_SUMMARY_MAX_CHARS: usize = 240;
+const EXTERNAL_MCP_JOURNAL_MAX_BYTES: u64 = 8 * 1024 * 1024;
+const EXTERNAL_MCP_JOURNAL_RELATIVE_PATH: &str = ".agent/conversations/codex-responses.jsonl";
+static EXTERNAL_MCP_JOURNAL_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+static EXTERNAL_MCP_SERVER: OnceLock<Mutex<Option<ExternalMcpServer>>> = OnceLock::new();
+
+pub(crate) struct ExternalMcpServer {
+    pub(crate) url: String,
+    pub(crate) token: String,
+    task: tokio::task::JoinHandle<()>,
+}
+
+impl Drop for ExternalMcpServer {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+
+#[derive(Clone)]
+struct ExternalMcpHttpState {
+    root: PathBuf,
+    token: String,
+    session_user_id: String,
+    session_generation: u64,
+}
 
 pub(crate) fn direct_tools_mcp_mode_requested(args: &[String]) -> bool {
     args == [DIRECT_TOOLS_MCP_MODE_FLAG]
@@ -43,6 +75,62 @@ fn direct_tools_mcp_specs() -> Value {
 
 fn direct_tools_mcp_specs_for(controlled_web_search: bool) -> Value {
     let tools = vec![
+        json!({
+            "name": "client.session.info",
+            "description": "返回当前已绑定的 AGC 客户端会话和项目安全摘要；不返回宿主路径、凭据或内部地址。",
+            "inputSchema": { "type": "object", "additionalProperties": false }
+        }),
+        json!({
+            "name": "conversation.record_codex_response",
+            "description": "显式记录外部 Codex 的一条最终返回。客户端只保存有界、脱敏后的正文和安全摘要，不根据正文触发业务动作。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "requestId": { "type": "string", "minLength": 1, "maxLength": 160 },
+                    "sequence": { "type": "integer", "minimum": 0, "maximum": 1000000 },
+                    "content": { "type": "string", "minLength": 1, "maxLength": EXTERNAL_MCP_RESPONSE_MAX_CHARS }
+                },
+                "required": ["requestId", "sequence", "content"],
+                "additionalProperties": false
+            }
+        }),
+        json!({
+            "name": "conversation.list",
+            "description": "按序读取当前项目已记录的 Codex 返回摘要。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "offset": { "type": "integer", "minimum": 0, "maximum": 10000 },
+                    "limit": { "type": "integer", "minimum": 1, "maximum": 100 }
+                },
+                "additionalProperties": false
+            }
+        }),
+        json!({
+            "name": "conversation.read",
+            "description": "读取当前项目的一条已记录 Codex 返回；只能使用 conversation.list 返回的 recordId。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "recordId": { "type": "string", "minLength": 1, "maxLength": 80 }
+                },
+                "required": ["recordId"],
+                "additionalProperties": false
+            }
+        }),
+        json!({
+            "name": "agc_read_skill_resource",
+            "description": "读取审核通过的 AGC Skill 指导文件；仅允许清单内 skillName 和相对文件名。",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "skillName": { "type": "string", "minLength": 1, "maxLength": 120 },
+                    "relativePath": { "type": "string", "minLength": 1, "maxLength": 240 }
+                },
+                "required": ["skillName", "relativePath"],
+                "additionalProperties": false
+            }
+        }),
         json!({
                 "name": "agc_write_file",
                 "description": "把文本写入当前 AGC 项目的相对路径。Codex 可以按需使用它直接推进代码、配置、资源依赖或说明文件；客户端只负责项目路径和基本控制面边界，不要求固定文件、任务顺序、验证或完成回执。",
@@ -971,9 +1059,41 @@ async fn call_agc_browser_playtest(arguments: &Value) -> Value {
 }
 
 async fn call_agc_web_search(arguments: &Value) -> Value {
-    if !controlled_web_search_enabled() {
+    call_agc_web_search_with_enabled(arguments, controlled_web_search_enabled()).await
+}
+
+fn call_agc_read_skill_resource(arguments: &Value) -> Value {
+    if let Err(error) = validate_tool_object_fields(arguments, &["skillName", "relativePath"]) {
+        return mcp_tool_result(error, Vec::new(), true);
+    }
+    let skill = match bounded_tool_string(arguments, "skillName", 120) {
+        Ok(value) => value,
+        Err(error) => return mcp_tool_result(error, Vec::new(), true),
+    };
+    let relative = match bounded_tool_string(arguments, "relativePath", 240) {
+        Ok(value) => value,
+        Err(error) => return mcp_tool_result(error, Vec::new(), true),
+    };
+    if Path::new(&relative).is_absolute()
+        || relative.contains("..")
+        || relative.contains(':')
+        || relative.contains('\\')
+    {
+        return mcp_tool_result("Skill 资源路径不安全".to_string(), Vec::new(), true);
+    }
+    match read_agc_skill_resource(&format!("{skill}/{relative}")) {
+        Ok(content) => mcp_tool_result(content, Vec::new(), false),
+        Err(error) => mcp_tool_result(error, Vec::new(), true),
+    }
+}
+
+async fn call_agc_web_search_with_enabled(arguments: &Value, enabled: bool) -> Value {
+    if !enabled {
         return mcp_tool_result("AGC 受控联网搜索未启用".to_string(), Vec::new(), true);
     }
+    if let Err(error) = validate_tool_object_fields(arguments, &["query", "maxResults"]) {
+        return mcp_tool_result(error, Vec::new(), true);
+    }
     let query =
         match bounded_tool_string(arguments, "query", DIRECT_TOOLS_MCP_MAX_SEARCH_QUERY_CHARS) {
             Ok(query) => query,
@@ -990,7 +1110,345 @@ async fn call_agc_web_search(arguments: &Value) -> Value {
     .await
 }
 
-async fn handle_direct_tools_mcp_request(_root: &Path, request: Value) -> Option<Value> {
+fn external_mcp_journal_path(root: &Path) -> PathBuf {
+    root.join(EXTERNAL_MCP_JOURNAL_RELATIVE_PATH)
+}
+
+fn redact_external_mcp_response(content: &str) -> String {
+    content
+        .lines()
+        .map(|line| {
+            let lower = line.to_ascii_lowercase();
+            let sensitive = [
+                "authorization:",
+                "cookie:",
+                "set-cookie:",
+                "api_key",
+                "apikey",
+                "access_token",
+                "refresh_token",
+                "client_secret",
+                "password:",
+                "bearer ",
+            ]
+            .iter()
+            .any(|marker| lower.contains(marker));
+            if sensitive {
+                "[redacted sensitive response line]".to_string()
+            } else {
+                line.to_string()
+            }
+        })
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+fn external_mcp_response_summary(content: &str) -> String {
+    let normalized = content.split_whitespace().collect::<Vec<_>>().join(" ");
+    normalized
+        .chars()
+        .take(EXTERNAL_MCP_RESPONSE_SUMMARY_MAX_CHARS)
+        .collect()
+}
+
+fn external_mcp_session_id(root: &Path) -> String {
+    let mut material = root.to_string_lossy().into_owned();
+    if let Some(session) = current_platform_session() {
+        material.push('\0');
+        material.push_str(&session.user_id);
+        material.push('\0');
+        material.push_str(&session.generation.to_string());
+    }
+    format!("mcp-{:x}", Sha256::digest(material.as_bytes()))
+}
+
+fn external_mcp_project_id(root: &Path) -> String {
+    std::fs::read(root.join(".agent/manifest.json"))
+        .ok()
+        .and_then(|bytes| serde_json::from_slice::<Value>(&bytes).ok())
+        .and_then(|value| {
+            value
+                .get("projectId")
+                .and_then(Value::as_str)
+                .map(str::to_string)
+        })
+        .unwrap_or_else(|| {
+            format!(
+                "project-{:x}",
+                Sha256::digest(root.to_string_lossy().as_bytes())
+            )
+        })
+}
+
+fn external_mcp_account_id() -> String {
+    current_platform_session()
+        .map(|session| format!("account-{:x}", Sha256::digest(session.user_id.as_bytes())))
+        .unwrap_or_else(|| "account-unknown".to_string())
+}
+
+fn validate_external_mcp_record_arguments(
+    arguments: &Value,
+) -> Result<(String, u64, String), String> {
+    validate_tool_object_fields(arguments, &["requestId", "sequence", "content"])?;
+    let request_id = bounded_tool_string(arguments, "requestId", 160)?;
+    let sequence = arguments
+        .get("sequence")
+        .and_then(Value::as_u64)
+        .ok_or_else(|| "工具参数 sequence 必须是非负整数".to_string())?;
+    if sequence > 1_000_000 {
+        return Err("工具参数 sequence 超出安全边界".to_string());
+    }
+    let content = arguments
+        .get("content")
+        .and_then(Value::as_str)
+        .ok_or_else(|| "工具参数 content 必须是字符串".to_string())?;
+    if content.is_empty() || content.chars().count() > EXTERNAL_MCP_RESPONSE_MAX_CHARS {
+        return Err("工具参数 content 不能为空或超过大小上限".to_string());
+    }
+    if content
+        .chars()
+        .any(|character| character.is_control() && !matches!(character, '\n' | '\r' | '\t'))
+    {
+        return Err("工具参数 content 不能包含控制字符".to_string());
+    }
+    Ok((request_id, sequence, content.to_string()))
+}
+
+fn read_external_mcp_journal(root: &Path) -> Result<Vec<Value>, String> {
+    let path = external_mcp_journal_path(root);
+    let Ok(bytes) = std::fs::read(&path) else {
+        return Ok(Vec::new());
+    };
+    if bytes.len() as u64 > EXTERNAL_MCP_JOURNAL_MAX_BYTES {
+        return Err("Codex 返回记录超过客户端保留上限".to_string());
+    }
+    bytes
+        .split(|byte| *byte == b'\n')
+        .filter(|line| !line.is_empty())
+        .map(|line| {
+            serde_json::from_slice::<Value>(line).map_err(|_| "Codex 返回记录格式损坏".to_string())
+        })
+        .collect()
+}
+
+fn external_mcp_record_response(root: &Path, arguments: &Value) -> Value {
+    let (request_id, sequence, content) = match validate_external_mcp_record_arguments(arguments) {
+        Ok(value) => value,
+        Err(error) => return mcp_tool_result(error, Vec::new(), true),
+    };
+    let redacted = redact_external_mcp_response(&content);
+    let key = format!("{request_id}\u{0}{sequence}");
+    let message_id = format!("external-codex-{:x}", Sha256::digest(key.as_bytes()));
+    let guard = EXTERNAL_MCP_JOURNAL_LOCK
+        .get_or_init(|| Mutex::new(()))
+        .lock();
+    if guard.is_err() {
+        return mcp_tool_result("Codex 返回记录锁不可用".to_string(), Vec::new(), true);
+    }
+    let mut records = match read_external_mcp_journal(root) {
+        Ok(records) => records,
+        Err(error) => return mcp_tool_result(error, Vec::new(), true),
+    };
+    if let Some(existing) = records.iter().find(|record| {
+        record.get("requestId").and_then(Value::as_str) == Some(request_id.as_str())
+            && record.get("sequence").and_then(Value::as_u64) == Some(sequence)
+    }) {
+        return mcp_tool_result(existing.to_string(), Vec::new(), false);
+    }
+    if let Some(max_sequence) = records
+        .iter()
+        .filter(|record| {
+            record.get("requestId").and_then(Value::as_str) == Some(request_id.as_str())
+        })
+        .filter_map(|record| record.get("sequence").and_then(Value::as_u64))
+        .max()
+    {
+        if sequence != max_sequence.saturating_add(1) {
+            return mcp_tool_result(
+                "工具参数 sequence 必须按 requestId 连续递增".to_string(),
+                Vec::new(),
+                true,
+            );
+        }
+    } else if sequence != 0 {
+        return mcp_tool_result(
+            "同一 requestId 的首条记录 sequence 必须为 0".to_string(),
+            Vec::new(),
+            true,
+        );
+    }
+    let path = external_mcp_journal_path(root);
+    if let Some(parent) = path.parent() {
+        if let Err(error) = std::fs::create_dir_all(parent) {
+            return mcp_tool_result(
+                format!("创建 Codex 返回记录目录失败：{error}"),
+                Vec::new(),
+                true,
+            );
+        }
+    }
+    let record = json!({
+        "recordId": uuid::Uuid::new_v4().to_string(),
+        "recordType": "codex.response",
+        "accountId": external_mcp_account_id(),
+        "projectId": external_mcp_project_id(root),
+        "sessionId": external_mcp_session_id(root),
+        "requestId": request_id,
+        "sequence": sequence,
+        "receivedAt": std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|duration| duration.as_millis() as u64)
+            .unwrap_or_default(),
+        "content": redacted,
+        "contentSha256": format!("{:x}", Sha256::digest(content.as_bytes())),
+        "summary": external_mcp_response_summary(&content),
+        "truncated": false,
+        "status": "completed"
+    });
+    let line = match serde_json::to_string(&record) {
+        Ok(line) => line,
+        Err(error) => {
+            return mcp_tool_result(
+                format!("序列化 Codex 返回记录失败：{error}"),
+                Vec::new(),
+                true,
+            )
+        }
+    };
+    let current_size = std::fs::metadata(&path)
+        .map(|metadata| metadata.len())
+        .unwrap_or(0);
+    if current_size.saturating_add(line.len() as u64 + 1) > EXTERNAL_MCP_JOURNAL_MAX_BYTES {
+        return mcp_tool_result(
+            "Codex 返回记录达到客户端保留上限".to_string(),
+            Vec::new(),
+            true,
+        );
+    }
+    let _project_lock = match acquire_project_write_lock(root, "conversation.write") {
+        Ok(lock) => lock,
+        Err(error) => {
+            return mcp_tool_result(format!("项目对话锁不可用：{error}"), Vec::new(), true)
+        }
+    };
+    let append_result = std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(&path)
+        .and_then(|mut file| {
+            use std::io::Write as _;
+            file.write_all(line.as_bytes())?;
+            file.write_all(b"\n")?;
+            file.sync_data()
+        });
+    if let Err(error) = append_result {
+        return mcp_tool_result(
+            format!("写入 Codex 返回记录失败：{error}"),
+            Vec::new(),
+            true,
+        );
+    }
+    // Reuse the existing conversation projection so the current UI can read
+    // the explicit external response without treating it as business truth.
+    if let Err(error) = append_local_conversation_message_for_session_idempotent_at(
+        root,
+        None,
+        None,
+        LocalConversationMessage {
+            role: "assistant".to_string(),
+            content: record
+                .get("content")
+                .and_then(Value::as_str)
+                .unwrap_or_default()
+                .to_string(),
+            agent_id: None,
+        },
+        &message_id,
+    ) {
+        return mcp_tool_result(
+            format!("Codex 返回已写入但对话投影失败：{error}"),
+            Vec::new(),
+            true,
+        );
+    }
+    records.push(record.clone());
+    mcp_tool_result(record.to_string(), Vec::new(), false)
+}
+
+fn external_mcp_session_info(root: &Path) -> Value {
+    let manifest = std::fs::read(root.join(".agent/manifest.json"))
+        .ok()
+        .and_then(|bytes| serde_json::from_slice::<Value>(&bytes).ok());
+    let project_id = manifest
+        .as_ref()
+        .and_then(|value| value.get("projectId"))
+        .and_then(Value::as_str)
+        .unwrap_or("unknown")
+        .to_string();
+    mcp_tool_result(
+        json!({
+            "status": "bound",
+            "projectId": project_id,
+            "sessionId": external_mcp_session_id(root),
+            "transport": "loopback-or-stdio"
+        })
+        .to_string(),
+        Vec::new(),
+        false,
+    )
+}
+
+fn external_mcp_conversation_list(root: &Path, arguments: &Value) -> Value {
+    if let Err(error) = validate_tool_object_fields(arguments, &["offset", "limit"]) {
+        return mcp_tool_result(error, Vec::new(), true);
+    }
+    let offset = arguments.get("offset").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let limit = arguments.get("limit").and_then(Value::as_u64).unwrap_or(20) as usize;
+    if offset > 10_000 || !(1..=100).contains(&limit) {
+        return mcp_tool_result(
+            "conversation.list 分页参数超出安全边界".to_string(),
+            Vec::new(),
+            true,
+        );
+    }
+    match read_external_mcp_journal(root) {
+        Ok(records) => mcp_tool_result(
+            json!({ "entries": records.into_iter().skip(offset).take(limit).map(|record| json!({
+                "recordId": record.get("recordId"), "requestId": record.get("requestId"),
+                "sequence": record.get("sequence"), "receivedAt": record.get("receivedAt"),
+                "summary": record.get("summary"), "status": record.get("status")
+            })).collect::<Vec<_>>() })
+            .to_string(),
+            Vec::new(),
+            false,
+        ),
+        Err(error) => mcp_tool_result(error, Vec::new(), true),
+    }
+}
+
+fn external_mcp_conversation_read(root: &Path, arguments: &Value) -> Value {
+    if let Err(error) = validate_tool_object_fields(arguments, &["recordId"]) {
+        return mcp_tool_result(error, Vec::new(), true);
+    }
+    let record_id = match bounded_tool_string(arguments, "recordId", 80) {
+        Ok(value) => value,
+        Err(error) => return mcp_tool_result(error, Vec::new(), true),
+    };
+    match read_external_mcp_journal(root) {
+        Ok(records) => records
+            .into_iter()
+            .find(|record| {
+                record.get("recordId").and_then(Value::as_str) == Some(record_id.as_str())
+            })
+            .map(|record| mcp_tool_result(record.to_string(), Vec::new(), false))
+            .unwrap_or_else(|| {
+                mcp_tool_result("未找到 Codex 返回记录".to_string(), Vec::new(), true)
+            }),
+        Err(error) => mcp_tool_result(error, Vec::new(), true),
+    }
+}
+
+async fn handle_direct_tools_mcp_request(root: &Path, request: Value) -> Option<Value> {
     let id = request.get("id").cloned();
     let method = request.get("method").and_then(Value::as_str)?;
     if id.is_none() {
@@ -1007,7 +1465,10 @@ async fn handle_direct_tools_mcp_request(_root: &Path, request: Value) -> Option
                 id,
                 json!({
                     "protocolVersion": requested_protocol,
-                    "capabilities": { "tools": { "listChanged": false } },
+                    "capabilities": {
+                        "tools": { "listChanged": false },
+                        "resources": { "subscribe": false, "listChanged": false }
+                    },
                     "serverInfo": {
                         "name": "genarrative-agc-tools",
                         "version": env!("CARGO_PKG_VERSION")
@@ -1016,6 +1477,75 @@ async fn handle_direct_tools_mcp_request(_root: &Path, request: Value) -> Option
             ))
         }
         "ping" => Some(mcp_success(id, json!({}))),
+        "resources/list" => Some(mcp_success(
+            id,
+            json!({
+                "resources": [{
+                    "uri": "agc://skills/index",
+                    "name": "AGC Skill 索引",
+                    "description": "审核通过的客户端 Skill 与工具使用指导",
+                    "mimeType": "text/plain"
+                }, {
+                    "uri": "agc://conversation/codex-responses",
+                    "name": "Codex 返回记录",
+                    "description": "当前项目中由 conversation.record_codex_response 写入的只读 journal",
+                    "mimeType": "application/x-ndjson"
+                }]
+            }),
+        )),
+        "resources/read" => {
+            let uri = request
+                .pointer("/params/uri")
+                .and_then(Value::as_str)
+                .unwrap_or_default();
+            if uri == "agc://skills/index" {
+                let text = render_agc_skill_pack_index()
+                    .map_err(|_| ())
+                    .unwrap_or_else(|_| "AGC Skill 索引暂不可用".to_string());
+                return Some(mcp_success(
+                    id,
+                    json!({ "contents": [{ "uri": uri, "mimeType": "text/plain", "text": text }] }),
+                ));
+            }
+            if let Some(resource) = uri.strip_prefix("agc://skills/") {
+                return match read_agc_skill_resource(resource) {
+                    Ok(text) if text.len() <= DIRECT_TOOLS_MCP_MAX_REQUEST_BYTES => {
+                        Some(mcp_success(
+                            id,
+                            json!({ "contents": [{ "uri": uri, "mimeType": "text/plain", "text": text }] }),
+                        ))
+                    }
+                    Ok(_) => Some(mcp_error(id, -32000, "AGC Skill 资源超过响应大小上限")),
+                    Err(_) => Some(mcp_error(id, -32602, "未知或未审核的 AGC Skill 资源")),
+                };
+            }
+            if uri != "agc://conversation/codex-responses" {
+                Some(mcp_error(id, -32602, "未知资源"))
+            } else {
+                let text = read_external_mcp_journal(root)
+                    .map(|records| {
+                        records
+                            .iter()
+                            .map(Value::to_string)
+                            .collect::<Vec<_>>()
+                            .join("\n")
+                    })
+                    .unwrap_or_default();
+                if text.len() > DIRECT_TOOLS_MCP_MAX_REQUEST_BYTES {
+                    return Some(mcp_error(id, -32000, "Codex 返回记录资源超过响应大小上限"));
+                }
+                Some(mcp_success(
+                    id,
+                    json!({
+                        "contents": [{
+                            "uri": uri,
+                            "mimeType": "application/x-ndjson",
+                            "text": text
+                        }]
+                    }),
+                ))
+            }
+        }
         "tools/list" => Some(mcp_success(id, direct_tools_mcp_specs())),
         "tools/call" => {
             let tool = request
@@ -1027,6 +1557,13 @@ async fn handle_direct_tools_mcp_request(_root: &Path, request: Value) -> Option
                 .cloned()
                 .unwrap_or_else(|| json!({}));
             let result = match tool {
+                "client.session.info" => external_mcp_session_info(root),
+                "conversation.record_codex_response" => {
+                    external_mcp_record_response(root, &arguments)
+                }
+                "conversation.list" => external_mcp_conversation_list(root, &arguments),
+                "conversation.read" => external_mcp_conversation_read(root, &arguments),
+                "agc_read_skill_resource" => call_agc_read_skill_resource(&arguments),
                 "agc_write_file" => call_agc_write_file(&arguments).await,
                 "taonier_prepare_game_art" => call_taonier_prepare_game_art(&arguments).await,
                 "agc_generate_image" => call_agc_generate_image(&arguments).await,
@@ -1115,6 +1652,100 @@ async fn run_direct_tools_mcp_stdio() -> Result<(), String> {
     Ok(())
 }
 
+fn external_mcp_authorized(headers: &HeaderMap, token: &str) -> bool {
+    headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "))
+        .is_some_and(|value| value == token)
+}
+
+async fn handle_external_mcp_http_request(
+    AxumState(state): AxumState<ExternalMcpHttpState>,
+    headers: HeaderMap,
+    Json(request): Json<Value>,
+) -> Result<Json<Value>, StatusCode> {
+    if !external_mcp_authorized(&headers, &state.token) {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+    let Some(session) = current_platform_session() else {
+        return Err(StatusCode::UNAUTHORIZED);
+    };
+    if session.user_id != state.session_user_id || session.generation != state.session_generation {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+    let response = handle_direct_tools_mcp_request(&state.root, request)
+        .await
+        .ok_or(StatusCode::BAD_REQUEST)?;
+    Ok(Json(response))
+}
+
+pub(crate) async fn start_external_mcp_loopback(
+    root: &Path,
+    _controlled_web_search: bool,
+) -> Result<(String, String), String> {
+    let root = validate_direct_tools_project_root(root)?;
+    let session = current_platform_session()
+        .ok_or_else(|| "启动客户端 MCP 前必须先完成账号会话绑定".to_string())?;
+    let token = uuid::Uuid::new_v4().to_string();
+    let route = format!("/mcp-{}", uuid::Uuid::new_v4().simple());
+    let listener = tokio::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, 0))
+        .await
+        .map_err(|error| format!("启动客户端 MCP loopback 失败：{error}"))?;
+    let address = listener
+        .local_addr()
+        .map_err(|error| format!("读取客户端 MCP 地址失败：{error}"))?;
+    let state = ExternalMcpHttpState {
+        root,
+        token: token.clone(),
+        session_user_id: session.user_id,
+        session_generation: session.generation,
+    };
+    let app = Router::new()
+        .route(&route, post(handle_external_mcp_http_request))
+        .layer(DefaultBodyLimit::max(DIRECT_TOOLS_MCP_MAX_REQUEST_BYTES))
+        .with_state(state);
+    let task = tokio::spawn(async move {
+        let _ = axum::serve(listener, app).await;
+    });
+    let url = format!("http://127.0.0.1:{}{route}", address.port());
+    let registry = EXTERNAL_MCP_SERVER.get_or_init(|| Mutex::new(None));
+    let mut guard = registry
+        .lock()
+        .map_err(|_| "客户端 MCP 服务注册表不可用".to_string())?;
+    if let Some(previous) = guard.take() {
+        drop(previous);
+    }
+    *guard = Some(ExternalMcpServer {
+        url: url.clone(),
+        token: token.clone(),
+        task,
+    });
+    Ok((url, token))
+}
+
+pub(crate) fn stop_external_mcp_loopback() {
+    if let Some(registry) = EXTERNAL_MCP_SERVER.get() {
+        if let Ok(mut guard) = registry.lock() {
+            guard.take();
+        }
+    }
+}
+
+#[tauri::command]
+pub(crate) async fn start_game_creator_external_mcp(project_path: String) -> Result<Value, String> {
+    let root = Path::new(project_path.trim());
+    enforce_project_permission_policy(root, "conversation.read")?;
+    let (url, token) = start_external_mcp_loopback(root, false).await?;
+    Ok(json!({ "url": url, "token": token, "transport": "streamable-http" }))
+}
+
+#[tauri::command]
+pub(crate) fn stop_game_creator_external_mcp() -> Result<(), String> {
+    stop_external_mcp_loopback();
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1193,7 +1824,7 @@ mod tests {
             DIRECT_TOOLS_MCP_MAX_REQUEST_BYTES > DIRECT_TOOLS_MCP_MAX_WRITE_CONTENT_BYTES + 1024,
             "MCP request envelope must fit the advertised file-write payload"
         );
-        let specs = direct_tools_mcp_specs();
+        let specs = direct_tools_mcp_specs_for(false);
         let names = specs["tools"]
             .as_array()
             .expect("tool array")
@@ -1203,6 +1834,11 @@ mod tests {
         assert_eq!(
             names,
             vec![
+                "client.session.info",
+                "conversation.record_codex_response",
+                "conversation.list",
+                "conversation.read",
+                "agc_read_skill_resource",
                 "agc_write_file",
                 "taonier_prepare_game_art",
                 "agc_generate_image",
@@ -1491,4 +2127,138 @@ mod tests {
         assert_eq!(response["result"]["isError"], true);
         assert!(response.to_string().contains("未知或未审核"));
     }
+
+    #[tokio::test]
+    async fn controlled_search_call_is_disabled_without_the_explicit_feature_flag() {
+        let response = call_agc_web_search_with_enabled(
+            &json!({
+                "query": "tauri"
+            }),
+            false,
+        )
+        .await;
+        assert_eq!(response["isError"], true);
+        assert!(response.to_string().contains("受控联网搜索未启用"));
+    }
+
+    #[tokio::test]
+    async fn mcp_search_forwards_only_reviewed_arguments_to_the_client_bridge() {
+        use std::sync::Arc;
+        use tokio::sync::Mutex;
+
+        let observed = Arc::new(Mutex::new(None::<Value>));
+        let observed_for_handler = Arc::clone(&observed);
+        let listener = tokio::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, 0))
+            .await
+            .expect("bind bridge fixture");
+        let port = listener
+            .local_addr()
+            .expect("bridge fixture address")
+            .port();
+        let app = axum::Router::new().route(
+            "/tool-fixture",
+            axum::routing::post(move |axum::Json(payload): axum::Json<Value>| {
+                let observed = Arc::clone(&observed_for_handler);
+                async move {
+                    *observed.lock().await = Some(payload);
+                    axum::Json(json!({
+                        "content": [{ "type": "text", "text": "bridge-result" }],
+                        "isError": false
+                    }))
+                }
+            }),
+        );
+        let task = tokio::spawn(async move {
+            let _ = axum::serve(listener, app).await;
+        });
+
+        let previous_url = std::env::var(DIRECT_TOOL_BRIDGE_URL_ENV).ok();
+        std::env::set_var(
+            DIRECT_TOOL_BRIDGE_URL_ENV,
+            format!("http://127.0.0.1:{port}/tool-fixture"),
+        );
+        let response = call_agc_web_search_with_enabled(
+            &json!({
+                "query": "  tauri rust  ",
+                "maxResults": 2
+            }),
+            true,
+        )
+        .await;
+        match previous_url {
+            Some(value) => std::env::set_var(DIRECT_TOOL_BRIDGE_URL_ENV, value),
+            None => std::env::remove_var(DIRECT_TOOL_BRIDGE_URL_ENV),
+        }
+        task.abort();
+
+        assert_eq!(response["isError"], false);
+        assert_eq!(response["content"][0]["text"], "bridge-result");
+        let observed = observed.lock().await.clone().expect("bridge request");
+        assert_eq!(observed["tool"], "agc_web_search");
+        assert_eq!(observed["arguments"]["query"], "tauri rust");
+        assert_eq!(observed["arguments"]["maxResults"], 2);
+    }
+
+    #[tokio::test]
+    async fn mcp_search_rejects_unreviewed_arguments_before_bridge_call() {
+        let response = call_agc_web_search_with_enabled(
+            &json!({
+                "query": "tauri",
+                "unexpected": "do-not-forward"
+            }),
+            true,
+        )
+        .await;
+        assert_eq!(response["isError"], true);
+        assert!(response.to_string().contains("未审核字段"));
+    }
+
+    #[test]
+    fn skill_resource_tool_rejects_unreviewed_paths() {
+        let accepted = call_agc_read_skill_resource(&json!({
+            "skillName": "agc-project-structure",
+            "relativePath": "references/structure-contract.md"
+        }));
+        assert_eq!(accepted["isError"], false);
+        assert!(accepted.to_string().contains("drive prefix"));
+
+        let denied = call_agc_read_skill_resource(&json!({
+            "skillName": "agc-project-structure",
+            "relativePath": "../../auth.json"
+        }));
+        assert_eq!(denied["isError"], true);
+
+        let denied_windows_absolute = call_agc_read_skill_resource(&json!({
+            "skillName": "agc-project-structure",
+            "relativePath": r"C:\temp\SKILL.md"
+        }));
+        assert_eq!(denied_windows_absolute["isError"], true);
+    }
+
+    #[test]
+    fn external_codex_response_redacts_sensitive_lines_and_keeps_safe_text() {
+        let response = redact_external_mcp_response(
+            "完成了页面布局\nAuthorization: Bearer secret-value\n下一步请运行试玩",
+        );
+        assert!(response.contains("完成了页面布局"));
+        assert!(response.contains("下一步请运行试玩"));
+        assert!(!response.contains("secret-value"));
+    }
+
+    #[test]
+    fn external_codex_response_arguments_reject_unknown_fields_and_control_bytes() {
+        assert!(validate_external_mcp_record_arguments(&json!({
+            "requestId": "req-1",
+            "sequence": 0,
+            "content": "ok",
+            "unexpected": true
+        }))
+        .is_err());
+        assert!(validate_external_mcp_record_arguments(&json!({
+            "requestId": "req-1",
+            "sequence": 0,
+            "content": "bad\u{0001}"
+        }))
+        .is_err());
+    }
 }
diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/skill_pack.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/skill_pack.rs
index aec1efbc2..9cb4fda28 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/skill_pack.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/skill_pack.rs
@@ -242,6 +242,27 @@ pub(crate) fn render_agc_skill_pack_index() -> Result<String, String> {
     Ok(lines.join("\n"))
 }
 
+pub(crate) fn read_agc_skill_resource(resource: &str) -> Result<String, String> {
+    let manifest = validated_skill_pack_manifest()?;
+    let normalized = resource.trim().trim_start_matches('/').replace('\\', "/");
+    let (skill_name, relative) = normalized
+        .split_once('/')
+        .ok_or_else(|| "Skill 资源路径必须是 skill/file".to_string())?;
+    let entry = manifest
+        .skills
+        .iter()
+        .find(|entry| entry.name == skill_name)
+        .ok_or_else(|| "未登记的 AGC Skill 资源".to_string())?;
+    if !entry.files.iter().any(|file| file == relative) || !is_safe_skill_relative_path(relative) {
+        return Err("未登记或不安全的 AGC Skill 资源".to_string());
+    }
+    let bundled_path = format!("{skill_name}/{relative}");
+    let bytes =
+        bundled_skill_file(&bundled_path).ok_or_else(|| "AGC Skill 资源不存在".to_string())?;
+    let canonical = canonical_skill_text_bytes(&bundled_path, bytes)?;
+    String::from_utf8(canonical.into_owned()).map_err(|_| "AGC Skill 资源不是 UTF-8".to_string())
+}
+
 pub(crate) fn install_agc_skill_pack(isolated_os_home: &Path) -> Result<String, String> {
     let manifest = validated_skill_pack_manifest()?;
     let skills_root = isolated_os_home.join(".agents").join("skills");
diff --git a/docs/project-memory/shared-memory/decision-log.md b/docs/project-memory/shared-memory/decision-log.md
index b62a2d88a..e417c24cc 100644
--- a/docs/project-memory/shared-memory/decision-log.md
+++ b/docs/project-memory/shared-memory/decision-log.md
@@ -7959,3 +7959,12 @@ CI 上 `background_agent_runtime_recovers_stale_running_before_pending_task` 在
 - UI 编辑器导出的 `ui/generated-*.js` 是派生本地产物。代码生成只写文件，绝不推进项目 revision、UI State revision、manifest 阶段或 Runtime 验证门；写入失败只返回生成错误，不能把生成文件写入冒充项目 mutation。
 - 生成文件名保留可读清洗前缀，并追加 asset ID 的 SHA-256 摘要前缀以避免不同 ID 碰撞；不迁移既有旧路径，调用方需在采用新命名后使用新返回路径。
 - Radial90 的前端预览与 Rust 导出统一使用角点映射和顺时针起始角规则，顺时针填充从角点前一条边开始，避免两端渲染偏移。
+
+## 2026-09-03 AGC 客户端能力以 MCP 暴露
+
+- 背景：客户端仍启动并驱动自己的 Codex 对话；同时需要把客户端自身的受控业务能力以 MCP 暴露给 Codex。客户端不应替 Codex 做业务语义门禁、意图判断或完成判定。
+- 决策：MCP 作为客户端能力层外挂，GUI 主进程提供 loopback MCP，stdio broker 只做协议转发；会话绑定 `accountId + projectId + clientInstanceId + sessionId`，项目切换、登出、重启、断开或令牌轮换失效。客户端保留现有对话/UI 和 `codex_app_server` 链路，仅暴露稳定业务工具白名单，不透传全部 Tauri command、任意路径、凭据、内部 URL、shell、数据库或管理能力。
+- 返回记录：客户端对话继续走现有 conversation projection；外部 Host 如需旁路归档，才调用 `conversation.record_codex_response` 写入有界、脱敏 journal。该记录不是客户端对话前置条件，UI 不从文本推断完成、规划、同步或其它副作用。
+- 迁移与兼容：`codex_app_server`、`codex_cli`、`provider`、既有 Agent Runtime 和客户端对话均保留；MCP 仅新增能力暴露，不替换现有 Codex 控制链。公网 `/api/external/v1/mcp` 与桌面 MCP facade 保持独立。
+- 影响范围：AGC 客户端 MCP facade、loopback/stdio 传输、DirectProject 会话绑定、Codex 返回 journal、前端对话数据源、运行模式与恢复/幂等测试；不新增 SpacetimeDB 表，不改变公网 External MCP 合同。
+- 验证方式：覆盖客户端对话驱动的 MCP 初始化/绑定/失效、跨项目与路径安全、工具大小和幂等、异步 operation 恢复、Skill resource 白名单以及旧 Provider/Codex 模式回归；执行对应 Rust/前端定向测试、MCP contract smoke、typecheck、`npm run check:encoding` 与 `git diff --check`。
diff --git a/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md b/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md
index ce63e5020..4db2446dc 100644
--- a/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md
+++ b/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md
@@ -233,6 +233,13 @@ Supervisor 认领该回执后，由父 run 自己为每个原 delivery 逐一创
 - 旧配置迁移：既有 AppData 若没有 `agentMode`，只有全局和逐 Agent 路由均为 `openai_responses` 时迁移到 `codex_app_server`；存在 `openai_chat / anthropic` 时显式保留 `provider`，避免打开项目自动恢复时把所有节点批量写成 `invalid-config`。用户确认端点支持 Responses 后，可在设置中显式切换并保留原 model/base URL/API Key。
 - 验收：fake JSON-RPC fixture、三态 UI/config、配置指纹、unknown-terminal 零重放、旧两种模式回归和显式 ignored 真实 smoke 全部通过后，才可视为模式切换完成。
 
+### 2026-09-03 AGC 客户端能力以 MCP 暴露
+
+- MCP 暴露是客户端能力层，不替换 `codex_app_server / codex_cli / provider` 或客户端对话。Codex 仍可由客户端对话入口驱动，同时其它 Codex Host 也可连接 loopback MCP facade/stdio broker；客户端不再替 Codex 做业务语义门禁、意图判断和完成判定。
+- MCP 会话在客户端握手时绑定当前账号、项目和实例，工具参数不得携带 `projectPath`、Token、Cookie、objectKey 或内部 URL。仅暴露稳定业务白名单与 `resources/list/read`，所有文件、资源、画布、预览和 operation 副作用继续复用客户端权限、锁、计费、幂等账本、manifest/revision 与恢复机制。
+- 客户端对话继续写入现有 conversation projection；外部 Host 如需旁路保存返回文本，可显式调用 `conversation.record_codex_response`。客户端将有界、脱敏正文、SHA-256、安全摘要和状态追加到项目级 journal，UI 只展示记录，不从文本推断业务状态或触发副作用。
+- loopback MCP 在账号登出、会话代际变化、项目切换、客户端退出或令牌轮换后立即失效；未知副作用保持 `needs-reconciliation`，只能通过 operation 查询恢复。稳定验收覆盖客户端对话驱动的 MCP 工具调用、Skill 指导资源、跨项目/账号拒绝以及旧 Provider/Codex 回归。
+
 ### 2026-08-10 Supervisor 边做边聊与条件中断
 
 - 根 Project Supervisor 的运行中消息继续进入当前 `taskId / sessionId / runId`，先持久显示“正在判断、当前任务继续”，再由独立 LLM 生成非终态语义回复并给出 `interruptCurrentProvider`。过程回复不能调用终态 `respond_to_user`，不能把制作 Run、Goal 或 task 提前完成。
diff --git a/docs/technical/【技术方案】DirectProject客户端Skill与MCP扩展导入方案-2026-08-31.md b/docs/technical/【技术方案】DirectProject客户端Skill与MCP扩展导入方案-2026-08-31.md
index bc6aeeafe..cf52261c4 100644
--- a/docs/technical/【技术方案】DirectProject客户端Skill与MCP扩展导入方案-2026-08-31.md
+++ b/docs/technical/【技术方案】DirectProject客户端Skill与MCP扩展导入方案-2026-08-31.md
@@ -14,6 +14,10 @@
 
 ## 3. 已确定的产品边界
 
+### 3.0 客户端能力 MCP 暴露边界（2026-09-03）
+
+客户端仍由现有对话入口启动并驱动 Codex；MCP 只是把客户端已审核的项目、文件、资源、画布、生成和预览能力暴露给该 Codex 或其它 Host。客户端只负责账号、项目路径、权限、计费、幂等、锁和恢复等自身安全，不替 Codex 做高层意图/完成门禁。审核 Skill 的索引和正文可作为只读 MCP resource 提供，第三方扩展不得获得客户端会话凭据、内部路径或 bridge token；该能力与公网 `/api/external/v1/mcp` 保持独立。
+
 ### 3.1 客户端安装、运行时注入
 
 - 扩展内容保存在 AGC 客户端的扩展仓库。
diff --git a/docs/technical/【技术方案】Direct回合行为审计账本-2026-08-31.md b/docs/technical/【技术方案】Direct回合行为审计账本-2026-08-31.md
index f16a4a5dc..d8a570436 100644
--- a/docs/technical/【技术方案】Direct回合行为审计账本-2026-08-31.md
+++ b/docs/technical/【技术方案】Direct回合行为审计账本-2026-08-31.md
@@ -89,6 +89,10 @@ Codex app-server 协议里，`commandExecution.commandActions` 已分类为 `Rea
 
 不升级 `GAME_CREATOR_AGENT_DB_SCHEMA_VERSION`；新 `recordType` 走 Ordinary 追加。`updatedAt` / `schemaVersion` 仍由 `serialize_agent_db_record` 写入。
 
+### 2026-09-03 客户端对话与 MCP 能力边界
+
+客户端对话仍由现有 Codex app-server 链路完成；MCP 只暴露客户端自身业务能力和审核 Skill 指导。客户端安全门禁限于账号、项目路径、权限、计费、幂等、锁、revision 与恢复，不根据 Codex 自然语言替代 Codex 决定业务动作。外部 Host 返回如需旁路归档，可使用显式记录工具，但不替代现有 conversation projection，也不触发资源、状态或完成判定。
+
 jsonl 每条自带 `recordedAtMs`（`unix_millis`）。同一 `clientTurnId` 若再次进入（当前 GUI 运行中互斥，结束后理论上可再来）：只追加，不截断；后一次 `turn_start` 视为新 attempt。读摘要时按文件内最后一次 `turn_start` 到对应 `turn_end` 计算 `offeredRead`。`agent.db` 每次 `turn_end` 再追加一条摘要，分析取该 `clientTurnId` 最后一条。
 
 ## 5. 记录合同
@@ -291,7 +295,7 @@ chat_with_game_creator_direct_codex
 
 `direct_game_creator_codex_chat_at_with_optional_observer` 增加可选 `audit: Option<&mut DirectCodexTurnAudit>`，再传到 `run_turn_with_direct_observer`。仅 `workspace_mode == DirectProject` 且 `audit` 为 Some 时抽取。
 
-`run_direct_game_creator_turn_inner` 的 UI observer 保持只处理 `AccumulatedText` / `Activity`。
+`run_direct_game_creator_turn_inner` 的 UI observer 把 `AccumulatedText`（仅开启流式时）映射为 `streaming`，`IntermediateText` 与 `Activity` 一律映射为 `running`，只向前端暴露安全活动词与可见正文，不携带原始 item JSON。
 
 回合失败（生成失败、浏览器试玩失败、回复落盘失败）：只要 `start` 过就 `finish(false)`，保留已观察到的 item。Codex 尚未启动则 `itemCount=0`。