chore: clarify token refresh comments

Co-authored-by: samanhappy <2755122+samanhappy@users.noreply.github.com>

Dockerfile

@@ -2,7 +2,7 @@ FROM python:3.13-slim-bookworm AS base
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
-RUN apt-get update && apt-get install -y curl gnupg git \
+RUN apt-get update && apt-get install -y curl gnupg git build-essential \
   && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
   && apt-get install -y nodejs \
   && apt-get clean && rm -rf /var/lib/apt/lists/*

frontend/src/App.tsx

@@ -4,6 +4,7 @@ import { AuthProvider } from './contexts/AuthContext';
 import { ToastProvider } from './contexts/ToastContext';
 import { ThemeProvider } from './contexts/ThemeContext';
 import { ServerProvider } from './contexts/ServerContext';
+import { SettingsProvider } from './contexts/SettingsContext';
 import MainLayout from './layouts/MainLayout';
 import ProtectedRoute from './components/ProtectedRoute';
 import LoginPage from './pages/LoginPage';
@@ -27,42 +28,41 @@ function App() {
   return (
     <ThemeProvider>
       <AuthProvider>
-      <ServerProvider>
-        <ToastProvider>
-          <Router basename={basename}>
-            <Routes>
-              {/* 公共路由 */}
-              <Route path="/login" element={<LoginPage />} />
+        <ServerProvider>
+          <ToastProvider>
+            <SettingsProvider>
+              <Router basename={basename}>
+                <Routes>
+                  {/* 公共路由 */}
+                  <Route path="/login" element={<LoginPage />} />
 
-              {/* 受保护的路由，使用 MainLayout 作为布局容器 */}
-              <Route element={<ProtectedRoute />}>
-                <Route element={<MainLayout />}>
-                  <Route path="/" element={<DashboardPage />} />
-                  <Route path="/servers" element={<ServersPage />} />
-                  <Route path="/groups" element={<GroupsPage />} />
-                  <Route path="/users" element={<UsersPage />} />
-                  <Route path="/market" element={<MarketPage />} />
-                  <Route path="/market/:serverName" element={<MarketPage />} />
-                  {/* Legacy cloud routes redirect to market with cloud tab */}
-                  <Route path="/cloud" element={<Navigate to="/market?tab=cloud" replace />} />
-                  <Route
-                    path="/cloud/:serverName"
-                    element={<CloudRedirect />}
-                  />
-                  <Route path="/logs" element={<LogsPage />} />
-                  <Route path="/settings" element={<SettingsPage />} />
-                </Route>
-              </Route>
+                  {/* 受保护的路由，使用 MainLayout 作为布局容器 */}
+                  <Route element={<ProtectedRoute />}>
+                    <Route element={<MainLayout />}>
+                      <Route path="/" element={<DashboardPage />} />
+                      <Route path="/servers" element={<ServersPage />} />
+                      <Route path="/groups" element={<GroupsPage />} />
+                      <Route path="/users" element={<UsersPage />} />
+                      <Route path="/market" element={<MarketPage />} />
+                      <Route path="/market/:serverName" element={<MarketPage />} />
+                      {/* Legacy cloud routes redirect to market with cloud tab */}
+                      <Route path="/cloud" element={<Navigate to="/market?tab=cloud" replace />} />
+                      <Route path="/cloud/:serverName" element={<CloudRedirect />} />
+                      <Route path="/logs" element={<LogsPage />} />
+                      <Route path="/settings" element={<SettingsPage />} />
+                    </Route>
+                  </Route>
 
-              {/* 未匹配的路由重定向到首页 */}
-              <Route path="*" element={<Navigate to="/" />} />
-            </Routes>
-          </Router>
-        </ToastProvider>
+                  {/* 未匹配的路由重定向到首页 */}
+                  <Route path="*" element={<Navigate to="/" />} />
+                </Routes>
+              </Router>
+            </SettingsProvider>
+          </ToastProvider>
         </ServerProvider>
       </AuthProvider>
     </ThemeProvider>
   );
 }
 
-export default App;
+export default App;

frontend/src/components/GroupImportForm.tsx

@@ -0,0 +1,284 @@
+import React, { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { apiPost } from '@/utils/fetchInterceptor';
+
+interface GroupImportFormProps {
+  onSuccess: () => void;
+  onCancel: () => void;
+}
+
+interface ImportGroupConfig {
+  name: string;
+  description?: string;
+  servers?: string[] | Array<{ name: string; tools?: string[] | 'all' }>;
+}
+
+interface ImportJsonFormat {
+  groups: ImportGroupConfig[];
+}
+
+const GroupImportForm: React.FC<GroupImportFormProps> = ({ onSuccess, onCancel }) => {
+  const { t } = useTranslation();
+  const [jsonInput, setJsonInput] = useState('');
+  const [error, setError] = useState<string | null>(null);
+  const [isImporting, setIsImporting] = useState(false);
+  const [previewGroups, setPreviewGroups] = useState<ImportGroupConfig[] | null>(null);
+
+  const examplePlaceholder = `{
+  "groups": [
+    {
+      "name": "AI Assistants",
+      "servers": ["openai-server", "anthropic-server"]
+    },
+    {
+      "name": "Development Tools",
+      "servers": [
+        {
+          "name": "github-server",
+          "tools": ["create_issue", "list_repos"]
+        },
+        {
+          "name": "gitlab-server",
+          "tools": "all"
+        }
+      ]
+    }
+  ]
+}
+
+Supports:
+- Simple server list: ["server1", "server2"]
+- Advanced server config: [{"name": "server1", "tools": ["tool1", "tool2"]}]
+- All groups will be imported in a single efficient batch operation.`;
+
+  const parseAndValidateJson = (input: string): ImportJsonFormat | null => {
+    try {
+      const parsed = JSON.parse(input.trim());
+
+      // Validate structure
+      if (!parsed.groups || !Array.isArray(parsed.groups)) {
+        setError(t('groupImport.invalidFormat'));
+        return null;
+      }
+
+      // Validate each group
+      for (const group of parsed.groups) {
+        if (!group.name || typeof group.name !== 'string') {
+          setError(t('groupImport.missingName'));
+          return null;
+        }
+      }
+
+      return parsed as ImportJsonFormat;
+    } catch (e) {
+      setError(t('groupImport.parseError'));
+      return null;
+    }
+  };
+
+  const handlePreview = () => {
+    setError(null);
+    const parsed = parseAndValidateJson(jsonInput);
+    if (!parsed) return;
+
+    setPreviewGroups(parsed.groups);
+  };
+
+  const handleImport = async () => {
+    if (!previewGroups) return;
+
+    setIsImporting(true);
+    setError(null);
+
+    try {
+      // Use batch import API for better performance
+      const result = await apiPost('/groups/batch', {
+        groups: previewGroups,
+      });
+
+      if (result.success) {
+        const { successCount, failureCount, results } = result;
+
+        if (failureCount > 0) {
+          const errors = results
+            .filter((r: any) => !r.success)
+            .map((r: any) => `${r.name}: ${r.message || t('groupImport.addFailed')}`);
+
+          setError(
+            t('groupImport.partialSuccess', { count: successCount, total: previewGroups.length }) +
+              '\n' +
+              errors.join('\n'),
+          );
+        }
+
+        if (successCount > 0) {
+          onSuccess();
+        }
+      } else {
+        setError(result.message || t('groupImport.importFailed'));
+      }
+    } catch (err) {
+      console.error('Import error:', err);
+      setError(t('groupImport.importFailed'));
+    } finally {
+      setIsImporting(false);
+    }
+  };
+
+  const renderServerList = (
+    servers?: string[] | Array<{ name: string; tools?: string[] | 'all' }>,
+  ) => {
+    if (!servers || servers.length === 0) {
+      return <span className="text-gray-500">{t('groups.noServers')}</span>;
+    }
+
+    return (
+      <div className="space-y-1">
+        {servers.map((server, idx) => {
+          if (typeof server === 'string') {
+            return (
+              <div key={idx} className="text-sm">
+                • {server}
+              </div>
+            );
+          } else {
+            return (
+              <div key={idx} className="text-sm">
+                • {server.name}
+                {server.tools && server.tools !== 'all' && (
+                  <span className="text-gray-500 ml-2">
+                    ({Array.isArray(server.tools) ? server.tools.join(', ') : server.tools})
+                  </span>
+                )}
+                {server.tools === 'all' && <span className="text-gray-500 ml-2">(all tools)</span>}
+              </div>
+            );
+          }
+        })}
+      </div>
+    );
+  };
+
+  return (
+    <div className="fixed inset-0 bg-black/50 z-50 flex items-center justify-center p-4">
+      <div className="bg-white shadow rounded-lg p-6 w-full max-w-4xl max-h-[90vh] overflow-y-auto">
+        <div className="flex justify-between items-center mb-6">
+          <h2 className="text-xl font-semibold text-gray-900">{t('groupImport.title')}</h2>
+          <button onClick={onCancel} className="text-gray-500 hover:text-gray-700">
+            ✕
+          </button>
+        </div>
+
+        {error && (
+          <div className="mb-4 bg-red-50 border-l-4 border-red-500 p-4 rounded">
+            <p className="text-red-700 whitespace-pre-wrap">{error}</p>
+          </div>
+        )}
+
+        {!previewGroups ? (
+          <div>
+            <div className="mb-4">
+              <label className="block text-sm font-medium text-gray-700 mb-2">
+                {t('groupImport.inputLabel')}
+              </label>
+              <textarea
+                value={jsonInput}
+                onChange={(e) => setJsonInput(e.target.value)}
+                className="w-full h-96 px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-blue-500 font-mono text-sm"
+                placeholder={examplePlaceholder}
+              />
+              <p className="text-xs text-gray-500 mt-2">{t('groupImport.inputHelp')}</p>
+            </div>
+
+            <div className="flex justify-end space-x-4">
+              <button
+                onClick={onCancel}
+                className="px-4 py-2 text-gray-700 bg-gray-200 rounded hover:bg-gray-300 btn-secondary"
+              >
+                {t('common.cancel')}
+              </button>
+              <button
+                onClick={handlePreview}
+                disabled={!jsonInput.trim()}
+                className="px-4 py-2 bg-blue-600 text-white rounded hover:bg-blue-700 disabled:opacity-50 btn-primary"
+              >
+                {t('groupImport.preview')}
+              </button>
+            </div>
+          </div>
+        ) : (
+          <div>
+            <div className="mb-4">
+              <h3 className="text-lg font-medium text-gray-900 mb-3">
+                {t('groupImport.previewTitle')}
+              </h3>
+              <div className="space-y-3">
+                {previewGroups.map((group, index) => (
+                  <div key={index} className="bg-gray-50 p-4 rounded-lg border border-gray-200">
+                    <div className="flex items-start justify-between">
+                      <div className="flex-1">
+                        <h4 className="font-medium text-gray-900">{group.name}</h4>
+                        {group.description && (
+                          <p className="text-sm text-gray-600 mt-1">{group.description}</p>
+                        )}
+                        <div className="mt-2 text-sm text-gray-600">
+                          <strong>{t('groups.servers')}:</strong>
+                          <div className="mt-1">{renderServerList(group.servers)}</div>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                ))}
+              </div>
+            </div>
+
+            <div className="flex justify-end space-x-4">
+              <button
+                onClick={() => setPreviewGroups(null)}
+                disabled={isImporting}
+                className="px-4 py-2 text-gray-700 bg-gray-200 rounded hover:bg-gray-300 disabled:opacity-50 btn-secondary"
+              >
+                {t('common.back')}
+              </button>
+              <button
+                onClick={handleImport}
+                disabled={isImporting}
+                className="px-4 py-2 bg-blue-600 text-white rounded hover:bg-blue-700 disabled:opacity-50 flex items-center btn-primary"
+              >
+                {isImporting ? (
+                  <>
+                    <svg
+                      className="animate-spin h-4 w-4 mr-2"
+                      xmlns="http://www.w3.org/2000/svg"
+                      fill="none"
+                      viewBox="0 0 24 24"
+                    >
+                      <circle
+                        className="opacity-25"
+                        cx="12"
+                        cy="12"
+                        r="10"
+                        stroke="currentColor"
+                        strokeWidth="4"
+                      ></circle>
+                      <path
+                        className="opacity-75"
+                        fill="currentColor"
+                        d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+                      ></path>
+                    </svg>
+                    {t('groupImport.importing')}
+                  </>
+                ) : (
+                  t('groupImport.import')
+                )}
+              </button>
+            </div>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+};
+
+export default GroupImportForm;

frontend/src/components/JSONImportForm.tsx

@@ -14,6 +14,10 @@ interface McpServerConfig {
   type?: string;
   url?: string;
   headers?: Record<string, string>;
+  openapi?: {
+    version: string;
+    url: string;
+  };
 }
 
 interface ImportJsonFormat {
@@ -29,29 +33,16 @@ const JSONImportForm: React.FC<JSONImportFormProps> = ({ onSuccess, onCancel })
     null,
   );
 
-  const examplePlaceholder = `STDIO example:
-{
+  const examplePlaceholder = `{
   "mcpServers": {
     "stdio-server-example": {
       "command": "npx",
       "args": ["-y", "mcp-server-example"]
-    }
-  }
-}
-
-SSE example:
-{
-  "mcpServers": {
+    },
     "sse-server-example": {
       "type": "sse",
       "url": "http://localhost:3000"
-    }
-  }
-}
-
-HTTP example:
-{
-  "mcpServers": {
+    },
     "http-server-example": {
       "type": "streamable-http",
       "url": "http://localhost:3001",
@@ -59,9 +50,18 @@ HTTP example:
         "Content-Type": "application/json",
         "Authorization": "Bearer your-token"
       }
+    },
+    "openapi-server-example": {
+      "type": "openapi",
+      "openapi": {
+        "url": "https://petstore.swagger.io/v2/swagger.json"
+      }
     }
   }
-}`;
+}
+
+Supports: STDIO, SSE, HTTP (streamable-http), OpenAPI
+All servers will be imported in a single efficient batch operation.`;
 
   const parseAndValidateJson = (input: string): ImportJsonFormat | null => {
     try {
@@ -95,6 +95,9 @@ HTTP example:
         if (config.headers) {
           normalizedConfig.headers = config.headers;
         }
+      } else if (config.type === 'openapi') {
+        normalizedConfig.type = 'openapi';
+        normalizedConfig.openapi = config.openapi;
       } else {
         // Default to stdio
         normalizedConfig.type = 'stdio';
@@ -118,38 +121,31 @@ HTTP example:
     setError(null);
 
     try {
-      let successCount = 0;
-      const errors: string[] = [];
+      // Use batch import API for better performance
+      const result = await apiPost('/servers/batch', {
+        servers: previewServers,
+      });
 
-      for (const server of previewServers) {
-        try {
-          const result = await apiPost('/servers', {
-            name: server.name,
-            config: server.config,
-          });
+      if (result.success && result.data) {
+        const { successCount, failureCount, results } = result.data;
 
-          if (result.success) {
-            successCount++;
-          } else {
-            errors.push(`${server.name}: ${result.message || t('jsonImport.addFailed')}`);
-          }
-        } catch (err) {
-          errors.push(
-            `${server.name}: ${err instanceof Error ? err.message : t('jsonImport.addFailed')}`,
+        if (failureCount > 0) {
+          const errors = results
+            .filter((r: any) => !r.success)
+            .map((r: any) => `${r.name}: ${r.message || t('jsonImport.addFailed')}`);
+
+          setError(
+            t('jsonImport.partialSuccess', { count: successCount, total: previewServers.length }) +
+              '\n' +
+              errors.join('\n'),
           );
         }
-      }
 
-      if (errors.length > 0) {
-        setError(
-          t('jsonImport.partialSuccess', { count: successCount, total: previewServers.length }) +
-            '\n' +
-            errors.join('\n'),
-        );
-      }
-
-      if (successCount > 0) {
-        onSuccess();
+        if (successCount > 0) {
+          onSuccess();
+        }
+      } else {
+        setError(result.message || t('jsonImport.importFailed'));
       }
     } catch (err) {
       console.error('Import error:', err);

frontend/src/components/ServerCard.tsx

@@ -15,14 +15,16 @@ interface ServerCardProps {
   onEdit: (server: Server) => void;
   onToggle?: (server: Server, enabled: boolean) => Promise<boolean>;
   onRefresh?: () => void;
+  onReload?: (server: Server) => Promise<boolean>;
 }
 
-const ServerCard = ({ server, onRemove, onEdit, onToggle, onRefresh }: ServerCardProps) => {
+const ServerCard = ({ server, onRemove, onEdit, onToggle, onRefresh, onReload }: ServerCardProps) => {
   const { t } = useTranslation();
   const { showToast } = useToast();
   const [isExpanded, setIsExpanded] = useState(false);
   const [showDeleteDialog, setShowDeleteDialog] = useState(false);
   const [isToggling, setIsToggling] = useState(false);
+  const [isReloading, setIsReloading] = useState(false);
   const [showErrorPopover, setShowErrorPopover] = useState(false);
   const [copied, setCopied] = useState(false);
   const errorPopoverRef = useRef<HTMLDivElement>(null);
@@ -64,6 +66,26 @@ const ServerCard = ({ server, onRemove, onEdit, onToggle, onRefresh }: ServerCar
     }
   };
 
+  const handleReload = async (e: React.MouseEvent) => {
+    e.stopPropagation();
+    if (isReloading || !onReload) return;
+
+    setIsReloading(true);
+    try {
+      const success = await onReload(server);
+      if (success) {
+        showToast(t('server.reloadSuccess') || 'Server reloaded successfully', 'success');
+      } else {
+        showToast(
+          t('server.reloadError', { serverName: server.name }) || 'Failed to reload server',
+          'error',
+        );
+      }
+    } finally {
+      setIsReloading(false);
+    }
+  };
+
   const handleErrorIconClick = (e: React.MouseEvent) => {
     e.stopPropagation();
     setShowErrorPopover(!showErrorPopover);
@@ -106,6 +128,10 @@ const ServerCard = ({ server, onRemove, onEdit, onToggle, onRefresh }: ServerCar
     e.stopPropagation();
     try {
       const result = await exportMCPSettings(server.name);
+      if (!result || !result.success || !result.data) {
+        showToast(result?.message || t('common.copyFailed') || 'Copy failed', 'error');
+        return;
+      }
       const configJson = JSON.stringify(result.data, null, 2);
 
       if (navigator.clipboard && window.isSecureContext) {
@@ -326,7 +352,7 @@ const ServerCard = ({ server, onRemove, onEdit, onToggle, onRefresh }: ServerCar
                       ? 'bg-green-100 text-green-800 hover:bg-green-200 btn-secondary'
                       : 'bg-gray-100 text-gray-800 hover:bg-gray-200 btn-primary'
                 }`}
-                disabled={isToggling}
+                disabled={isToggling || isReloading}
               >
                 {isToggling
                   ? t('common.processing')
@@ -335,6 +361,15 @@ const ServerCard = ({ server, onRemove, onEdit, onToggle, onRefresh }: ServerCar
                     : t('server.enable')}
               </button>
             </div>
+            {server.enabled !== false && onReload && (
+              <button
+                onClick={handleReload}
+                className="px-3 py-1 bg-purple-100 text-purple-800 rounded hover:bg-purple-200 text-sm btn-secondary disabled:opacity-70 disabled:cursor-not-allowed"
+                disabled={isReloading || isToggling}
+              >
+                {isReloading ? t('common.processing') : t('server.reload')}
+              </button>
+            )}
             <button
               onClick={handleRemove}
               className="px-3 py-1 bg-red-100 text-red-800 rounded hover:bg-red-200 text-sm btn-danger"

frontend/src/components/ui/DynamicForm.tsx

@@ -21,7 +21,14 @@ interface DynamicFormProps {
   title?: string; // Optional title to display instead of default parameters title
 }
 
-const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, loading = false, storageKey, title }) => {
+const DynamicForm: React.FC<DynamicFormProps> = ({
+  schema,
+  onSubmit,
+  onCancel,
+  loading = false,
+  storageKey,
+  title,
+}) => {
   const { t } = useTranslation();
   const [formValues, setFormValues] = useState<Record<string, any>>({});
   const [errors, setErrors] = useState<Record<string, string>>({});
@@ -40,9 +47,14 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
             description: obj.description,
             enum: obj.enum,
             default: obj.default,
-            properties: obj.properties ? Object.fromEntries(
-              Object.entries(obj.properties).map(([key, value]) => [key, convertProperty(value)])
-            ) : undefined,
+            properties: obj.properties
+              ? Object.fromEntries(
+                  Object.entries(obj.properties).map(([key, value]) => [
+                    key,
+                    convertProperty(value),
+                  ]),
+                )
+              : undefined,
             required: obj.required,
             items: obj.items ? convertProperty(obj.items) : undefined,
           };
@@ -52,9 +64,14 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
 
       return {
         type: schema.type,
-        properties: schema.properties ? Object.fromEntries(
-          Object.entries(schema.properties).map(([key, value]) => [key, convertProperty(value)])
-        ) : undefined,
+        properties: schema.properties
+          ? Object.fromEntries(
+              Object.entries(schema.properties).map(([key, value]) => [
+                key,
+                convertProperty(value),
+              ]),
+            )
+          : undefined,
         required: schema.required,
       };
     };
@@ -167,7 +184,7 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
   };
 
   const handleInputChange = (path: string, value: any) => {
-    setFormValues(prev => {
+    setFormValues((prev) => {
       const newValues = { ...prev };
       const keys = path.split('.');
       let current = newValues;
@@ -195,7 +212,7 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
 
     // Clear error for this field
     if (errors[path]) {
-      setErrors(prev => {
+      setErrors((prev) => {
         const newErrors = { ...prev };
         delete newErrors[path];
         return newErrors;
@@ -209,10 +226,16 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
       if (schema.type === 'object' && schema.properties) {
         Object.entries(schema.properties).forEach(([key, propSchema]) => {
           const fullPath = path ? `${path}.${key}` : key;
-          const value = getNestedValue(values, fullPath);
+          const value = values?.[key];
 
           // Check required fields
-          if (schema.required?.includes(key) && (value === undefined || value === null || value === '')) {
+          if (
+            schema.required?.includes(key) &&
+            (value === undefined ||
+              value === null ||
+              value === '' ||
+              (Array.isArray(value) && value.length === 0))
+          ) {
             newErrors[fullPath] = `${key} is required`;
             return;
           }
@@ -223,7 +246,10 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
               newErrors[fullPath] = `${key} must be a string`;
             } else if (propSchema.type === 'number' && typeof value !== 'number') {
               newErrors[fullPath] = `${key} must be a number`;
-            } else if (propSchema.type === 'integer' && (!Number.isInteger(value) || typeof value !== 'number')) {
+            } else if (
+              propSchema.type === 'integer' &&
+              (!Number.isInteger(value) || typeof value !== 'number')
+            ) {
               newErrors[fullPath] = `${key} must be an integer`;
             } else if (propSchema.type === 'boolean' && typeof value !== 'boolean') {
               newErrors[fullPath] = `${key} must be a boolean`;
@@ -260,7 +286,12 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
     return path.split('.').reduce((current, key) => current?.[key], obj);
   };
 
-  const renderObjectField = (key: string, schema: JsonSchema, currentValue: any, onChange: (value: any) => void): React.ReactNode => {
+  const renderObjectField = (
+    key: string,
+    schema: JsonSchema,
+    currentValue: any,
+    onChange: (value: any) => void,
+  ): React.ReactNode => {
     const value = currentValue?.[key];
 
     if (schema.type === 'string') {
@@ -299,7 +330,12 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           step={schema.type === 'integer' ? '1' : 'any'}
           value={value ?? ''}
           onChange={(e) => {
-            const val = e.target.value === '' ? '' : schema.type === 'integer' ? parseInt(e.target.value) : parseFloat(e.target.value);
+            const val =
+              e.target.value === ''
+                ? ''
+                : schema.type === 'integer'
+                  ? parseInt(e.target.value)
+                  : parseFloat(e.target.value);
             onChange(val);
           }}
           className="w-full border rounded-md px-2 py-1 text-sm border-gray-300 focus:outline-none focus:ring-1 focus:ring-blue-500 form-input"
@@ -333,7 +369,7 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
   const renderField = (key: string, propSchema: JsonSchema, path: string = ''): React.ReactNode => {
     const fullPath = path ? `${path}.${key}` : key;
     const value = getNestedValue(formValues, fullPath);
-    const error = errors[fullPath];    // Handle array type
+    const error = errors[fullPath]; // Handle array type
     if (propSchema.type === 'array') {
       const arrayValue = getNestedValue(formValues, fullPath) || [];
 
@@ -341,7 +377,11 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
         <div key={fullPath} className="mb-6">
           <label className="block text-sm font-medium text-gray-700 mb-1">
             {key}
-            {(path ? getNestedValue(jsonSchema, path)?.required?.includes(key) : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+            {(path
+              ? getNestedValue(jsonSchema, path)?.required?.includes(key)
+              : jsonSchema.required?.includes(key)) && (
+              <span className="text-status-red ml-1">*</span>
+            )}
           </label>
           {propSchema.description && (
             <p className="text-xs text-gray-500 mb-2">{propSchema.description}</p>
@@ -349,9 +389,11 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
 
           <div className="border border-gray-200 rounded-md p-3 bg-gray-50">
             {arrayValue.map((item: any, index: number) => (
-              <div key={index} className="mb-3 p-3 bg-white border rounded-md">
+              <div key={index} className="mb-3 p-3 bg-white border border-gray-200 rounded-md">
                 <div className="flex justify-between items-center mb-2">
-                  <span className="text-sm font-medium text-gray-600">{t('tool.item', { index: index + 1 })}</span>
+                  <span className="text-sm font-medium text-gray-600">
+                    {t('tool.item', { index: index + 1 })}
+                  </span>
                   <button
                     type="button"
                     onClick={() => {
@@ -388,7 +430,9 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
                       <div key={objKey}>
                         <label className="block text-xs font-medium text-gray-600 mb-1">
                           {objKey}
-                          {propSchema.items?.required?.includes(objKey) && <span className="text-status-red ml-1">*</span>}
+                          {propSchema.items?.required?.includes(objKey) && (
+                            <span className="text-status-red ml-1">*</span>
+                          )}
                         </label>
                         {renderObjectField(objKey, objSchema as JsonSchema, item, (newValue) => {
                           const newArray = [...arrayValue];
@@ -429,7 +473,7 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           {error && <p className="text-status-red text-xs mt-1">{error}</p>}
         </div>
       );
-    }    // Handle object type
+    } // Handle object type
     if (propSchema.type === 'object') {
       if (propSchema.properties) {
         // Object with defined properties - render as nested form
@@ -437,16 +481,20 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           <div key={fullPath} className="mb-6">
             <label className="block text-sm font-medium text-gray-700 mb-1">
               {key}
-              {(path ? getNestedValue(jsonSchema, path)?.required?.includes(key) : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+              {(path
+                ? getNestedValue(jsonSchema, path)?.required?.includes(key)
+                : jsonSchema.required?.includes(key)) && (
+                <span className="text-status-red ml-1">*</span>
+              )}
             </label>
             {propSchema.description && (
               <p className="text-xs text-gray-500 mb-2">{propSchema.description}</p>
             )}
 
             <div className="border border-gray-200 rounded-md p-4 bg-gray-50">
-              {Object.entries(propSchema.properties).map(([objKey, objSchema]) => (
-                renderField(objKey, objSchema as JsonSchema, fullPath)
-              ))}
+              {Object.entries(propSchema.properties).map(([objKey, objSchema]) =>
+                renderField(objKey, objSchema as JsonSchema, fullPath),
+              )}
             </div>
 
             {error && <p className="text-status-red text-xs mt-1">{error}</p>}
@@ -458,7 +506,11 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           <div key={fullPath} className="mb-4">
             <label className="block text-sm font-medium text-gray-700 mb-1">
               {key}
-              {(path ? getNestedValue(jsonSchema, path)?.required?.includes(key) : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+              {(path
+                ? getNestedValue(jsonSchema, path)?.required?.includes(key)
+                : jsonSchema.required?.includes(key)) && (
+                <span className="text-status-red ml-1">*</span>
+              )}
               <span className="text-xs text-gray-500 ml-1">(JSON object)</span>
             </label>
             {propSchema.description && (
@@ -483,13 +535,16 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           </div>
         );
       }
-    } if (propSchema.type === 'string') {
+    }
+    if (propSchema.type === 'string') {
       if (propSchema.enum) {
         return (
           <div key={fullPath} className="mb-4">
             <label className="block text-sm font-medium text-gray-700 mb-1">
               {key}
-              {(path ? false : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+              {(path ? false : jsonSchema.required?.includes(key)) && (
+                <span className="text-status-red ml-1">*</span>
+              )}
             </label>
             {propSchema.description && (
               <p className="text-xs text-gray-500 mb-2">{propSchema.description}</p>
@@ -514,7 +569,9 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           <div key={fullPath} className="mb-4">
             <label className="block text-sm font-medium text-gray-700 mb-1">
               {key}
-              {(path ? false : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+              {(path ? false : jsonSchema.required?.includes(key)) && (
+                <span className="text-status-red ml-1">*</span>
+              )}
             </label>
             {propSchema.description && (
               <p className="text-xs text-gray-500 mb-2">{propSchema.description}</p>
@@ -529,12 +586,15 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           </div>
         );
       }
-    } if (propSchema.type === 'number' || propSchema.type === 'integer') {
+    }
+    if (propSchema.type === 'number' || propSchema.type === 'integer') {
       return (
         <div key={fullPath} className="mb-4">
           <label className="block text-sm font-medium text-gray-700 mb-1">
             {key}
-            {(path ? false : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+            {(path ? false : jsonSchema.required?.includes(key)) && (
+              <span className="text-status-red ml-1">*</span>
+            )}
           </label>
           {propSchema.description && (
             <p className="text-xs text-gray-500 mb-2">{propSchema.description}</p>
@@ -544,7 +604,12 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
             step={propSchema.type === 'integer' ? '1' : 'any'}
             value={value !== undefined && value !== null ? value : ''}
             onChange={(e) => {
-              const val = e.target.value === '' ? '' : propSchema.type === 'integer' ? parseInt(e.target.value) : parseFloat(e.target.value);
+              const val =
+                e.target.value === ''
+                  ? ''
+                  : propSchema.type === 'integer'
+                    ? parseInt(e.target.value)
+                    : parseFloat(e.target.value);
               handleInputChange(fullPath, val);
             }}
             className={`w-full border rounded-md px-3 py-2 form-input ${error ? 'border-red-500' : 'border-gray-300'} focus:outline-none focus:ring-2 focus:ring-blue-500`}
@@ -566,7 +631,9 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
             />
             <label className="ml-2 block text-sm text-gray-700">
               {key}
-              {(path ? false : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+              {(path ? false : jsonSchema.required?.includes(key)) && (
+                <span className="text-status-red ml-1">*</span>
+              )}
             </label>
           </div>
           {propSchema.description && (
@@ -575,12 +642,14 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           {error && <p className="text-status-red text-xs mt-1">{error}</p>}
         </div>
       );
-    }    // For other types, show as text input with description
+    } // For other types, show as text input with description
     return (
       <div key={fullPath} className="mb-4">
         <label className="block text-sm font-medium text-gray-700 mb-1">
           {key}
-          {(path ? false : jsonSchema.required?.includes(key)) && <span className="text-status-red ml-1">*</span>}
+          {(path ? false : jsonSchema.required?.includes(key)) && (
+            <span className="text-status-red ml-1">*</span>
+          )}
           <span className="text-xs text-gray-500 ml-1">({propSchema.type})</span>
         </label>
         {propSchema.description && (
@@ -631,20 +700,22 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
           <button
             type="button"
             onClick={switchToFormMode}
-            className={`px-3 py-1 text-sm rounded-md transition-colors ${!isJsonMode
-              ? 'bg-blue-100 text-blue-800 rounded hover:bg-blue-200 text-sm btn-primary'
-              : 'text-sm text-gray-600 bg-gray-200 rounded hover:bg-gray-300 btn-secondary'
-              }`}
+            className={`px-3 py-1 text-sm rounded-md transition-colors ${
+              !isJsonMode
+                ? 'bg-blue-100 text-blue-800 rounded hover:bg-blue-200 text-sm btn-primary'
+                : 'text-sm text-gray-600 bg-gray-200 rounded hover:bg-gray-300 btn-secondary'
+            }`}
           >
             {t('tool.formMode')}
           </button>
           <button
             type="button"
             onClick={switchToJsonMode}
-            className={`px-3 py-1 text-sm rounded-md transition-colors ${isJsonMode
-              ? 'px-4 py-1 bg-blue-100 text-blue-800 rounded hover:bg-blue-200 text-sm btn-primary'
-              : 'text-sm text-gray-600 bg-gray-200 rounded hover:bg-gray-300 btn-secondary'
-              }`}
+            className={`px-3 py-1 text-sm rounded-md transition-colors ${
+              isJsonMode
+                ? 'px-4 py-1 bg-blue-100 text-blue-800 rounded hover:bg-blue-200 text-sm btn-primary'
+                : 'text-sm text-gray-600 bg-gray-200 rounded hover:bg-gray-300 btn-secondary'
+            }`}
           >
             {t('tool.jsonMode')}
           </button>
@@ -662,8 +733,9 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
               value={jsonText}
               onChange={(e) => handleJsonTextChange(e.target.value)}
               placeholder={`{\n  "key": "value"\n}`}
-              className={`w-full h-64 border rounded-md px-3 py-2 font-mono text-sm resize-y form-input ${jsonError ? 'border-red-500' : 'border-gray-300'
-                } focus:outline-none focus:ring-2 focus:ring-blue-500`}
+              className={`w-full h-64 border rounded-md px-3 py-2 font-mono text-sm resize-y form-input ${
+                jsonError ? 'border-red-500' : 'border-gray-300'
+              } focus:outline-none focus:ring-2 focus:ring-blue-500`}
             />
             {jsonError && <p className="text-status-red text-xs mt-1">{jsonError}</p>}
           </div>
@@ -696,7 +768,7 @@ const DynamicForm: React.FC<DynamicFormProps> = ({ schema, onSubmit, onCancel, l
         /* Form Mode */
         <form onSubmit={handleSubmit} className="space-y-4">
           {Object.entries(jsonSchema.properties || {}).map(([key, propSchema]) =>
-            renderField(key, propSchema)
+            renderField(key, propSchema),
           )}
 
           <div className="flex justify-end space-x-2 pt-4">

frontend/src/components/ui/MultiSelect.tsx

@@ -0,0 +1,161 @@
+import React, { useState, useRef, useEffect } from 'react';
+import { Check, ChevronDown, X } from 'lucide-react';
+
+interface MultiSelectProps {
+  options: { value: string; label: string }[];
+  selected: string[];
+  onChange: (selected: string[]) => void;
+  placeholder?: string;
+  disabled?: boolean;
+  className?: string;
+}
+
+export const MultiSelect: React.FC<MultiSelectProps> = ({
+  options,
+  selected,
+  onChange,
+  placeholder = 'Select items...',
+  disabled = false,
+  className = '',
+}) => {
+  const [isOpen, setIsOpen] = useState(false);
+  const [searchTerm, setSearchTerm] = useState('');
+  const dropdownRef = useRef<HTMLDivElement>(null);
+  const inputRef = useRef<HTMLInputElement>(null);
+
+  // Close dropdown when clicking outside
+  useEffect(() => {
+    const handleClickOutside = (event: MouseEvent) => {
+      if (dropdownRef.current && !dropdownRef.current.contains(event.target as Node)) {
+        setIsOpen(false);
+        setSearchTerm('');
+      }
+    };
+
+    document.addEventListener('mousedown', handleClickOutside);
+    return () => document.removeEventListener('mousedown', handleClickOutside);
+  }, []);
+
+  const filteredOptions = options.filter((option) =>
+    option.label.toLowerCase().includes(searchTerm.toLowerCase()),
+  );
+
+  const handleToggleOption = (value: string) => {
+    if (disabled) return;
+
+    const newSelected = selected.includes(value)
+      ? selected.filter((item) => item !== value)
+      : [...selected, value];
+
+    onChange(newSelected);
+  };
+
+  const handleRemoveItem = (value: string, e: React.MouseEvent) => {
+    e.stopPropagation();
+    if (disabled) return;
+    onChange(selected.filter((item) => item !== value));
+  };
+
+  const handleToggleDropdown = () => {
+    if (disabled) return;
+    setIsOpen(!isOpen);
+    if (!isOpen) {
+      setTimeout(() => inputRef.current?.focus(), 0);
+    }
+  };
+
+  const getSelectedLabels = () => {
+    return selected
+      .map((value) => options.find((opt) => opt.value === value)?.label || value)
+      .filter(Boolean);
+  };
+
+  return (
+    <div ref={dropdownRef} className={`relative ${className}`}>
+      {/* Selected items display */}
+      <div
+        onClick={handleToggleDropdown}
+        className={`
+          min-h-[38px] w-full px-3 py-1.5 border rounded-md shadow-sm
+          flex flex-wrap items-center gap-1.5 cursor-pointer
+          transition-all duration-200
+          ${disabled ? 'bg-gray-100 cursor-not-allowed' : 'bg-white hover:border-blue-400'}
+          ${isOpen ? 'border-blue-500 ring-1 ring-blue-500' : 'border-gray-300'}
+        `}
+      >
+        {selected.length > 0 ? (
+          <>
+            {getSelectedLabels().map((label, index) => (
+              <span
+                key={selected[index]}
+                className="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-blue-100 text-blue-800"
+              >
+                {label}
+                {!disabled && (
+                  <button
+                    type="button"
+                    onClick={(e) => handleRemoveItem(selected[index], e)}
+                    className="ml-1 hover:bg-blue-200 rounded-full p-0.5 transition-colors"
+                  >
+                    <X className="h-3 w-3" />
+                  </button>
+                )}
+              </span>
+            ))}
+          </>
+        ) : (
+          <span className="text-gray-400 text-sm">{placeholder}</span>
+        )}
+        <div className="flex-1"></div>
+        <ChevronDown
+          className={`h-4 w-4 text-gray-400 transition-transform duration-200 ${isOpen ? 'transform rotate-180' : ''}`}
+        />
+      </div>
+
+      {/* Dropdown menu */}
+      {isOpen && !disabled && (
+        <div className="absolute z-50 w-full mt-1 bg-white border border-gray-300 rounded-md shadow-lg max-h-60 overflow-hidden">
+          {/* Search input */}
+          <div className="p-2 border-b border-gray-200">
+            <input
+              ref={inputRef}
+              type="text"
+              value={searchTerm}
+              onChange={(e) => setSearchTerm(e.target.value)}
+              placeholder="Search..."
+              className="w-full px-3 py-1.5 text-sm border border-gray-300 rounded focus:outline-none focus:ring-1 focus:ring-blue-500 focus:border-blue-500"
+              onClick={(e) => e.stopPropagation()}
+            />
+          </div>
+
+          {/* Options list */}
+          <div className="max-h-48 overflow-y-auto">
+            {filteredOptions.length > 0 ? (
+              filteredOptions.map((option) => {
+                const isSelected = selected.includes(option.value);
+                return (
+                  <div
+                    key={option.value}
+                    onClick={() => handleToggleOption(option.value)}
+                    className={`
+                      px-3 py-2 cursor-pointer flex items-center justify-between
+                      transition-colors duration-150
+                      ${isSelected ? 'bg-blue-50 text-blue-700' : 'hover:bg-gray-100'}
+                    `}
+                  >
+                    <span className="text-sm">{option.label}</span>
+                    {isSelected && <Check className="h-4 w-4 text-blue-600" />}
+                  </div>
+                );
+              })
+            ) : (
+              <div className="px-3 py-2 text-sm text-gray-500 text-center">
+                {searchTerm ? 'No results found' : 'No options available'}
+              </div>
+            )}
+          </div>
+        </div>
+      )}
+    </div>
+  );
+};

frontend/src/components/ui/PromptCard.tsx

@@ -1,152 +1,174 @@
-import { useState, useCallback, useRef, useEffect } from 'react'
-import { useTranslation } from 'react-i18next'
-import { Prompt } from '@/types'
-import { ChevronDown, ChevronRight, Play, Loader, Edit, Check } from '@/components/icons/LucideIcons'
-import { Switch } from './ToggleGroup'
-import { getPrompt, PromptCallResult } from '@/services/promptService'
-import { useSettingsData } from '@/hooks/useSettingsData'
-import DynamicForm from './DynamicForm'
-import PromptResult from './PromptResult'
+import { useState, useCallback, useRef, useEffect } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Prompt } from '@/types';
+import {
+  ChevronDown,
+  ChevronRight,
+  Play,
+  Loader,
+  Edit,
+  Check,
+} from '@/components/icons/LucideIcons';
+import { Switch } from './ToggleGroup';
+import { getPrompt, updatePromptDescription, PromptCallResult } from '@/services/promptService';
+import { useSettingsData } from '@/hooks/useSettingsData';
+import DynamicForm from './DynamicForm';
+import PromptResult from './PromptResult';
+import { useToast } from '@/contexts/ToastContext';
 
 interface PromptCardProps {
-  server: string
-  prompt: Prompt
-  onToggle?: (promptName: string, enabled: boolean) => void
-  onDescriptionUpdate?: (promptName: string, description: string) => void
+  server: string;
+  prompt: Prompt;
+  onToggle?: (promptName: string, enabled: boolean) => void;
+  onDescriptionUpdate?: (promptName: string, description: string) => void;
 }
 
 const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCardProps) => {
-  const { t } = useTranslation()
-  const { nameSeparator } = useSettingsData()
-  const [isExpanded, setIsExpanded] = useState(false)
-  const [showRunForm, setShowRunForm] = useState(false)
-  const [isRunning, setIsRunning] = useState(false)
-  const [result, setResult] = useState<PromptCallResult | null>(null)
-  const [isEditingDescription, setIsEditingDescription] = useState(false)
-  const [customDescription, setCustomDescription] = useState(prompt.description || '')
-  const descriptionInputRef = useRef<HTMLInputElement>(null)
-  const descriptionTextRef = useRef<HTMLSpanElement>(null)
-  const [textWidth, setTextWidth] = useState<number>(0)
+  const { t } = useTranslation();
+  const { showToast } = useToast();
+  const { nameSeparator } = useSettingsData();
+  const [isExpanded, setIsExpanded] = useState(false);
+  const [showRunForm, setShowRunForm] = useState(false);
+  const [isRunning, setIsRunning] = useState(false);
+  const [result, setResult] = useState<PromptCallResult | null>(null);
+  const [isEditingDescription, setIsEditingDescription] = useState(false);
+  const [customDescription, setCustomDescription] = useState(prompt.description || '');
+  const descriptionInputRef = useRef<HTMLInputElement>(null);
+  const descriptionTextRef = useRef<HTMLSpanElement>(null);
+  const [textWidth, setTextWidth] = useState<number>(0);
 
   // Focus the input when editing mode is activated
   useEffect(() => {
     if (isEditingDescription && descriptionInputRef.current) {
-      descriptionInputRef.current.focus()
+      descriptionInputRef.current.focus();
       // Set input width to match text width
       if (textWidth > 0) {
-        descriptionInputRef.current.style.width = `${textWidth + 20}px` // Add some padding
+        descriptionInputRef.current.style.width = `${textWidth + 20}px`; // Add some padding
       }
     }
-  }, [isEditingDescription, textWidth])
+  }, [isEditingDescription, textWidth]);
 
   // Measure text width when not editing
   useEffect(() => {
     if (!isEditingDescription && descriptionTextRef.current) {
-      setTextWidth(descriptionTextRef.current.offsetWidth)
+      setTextWidth(descriptionTextRef.current.offsetWidth);
     }
-  }, [isEditingDescription, customDescription])
+  }, [isEditingDescription, customDescription]);
 
   // Generate a unique key for localStorage based on prompt name and server
   const getStorageKey = useCallback(() => {
-    return `mcphub_prompt_form_${server ? `${server}_` : ''}${prompt.name}`
-  }, [prompt.name, server])
+    return `mcphub_prompt_form_${server ? `${server}_` : ''}${prompt.name}`;
+  }, [prompt.name, server]);
 
   // Clear form data from localStorage
   const clearStoredFormData = useCallback(() => {
-    localStorage.removeItem(getStorageKey())
-  }, [getStorageKey])
+    localStorage.removeItem(getStorageKey());
+  }, [getStorageKey]);
 
   const handleToggle = (enabled: boolean) => {
     if (onToggle) {
-      onToggle(prompt.name, enabled)
+      onToggle(prompt.name, enabled);
     }
-  }
+  };
 
   const handleDescriptionEdit = () => {
-    setIsEditingDescription(true)
-  }
+    setIsEditingDescription(true);
+  };
 
   const handleDescriptionSave = async () => {
-    // For now, we'll just update the local state
-    // In a real implementation, you would call an API to update the description
-    setIsEditingDescription(false)
-    if (onDescriptionUpdate) {
-      onDescriptionUpdate(prompt.name, customDescription)
+    setIsEditingDescription(false);
+    try {
+      const result = await updatePromptDescription(server, prompt.name, customDescription);
+      if (result.success) {
+        showToast(t('prompt.descriptionUpdateSuccess'), 'success');
+        if (onDescriptionUpdate) {
+          onDescriptionUpdate(prompt.name, customDescription);
+        }
+      } else {
+        showToast(result.error || t('prompt.descriptionUpdateFailed'), 'error');
+        // Revert to original description on failure
+        setCustomDescription(prompt.description || '');
+      }
+    } catch (error) {
+      console.error('Error updating prompt description:', error);
+      showToast(t('prompt.descriptionUpdateFailed'), 'error');
+      // Revert to original description on failure
+      setCustomDescription(prompt.description || '');
     }
-  }
+  };
 
   const handleDescriptionChange = (e: React.ChangeEvent<HTMLInputElement>) => {
-    setCustomDescription(e.target.value)
-  }
+    setCustomDescription(e.target.value);
+  };
 
   const handleDescriptionKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
     if (e.key === 'Enter') {
-      handleDescriptionSave()
+      handleDescriptionSave();
     } else if (e.key === 'Escape') {
-      setCustomDescription(prompt.description || '')
-      setIsEditingDescription(false)
+      setCustomDescription(prompt.description || '');
+      setIsEditingDescription(false);
     }
-  }
+  };
 
   const handleGetPrompt = async (arguments_: Record<string, any>) => {
-    setIsRunning(true)
+    setIsRunning(true);
     try {
-      const result = await getPrompt({ promptName: prompt.name, arguments: arguments_ }, server)
-      console.log('GetPrompt result:', result)
+      const result = await getPrompt({ promptName: prompt.name, arguments: arguments_ }, server);
+      console.log('GetPrompt result:', result);
       setResult({
         success: result.success,
         data: result.data,
-        error: result.error
-      })
+        error: result.error,
+      });
       // Clear form data on successful submission
       // clearStoredFormData()
     } catch (error) {
       setResult({
         success: false,
         error: error instanceof Error ? error.message : 'Unknown error occurred',
-      })
+      });
     } finally {
-      setIsRunning(false)
+      setIsRunning(false);
     }
-  }
+  };
 
   const handleCancelRun = () => {
-    setShowRunForm(false)
+    setShowRunForm(false);
     // Clear form data when cancelled
-    clearStoredFormData()
-    setResult(null)
-  }
+    clearStoredFormData();
+    setResult(null);
+  };
 
   const handleCloseResult = () => {
-    setResult(null)
-  }
+    setResult(null);
+  };
 
   // Convert prompt arguments to ToolInputSchema format for DynamicForm
   const convertToSchema = () => {
     if (!prompt.arguments || prompt.arguments.length === 0) {
-      return { type: 'object', properties: {}, required: [] }
+      return { type: 'object', properties: {}, required: [] };
     }
 
-    const properties: Record<string, any> = {}
-    const required: string[] = []
+    const properties: Record<string, any> = {};
+    const required: string[] = [];
 
-    prompt.arguments.forEach(arg => {
+    prompt.arguments.forEach((arg) => {
       properties[arg.name] = {
         type: 'string', // Default to string for prompts
-        description: arg.description || ''
-      }
+        description: arg.description || '',
+      };
 
       if (arg.required) {
-        required.push(arg.name)
+        required.push(arg.name);
       }
-    })
+    });
 
     return {
       type: 'object',
       properties,
-      required
-    }
-  }
+      required,
+    };
+  };
 
   return (
     <div className="bg-white border border-gray-200 shadow rounded-lg p-4 mb-4">
@@ -158,9 +180,7 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
           <h3 className="text-lg font-medium text-gray-900">
             {prompt.name.replace(server + nameSeparator, '')}
             {prompt.title && (
-              <span className="ml-2 text-sm font-normal text-gray-600">
-                {prompt.title}
-              </span>
+              <span className="ml-2 text-sm font-normal text-gray-600">{prompt.title}</span>
             )}
             <span className="ml-2 text-sm font-normal text-gray-500 inline-flex items-center">
               {isEditingDescription ? (
@@ -175,14 +195,14 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
                     onClick={(e) => e.stopPropagation()}
                     style={{
                       minWidth: '100px',
-                      width: textWidth > 0 ? `${textWidth + 20}px` : 'auto'
+                      width: textWidth > 0 ? `${textWidth + 20}px` : 'auto',
                     }}
                   />
                   <button
                     className="ml-2 p-1 text-green-600 hover:text-green-800 cursor-pointer transition-colors"
                     onClick={(e) => {
-                      e.stopPropagation()
-                      handleDescriptionSave()
+                      e.stopPropagation();
+                      handleDescriptionSave();
                     }}
                   >
                     <Check size={16} />
@@ -190,12 +210,14 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
                 </>
               ) : (
                 <>
-                  <span ref={descriptionTextRef}>{customDescription || t('tool.noDescription')}</span>
+                  <span ref={descriptionTextRef}>
+                    {customDescription || t('tool.noDescription')}
+                  </span>
                   <button
                     className="ml-2 p-1 text-gray-500 hover:text-blue-600 cursor-pointer transition-colors"
                     onClick={(e) => {
-                      e.stopPropagation()
-                      handleDescriptionEdit()
+                      e.stopPropagation();
+                      handleDescriptionEdit();
                     }}
                   >
                     <Edit size={14} />
@@ -206,10 +228,7 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
           </h3>
         </div>
         <div className="flex items-center space-x-2">
-          <div
-            className="flex items-center space-x-2"
-            onClick={(e) => e.stopPropagation()}
-          >
+          <div className="flex items-center space-x-2" onClick={(e) => e.stopPropagation()}>
             {prompt.enabled !== undefined && (
               <Switch
                 checked={prompt.enabled}
@@ -220,18 +239,14 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
           </div>
           <button
             onClick={(e) => {
-              e.stopPropagation()
-              setIsExpanded(true) // Ensure card is expanded when showing run form
-              setShowRunForm(true)
+              e.stopPropagation();
+              setIsExpanded(true); // Ensure card is expanded when showing run form
+              setShowRunForm(true);
             }}
             className="flex items-center space-x-1 px-3 py-1 text-sm text-blue-600 bg-blue-50 hover:bg-blue-100 rounded-md transition-colors btn-primary"
             disabled={isRunning || !prompt.enabled}
           >
-            {isRunning ? (
-              <Loader size={14} className="animate-spin" />
-            ) : (
-              <Play size={14} />
-            )}
+            {isRunning ? <Loader size={14} className="animate-spin" /> : <Play size={14} />}
             <span>{isRunning ? t('tool.running') : t('tool.run')}</span>
           </button>
           <button className="text-gray-400 hover:text-gray-600">
@@ -251,7 +266,9 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
                 onCancel={handleCancelRun}
                 loading={isRunning}
                 storageKey={getStorageKey()}
-                title={t('prompt.runPromptWithName', { name: prompt.name.replace(server + nameSeparator, '') })}
+                title={t('prompt.runPromptWithName', {
+                  name: prompt.name.replace(server + nameSeparator, ''),
+                })}
               />
               {/* Prompt Result */}
               {result && (
@@ -278,9 +295,7 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
                         <p className="text-sm text-gray-600 mt-1">{arg.description}</p>
                       )}
                     </div>
-                    <div className="text-xs text-gray-500 ml-2">
-                      {arg.title || ''}
-                    </div>
+                    <div className="text-xs text-gray-500 ml-2">{arg.title || ''}</div>
                   </div>
                 ))}
               </div>
@@ -296,7 +311,7 @@ const PromptCard = ({ prompt, server, onToggle, onDescriptionUpdate }: PromptCar
         </div>
       )}
     </div>
-  )
-}
+  );
+};
 
-export default PromptCard
+export default PromptCard;

frontend/src/contexts/ServerContext.tsx

@@ -30,6 +30,7 @@ interface ServerContextType {
   handleServerEdit: (server: Server) => Promise<any>;
   handleServerRemove: (serverName: string) => Promise<boolean>;
   handleServerToggle: (server: Server, enabled: boolean) => Promise<boolean>;
+  handleServerReload: (server: Server) => Promise<boolean>;
 }
 
 // Create Context
@@ -358,6 +359,30 @@ export const ServerProvider: React.FC<{ children: React.ReactNode }> = ({ childr
     [t],
   );
 
+  const handleServerReload = useCallback(
+    async (server: Server) => {
+      try {
+        const encodedServerName = encodeURIComponent(server.name);
+        const result = await apiPost(`/servers/${encodedServerName}/reload`, {});
+
+        if (!result || !result.success) {
+          console.error('Failed to reload server:', result);
+          setError(t('server.reloadError', { serverName: server.name }));
+          return false;
+        }
+
+        // Refresh server list after successful reload
+        triggerRefresh();
+        return true;
+      } catch (err) {
+        console.error('Error reloading server:', err);
+        setError(err instanceof Error ? err.message : String(err));
+        return false;
+      }
+    },
+    [t, triggerRefresh],
+  );
+
   const value: ServerContextType = {
     servers,
     error,
@@ -370,6 +395,7 @@ export const ServerProvider: React.FC<{ children: React.ReactNode }> = ({ childr
     handleServerEdit,
     handleServerRemove,
     handleServerToggle,
+    handleServerReload,
   };
 
   return <ServerContext.Provider value={value}>{children}</ServerContext.Provider>;

frontend/src/contexts/SettingsContext.tsx

@@ -0,0 +1,792 @@
+import React, {
+  createContext,
+  useContext,
+  useState,
+  useCallback,
+  useEffect,
+  ReactNode,
+} from 'react';
+import { useTranslation } from 'react-i18next';
+import { ApiResponse, BearerKey } from '@/types';
+import { useToast } from '@/contexts/ToastContext';
+import { apiGet, apiPut, apiPost, apiDelete } from '@/utils/fetchInterceptor';
+
+// Define types for the settings data
+interface RoutingConfig {
+  enableGlobalRoute: boolean;
+  enableGroupNameRoute: boolean;
+  enableBearerAuth: boolean;
+  bearerAuthKey: string;
+  skipAuth: boolean;
+}
+
+interface InstallConfig {
+  pythonIndexUrl: string;
+  npmRegistry: string;
+  baseUrl: string;
+}
+
+interface SmartRoutingConfig {
+  enabled: boolean;
+  dbUrl: string;
+  openaiApiBaseUrl: string;
+  openaiApiKey: string;
+  openaiApiEmbeddingModel: string;
+}
+
+interface MCPRouterConfig {
+  apiKey: string;
+  referer: string;
+  title: string;
+  baseUrl: string;
+}
+
+interface OAuthServerConfig {
+  enabled: boolean;
+  accessTokenLifetime: number;
+  refreshTokenLifetime: number;
+  authorizationCodeLifetime: number;
+  requireClientSecret: boolean;
+  allowedScopes: string[];
+  requireState: boolean;
+  dynamicRegistration: {
+    enabled: boolean;
+    allowedGrantTypes: string[];
+    requiresAuthentication: boolean;
+  };
+}
+
+interface SystemSettings {
+  systemConfig?: {
+    routing?: RoutingConfig;
+    install?: InstallConfig;
+    smartRouting?: SmartRoutingConfig;
+    mcpRouter?: MCPRouterConfig;
+    nameSeparator?: string;
+    oauthServer?: OAuthServerConfig;
+    enableSessionRebuild?: boolean;
+  };
+  bearerKeys?: BearerKey[];
+}
+
+interface TempRoutingConfig {
+  bearerAuthKey: string;
+}
+
+interface SettingsContextValue {
+  routingConfig: RoutingConfig;
+  tempRoutingConfig: TempRoutingConfig;
+  setTempRoutingConfig: React.Dispatch<React.SetStateAction<TempRoutingConfig>>;
+  installConfig: InstallConfig;
+  smartRoutingConfig: SmartRoutingConfig;
+  mcpRouterConfig: MCPRouterConfig;
+  oauthServerConfig: OAuthServerConfig;
+  nameSeparator: string;
+  enableSessionRebuild: boolean;
+  bearerKeys: BearerKey[];
+  loading: boolean;
+  error: string | null;
+  setError: React.Dispatch<React.SetStateAction<string | null>>;
+  triggerRefresh: () => void;
+  fetchSettings: () => Promise<void>;
+  updateRoutingConfig: (key: keyof RoutingConfig, value: any) => Promise<boolean | undefined>;
+  updateInstallConfig: (key: keyof InstallConfig, value: any) => Promise<boolean | undefined>;
+  updateSmartRoutingConfig: (
+    key: keyof SmartRoutingConfig,
+    value: any,
+  ) => Promise<boolean | undefined>;
+  updateSmartRoutingConfigBatch: (
+    updates: Partial<SmartRoutingConfig>,
+  ) => Promise<boolean | undefined>;
+  updateRoutingConfigBatch: (updates: Partial<RoutingConfig>) => Promise<boolean | undefined>;
+  updateMCPRouterConfig: (key: keyof MCPRouterConfig, value: any) => Promise<boolean | undefined>;
+  updateMCPRouterConfigBatch: (updates: Partial<MCPRouterConfig>) => Promise<boolean | undefined>;
+  updateOAuthServerConfig: (
+    key: keyof OAuthServerConfig,
+    value: any,
+  ) => Promise<boolean | undefined>;
+  updateOAuthServerConfigBatch: (
+    updates: Partial<OAuthServerConfig>,
+  ) => Promise<boolean | undefined>;
+  updateNameSeparator: (value: string) => Promise<boolean | undefined>;
+  updateSessionRebuild: (value: boolean) => Promise<boolean | undefined>;
+  exportMCPSettings: (serverName?: string) => Promise<any>;
+  // Bearer key management
+  refreshBearerKeys: () => Promise<void>;
+  createBearerKey: (payload: Omit<BearerKey, 'id'>) => Promise<BearerKey | null>;
+  updateBearerKey: (
+    id: string,
+    updates: Partial<Omit<BearerKey, 'id'>>,
+  ) => Promise<BearerKey | null>;
+  deleteBearerKey: (id: string) => Promise<boolean>;
+}
+
+const getDefaultOAuthServerConfig = (): OAuthServerConfig => ({
+  enabled: true,
+  accessTokenLifetime: 3600,
+  refreshTokenLifetime: 1209600,
+  authorizationCodeLifetime: 300,
+  requireClientSecret: false,
+  allowedScopes: ['read', 'write'],
+  requireState: false,
+  dynamicRegistration: {
+    enabled: true,
+    allowedGrantTypes: ['authorization_code', 'refresh_token'],
+    requiresAuthentication: false,
+  },
+});
+
+const SettingsContext = createContext<SettingsContextValue | undefined>(undefined);
+
+export const useSettings = () => {
+  const context = useContext(SettingsContext);
+  if (!context) {
+    throw new Error('useSettings must be used within a SettingsProvider');
+  }
+  return context;
+};
+
+interface SettingsProviderProps {
+  children: ReactNode;
+}
+
+export const SettingsProvider: React.FC<SettingsProviderProps> = ({ children }) => {
+  const { t } = useTranslation();
+  const { showToast } = useToast();
+
+  const [routingConfig, setRoutingConfig] = useState<RoutingConfig>({
+    enableGlobalRoute: true,
+    enableGroupNameRoute: true,
+    enableBearerAuth: false,
+    bearerAuthKey: '',
+    skipAuth: false,
+  });
+
+  const [tempRoutingConfig, setTempRoutingConfig] = useState<TempRoutingConfig>({
+    bearerAuthKey: '',
+  });
+
+  const [installConfig, setInstallConfig] = useState<InstallConfig>({
+    pythonIndexUrl: '',
+    npmRegistry: '',
+    baseUrl: 'http://localhost:3000',
+  });
+
+  const [smartRoutingConfig, setSmartRoutingConfig] = useState<SmartRoutingConfig>({
+    enabled: false,
+    dbUrl: '',
+    openaiApiBaseUrl: '',
+    openaiApiKey: '',
+    openaiApiEmbeddingModel: '',
+  });
+
+  const [mcpRouterConfig, setMCPRouterConfig] = useState<MCPRouterConfig>({
+    apiKey: '',
+    referer: 'https://www.mcphubx.com',
+    title: 'MCPHub',
+    baseUrl: 'https://api.mcprouter.to/v1',
+  });
+
+  const [oauthServerConfig, setOAuthServerConfig] = useState<OAuthServerConfig>(
+    getDefaultOAuthServerConfig(),
+  );
+
+  const [nameSeparator, setNameSeparator] = useState<string>('-');
+  const [enableSessionRebuild, setEnableSessionRebuild] = useState<boolean>(false);
+  const [bearerKeys, setBearerKeys] = useState<BearerKey[]>([]);
+
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [refreshKey, setRefreshKey] = useState(0);
+
+  // Trigger a refresh of the settings data
+  const triggerRefresh = useCallback(() => {
+    setRefreshKey((prev) => prev + 1);
+  }, []);
+
+  // Fetch current settings
+  const fetchSettings = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data: ApiResponse<SystemSettings> = await apiGet('/settings');
+
+      if (data.success && data.data?.systemConfig?.routing) {
+        setRoutingConfig({
+          enableGlobalRoute: data.data.systemConfig.routing.enableGlobalRoute ?? true,
+          enableGroupNameRoute: data.data.systemConfig.routing.enableGroupNameRoute ?? true,
+          enableBearerAuth: data.data.systemConfig.routing.enableBearerAuth ?? false,
+          bearerAuthKey: data.data.systemConfig.routing.bearerAuthKey || '',
+          skipAuth: data.data.systemConfig.routing.skipAuth ?? false,
+        });
+      }
+      if (data.success && data.data?.systemConfig?.install) {
+        setInstallConfig({
+          pythonIndexUrl: data.data.systemConfig.install.pythonIndexUrl || '',
+          npmRegistry: data.data.systemConfig.install.npmRegistry || '',
+          baseUrl: data.data.systemConfig.install.baseUrl || 'http://localhost:3000',
+        });
+      }
+      if (data.success && data.data?.systemConfig?.smartRouting) {
+        setSmartRoutingConfig({
+          enabled: data.data.systemConfig.smartRouting.enabled ?? false,
+          dbUrl: data.data.systemConfig.smartRouting.dbUrl || '',
+          openaiApiBaseUrl: data.data.systemConfig.smartRouting.openaiApiBaseUrl || '',
+          openaiApiKey: data.data.systemConfig.smartRouting.openaiApiKey || '',
+          openaiApiEmbeddingModel:
+            data.data.systemConfig.smartRouting.openaiApiEmbeddingModel || '',
+        });
+      }
+      if (data.success && data.data?.systemConfig?.mcpRouter) {
+        setMCPRouterConfig({
+          apiKey: data.data.systemConfig.mcpRouter.apiKey || '',
+          referer: data.data.systemConfig.mcpRouter.referer || 'https://www.mcphubx.com',
+          title: data.data.systemConfig.mcpRouter.title || 'MCPHub',
+          baseUrl: data.data.systemConfig.mcpRouter.baseUrl || 'https://api.mcprouter.to/v1',
+        });
+      }
+      if (data.success) {
+        if (data.data?.systemConfig?.oauthServer) {
+          const oauth = data.data.systemConfig.oauthServer;
+          const defaultOauthConfig = getDefaultOAuthServerConfig();
+          const defaultDynamic = defaultOauthConfig.dynamicRegistration;
+          const allowedScopes = Array.isArray(oauth.allowedScopes)
+            ? [...oauth.allowedScopes]
+            : [...defaultOauthConfig.allowedScopes];
+          const dynamicAllowedGrantTypes = Array.isArray(
+            oauth.dynamicRegistration?.allowedGrantTypes,
+          )
+            ? [...oauth.dynamicRegistration!.allowedGrantTypes!]
+            : [...defaultDynamic.allowedGrantTypes];
+
+          setOAuthServerConfig({
+            enabled: oauth.enabled ?? defaultOauthConfig.enabled,
+            accessTokenLifetime:
+              oauth.accessTokenLifetime ?? defaultOauthConfig.accessTokenLifetime,
+            refreshTokenLifetime:
+              oauth.refreshTokenLifetime ?? defaultOauthConfig.refreshTokenLifetime,
+            authorizationCodeLifetime:
+              oauth.authorizationCodeLifetime ?? defaultOauthConfig.authorizationCodeLifetime,
+            requireClientSecret:
+              oauth.requireClientSecret ?? defaultOauthConfig.requireClientSecret,
+            requireState: oauth.requireState ?? defaultOauthConfig.requireState,
+            allowedScopes,
+            dynamicRegistration: {
+              enabled: oauth.dynamicRegistration?.enabled ?? defaultDynamic.enabled,
+              allowedGrantTypes: dynamicAllowedGrantTypes,
+              requiresAuthentication:
+                oauth.dynamicRegistration?.requiresAuthentication ??
+                defaultDynamic.requiresAuthentication,
+            },
+          });
+        } else {
+          setOAuthServerConfig(getDefaultOAuthServerConfig());
+        }
+      }
+      if (data.success && data.data?.systemConfig?.nameSeparator !== undefined) {
+        setNameSeparator(data.data.systemConfig.nameSeparator);
+      }
+      if (data.success && data.data?.systemConfig?.enableSessionRebuild !== undefined) {
+        setEnableSessionRebuild(data.data.systemConfig.enableSessionRebuild);
+      }
+
+      if (data.success && Array.isArray(data.data?.bearerKeys)) {
+        setBearerKeys(data.data.bearerKeys);
+      }
+    } catch (error) {
+      console.error('Failed to fetch settings:', error);
+      setError(error instanceof Error ? error.message : 'Failed to fetch settings');
+      showToast(t('errors.failedToFetchSettings'));
+    } finally {
+      setLoading(false);
+    }
+  }, [t, showToast]);
+
+  // Update routing configuration
+  const updateRoutingConfig = async (key: keyof RoutingConfig, value: any) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        routing: {
+          [key]: value,
+        },
+      });
+
+      if (data.success) {
+        setRoutingConfig({
+          ...routingConfig,
+          [key]: value,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update routing config');
+        showToast(data.error || t('errors.failedToUpdateRoutingConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update routing config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update routing config');
+      showToast(t('errors.failedToUpdateRoutingConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Update install configuration
+  const updateInstallConfig = async (key: keyof InstallConfig, value: any) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        install: {
+          [key]: value,
+        },
+      });
+
+      if (data.success) {
+        setInstallConfig({
+          ...installConfig,
+          [key]: value,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update install config');
+        showToast(data.error || t('errors.failedToUpdateInstallConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update install config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update install config');
+      showToast(t('errors.failedToUpdateInstallConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Update smart routing configuration
+  const updateSmartRoutingConfig = async (key: keyof SmartRoutingConfig, value: any) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        smartRouting: {
+          [key]: value,
+        },
+      });
+
+      if (data.success) {
+        setSmartRoutingConfig({
+          ...smartRoutingConfig,
+          [key]: value,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update smart routing config');
+        showToast(data.error || t('errors.failedToUpdateSmartRoutingConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update smart routing config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update smart routing config');
+      showToast(t('errors.failedToUpdateSmartRoutingConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Batch update smart routing configuration
+  const updateSmartRoutingConfigBatch = async (updates: Partial<SmartRoutingConfig>) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        smartRouting: updates,
+      });
+
+      if (data.success) {
+        setSmartRoutingConfig({
+          ...smartRoutingConfig,
+          ...updates,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update smart routing config');
+        showToast(data.error || t('errors.failedToUpdateSmartRoutingConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update smart routing config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update smart routing config');
+      showToast(t('errors.failedToUpdateSmartRoutingConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Batch update routing configuration
+  const updateRoutingConfigBatch = async (updates: Partial<RoutingConfig>) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        routing: updates,
+      });
+
+      if (data.success) {
+        setRoutingConfig({
+          ...routingConfig,
+          ...updates,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update routing config');
+        showToast(data.error || t('errors.failedToUpdateRoutingConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update routing config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update routing config');
+      showToast(t('errors.failedToUpdateRoutingConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Update MCP Router configuration
+  const updateMCPRouterConfig = async (key: keyof MCPRouterConfig, value: any) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        mcpRouter: {
+          [key]: value,
+        },
+      });
+
+      if (data.success) {
+        setMCPRouterConfig({
+          ...mcpRouterConfig,
+          [key]: value,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update MCP Router config');
+        showToast(data.error || t('errors.failedToUpdateMCPRouterConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update MCP Router config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update MCP Router config');
+      showToast(t('errors.failedToUpdateMCPRouterConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Batch update MCP Router configuration
+  const updateMCPRouterConfigBatch = async (updates: Partial<MCPRouterConfig>) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        mcpRouter: updates,
+      });
+
+      if (data.success) {
+        setMCPRouterConfig({
+          ...mcpRouterConfig,
+          ...updates,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update MCP Router config');
+        showToast(data.error || t('errors.failedToUpdateMCPRouterConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update MCP Router config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update MCP Router config');
+      showToast(t('errors.failedToUpdateMCPRouterConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Update OAuth server configuration
+  const updateOAuthServerConfig = async (key: keyof OAuthServerConfig, value: any) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        oauthServer: {
+          [key]: value,
+        },
+      });
+
+      if (data.success) {
+        setOAuthServerConfig({
+          ...oauthServerConfig,
+          [key]: value,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update OAuth server config');
+        showToast(data.error || t('errors.failedToUpdateOAuthServerConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update OAuth server config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update OAuth server config');
+      showToast(t('errors.failedToUpdateOAuthServerConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Batch update OAuth server configuration
+  const updateOAuthServerConfigBatch = async (updates: Partial<OAuthServerConfig>) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        oauthServer: updates,
+      });
+
+      if (data.success) {
+        setOAuthServerConfig({
+          ...oauthServerConfig,
+          ...updates,
+        });
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update OAuth server config');
+        showToast(data.error || t('errors.failedToUpdateOAuthServerConfig'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update OAuth server config:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update OAuth server config');
+      showToast(t('errors.failedToUpdateOAuthServerConfig'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Update name separator
+  const updateNameSeparator = async (value: string) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        nameSeparator: value,
+      });
+
+      if (data.success) {
+        setNameSeparator(value);
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update name separator');
+        showToast(data.error || t('errors.failedToUpdateNameSeparator'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update name separator:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update name separator');
+      showToast(t('errors.failedToUpdateNameSeparator'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Update session rebuild flag
+  const updateSessionRebuild = async (value: boolean) => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const data = await apiPut('/system-config', {
+        enableSessionRebuild: value,
+      });
+
+      if (data.success) {
+        setEnableSessionRebuild(value);
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      } else {
+        setError(data.error || 'Failed to update session rebuild setting');
+        showToast(data.error || t('errors.failedToUpdateSessionRebuild'));
+        return false;
+      }
+    } catch (error) {
+      console.error('Failed to update session rebuild setting:', error);
+      setError(error instanceof Error ? error.message : 'Failed to update session rebuild setting');
+      showToast(t('errors.failedToUpdateSessionRebuild'));
+      return false;
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const exportMCPSettings = async (serverName?: string) => {
+    setLoading(true);
+    setError(null);
+    try {
+      return await apiGet(`/mcp-settings/export?serverName=${serverName ? serverName : ''}`);
+    } catch (error) {
+      console.error('Failed to export MCP settings:', error);
+      const errorMessage = error instanceof Error ? error.message : 'Failed to export MCP settings';
+      setError(errorMessage);
+      showToast(errorMessage);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  // Bearer key management helpers
+  const refreshBearerKeys = async () => {
+    try {
+      const data: ApiResponse<BearerKey[]> = await apiGet('/auth/keys');
+      if (data.success && Array.isArray(data.data)) {
+        setBearerKeys(data.data);
+      }
+    } catch (error) {
+      console.error('Failed to refresh bearer keys:', error);
+      showToast(t('errors.failedToFetchSettings'));
+    }
+  };
+
+  const createBearerKey = async (payload: Omit<BearerKey, 'id'>): Promise<BearerKey | null> => {
+    try {
+      const data: ApiResponse<BearerKey> = await apiPost('/auth/keys', payload as any);
+      if (data.success && data.data) {
+        await refreshBearerKeys();
+        showToast(t('settings.systemConfigUpdated'));
+        return data.data;
+      }
+      showToast(data.message || t('errors.failedToUpdateRoutingConfig'));
+      return null;
+    } catch (error) {
+      console.error('Failed to create bearer key:', error);
+      showToast(t('errors.failedToUpdateRoutingConfig'));
+      return null;
+    }
+  };
+
+  const updateBearerKey = async (
+    id: string,
+    updates: Partial<Omit<BearerKey, 'id'>>,
+  ): Promise<BearerKey | null> => {
+    try {
+      const data: ApiResponse<BearerKey> = await apiPut(`/auth/keys/${id}`, updates as any);
+      if (data.success && data.data) {
+        await refreshBearerKeys();
+        showToast(t('settings.systemConfigUpdated'));
+        return data.data;
+      }
+      showToast(data.message || t('errors.failedToUpdateRoutingConfig'));
+      return null;
+    } catch (error) {
+      console.error('Failed to update bearer key:', error);
+      showToast(t('errors.failedToUpdateRoutingConfig'));
+      return null;
+    }
+  };
+
+  const deleteBearerKey = async (id: string): Promise<boolean> => {
+    try {
+      const data: ApiResponse = await apiDelete(`/auth/keys/${id}`);
+      if (data.success) {
+        await refreshBearerKeys();
+        showToast(t('settings.systemConfigUpdated'));
+        return true;
+      }
+      showToast(data.message || t('errors.failedToUpdateRoutingConfig'));
+      return false;
+    } catch (error) {
+      console.error('Failed to delete bearer key:', error);
+      showToast(t('errors.failedToUpdateRoutingConfig'));
+      return false;
+    }
+  };
+
+  // Fetch settings when the component mounts or refreshKey changes
+  useEffect(() => {
+    fetchSettings();
+  }, [fetchSettings, refreshKey]);
+
+  useEffect(() => {
+    if (routingConfig) {
+      setTempRoutingConfig({
+        bearerAuthKey: routingConfig.bearerAuthKey,
+      });
+    }
+  }, [routingConfig]);
+
+  const value: SettingsContextValue = {
+    routingConfig,
+    tempRoutingConfig,
+    setTempRoutingConfig,
+    installConfig,
+    smartRoutingConfig,
+    mcpRouterConfig,
+    oauthServerConfig,
+    nameSeparator,
+    enableSessionRebuild,
+    bearerKeys,
+    loading,
+    error,
+    setError,
+    triggerRefresh,
+    fetchSettings,
+    updateRoutingConfig,
+    updateInstallConfig,
+    updateSmartRoutingConfig,
+    updateSmartRoutingConfigBatch,
+    updateRoutingConfigBatch,
+    updateMCPRouterConfig,
+    updateMCPRouterConfigBatch,
+    updateOAuthServerConfig,
+    updateOAuthServerConfigBatch,
+    updateNameSeparator,
+    updateSessionRebuild,
+    exportMCPSettings,
+    refreshBearerKeys,
+    createBearerKey,
+    updateBearerKey,
+    deleteBearerKey,
+  };
+
+  return <SettingsContext.Provider value={value}>{children}</SettingsContext.Provider>;
+};

frontend/src/hooks/useSettingsData.ts

@@ -1,658 +1,10 @@
-import { useState, useCallback, useEffect } from 'react';
-import { useTranslation } from 'react-i18next';
-import { ApiResponse } from '@/types';
-import { useToast } from '@/contexts/ToastContext';
-import { apiGet, apiPut } from '../utils/fetchInterceptor';
-
-// Define types for the settings data
-interface RoutingConfig {
-  enableGlobalRoute: boolean;
-  enableGroupNameRoute: boolean;
-  enableBearerAuth: boolean;
-  bearerAuthKey: string;
-  skipAuth: boolean;
-}
-
-interface InstallConfig {
-  pythonIndexUrl: string;
-  npmRegistry: string;
-  baseUrl: string;
-}
-
-interface SmartRoutingConfig {
-  enabled: boolean;
-  dbUrl: string;
-  openaiApiBaseUrl: string;
-  openaiApiKey: string;
-  openaiApiEmbeddingModel: string;
-}
-
-interface MCPRouterConfig {
-  apiKey: string;
-  referer: string;
-  title: string;
-  baseUrl: string;
-}
-
-interface OAuthServerConfig {
-  enabled: boolean;
-  accessTokenLifetime: number;
-  refreshTokenLifetime: number;
-  authorizationCodeLifetime: number;
-  requireClientSecret: boolean;
-  allowedScopes: string[];
-  requireState: boolean;
-  dynamicRegistration: {
-    enabled: boolean;
-    allowedGrantTypes: string[];
-    requiresAuthentication: boolean;
-  };
-}
-
-interface SystemSettings {
-  systemConfig?: {
-    routing?: RoutingConfig;
-    install?: InstallConfig;
-    smartRouting?: SmartRoutingConfig;
-    mcpRouter?: MCPRouterConfig;
-    nameSeparator?: string;
-    oauthServer?: OAuthServerConfig;
-    enableSessionRebuild?: boolean;
-  };
-}
-
-interface TempRoutingConfig {
-  bearerAuthKey: string;
-}
-
-const getDefaultOAuthServerConfig = (): OAuthServerConfig => ({
-  enabled: true,
-  accessTokenLifetime: 3600,
-  refreshTokenLifetime: 1209600,
-  authorizationCodeLifetime: 300,
-  requireClientSecret: false,
-  allowedScopes: ['read', 'write'],
-  requireState: false,
-  dynamicRegistration: {
-    enabled: true,
-    allowedGrantTypes: ['authorization_code', 'refresh_token'],
-    requiresAuthentication: false,
-  },
-});
+import { useSettings } from '@/contexts/SettingsContext';
 
+/**
+ * Hook that provides access to settings data via SettingsContext.
+ * This hook is a thin wrapper around useSettings to maintain backward compatibility.
+ * The actual data fetching happens once in SettingsProvider, avoiding duplicate API calls.
+ */
 export const useSettingsData = () => {
-  const { t } = useTranslation();
-  const { showToast } = useToast();
-
-  const [routingConfig, setRoutingConfig] = useState<RoutingConfig>({
-    enableGlobalRoute: true,
-    enableGroupNameRoute: true,
-    enableBearerAuth: false,
-    bearerAuthKey: '',
-    skipAuth: false,
-  });
-
-  const [tempRoutingConfig, setTempRoutingConfig] = useState<TempRoutingConfig>({
-    bearerAuthKey: '',
-  });
-
-  const [installConfig, setInstallConfig] = useState<InstallConfig>({
-    pythonIndexUrl: '',
-    npmRegistry: '',
-    baseUrl: 'http://localhost:3000',
-  });
-
-  const [smartRoutingConfig, setSmartRoutingConfig] = useState<SmartRoutingConfig>({
-    enabled: false,
-    dbUrl: '',
-    openaiApiBaseUrl: '',
-    openaiApiKey: '',
-    openaiApiEmbeddingModel: '',
-  });
-
-  const [mcpRouterConfig, setMCPRouterConfig] = useState<MCPRouterConfig>({
-    apiKey: '',
-    referer: 'https://www.mcphubx.com',
-    title: 'MCPHub',
-    baseUrl: 'https://api.mcprouter.to/v1',
-  });
-
-  const [oauthServerConfig, setOAuthServerConfig] = useState<OAuthServerConfig>(
-    getDefaultOAuthServerConfig(),
-  );
-
-  const [nameSeparator, setNameSeparator] = useState<string>('-');
-  const [enableSessionRebuild, setEnableSessionRebuild] = useState<boolean>(false);
-
-  const [loading, setLoading] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [refreshKey, setRefreshKey] = useState(0);
-
-  // Trigger a refresh of the settings data
-  const triggerRefresh = useCallback(() => {
-    setRefreshKey((prev) => prev + 1);
-  }, []);
-
-  // Fetch current settings
-  const fetchSettings = useCallback(async () => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data: ApiResponse<SystemSettings> = await apiGet('/settings');
-
-      if (data.success && data.data?.systemConfig?.routing) {
-        setRoutingConfig({
-          enableGlobalRoute: data.data.systemConfig.routing.enableGlobalRoute ?? true,
-          enableGroupNameRoute: data.data.systemConfig.routing.enableGroupNameRoute ?? true,
-          enableBearerAuth: data.data.systemConfig.routing.enableBearerAuth ?? false,
-          bearerAuthKey: data.data.systemConfig.routing.bearerAuthKey || '',
-          skipAuth: data.data.systemConfig.routing.skipAuth ?? false,
-        });
-      }
-      if (data.success && data.data?.systemConfig?.install) {
-        setInstallConfig({
-          pythonIndexUrl: data.data.systemConfig.install.pythonIndexUrl || '',
-          npmRegistry: data.data.systemConfig.install.npmRegistry || '',
-          baseUrl: data.data.systemConfig.install.baseUrl || 'http://localhost:3000',
-        });
-      }
-      if (data.success && data.data?.systemConfig?.smartRouting) {
-        setSmartRoutingConfig({
-          enabled: data.data.systemConfig.smartRouting.enabled ?? false,
-          dbUrl: data.data.systemConfig.smartRouting.dbUrl || '',
-          openaiApiBaseUrl: data.data.systemConfig.smartRouting.openaiApiBaseUrl || '',
-          openaiApiKey: data.data.systemConfig.smartRouting.openaiApiKey || '',
-          openaiApiEmbeddingModel:
-            data.data.systemConfig.smartRouting.openaiApiEmbeddingModel || '',
-        });
-      }
-      if (data.success && data.data?.systemConfig?.mcpRouter) {
-        setMCPRouterConfig({
-          apiKey: data.data.systemConfig.mcpRouter.apiKey || '',
-          referer: data.data.systemConfig.mcpRouter.referer || 'https://www.mcphubx.com',
-          title: data.data.systemConfig.mcpRouter.title || 'MCPHub',
-          baseUrl: data.data.systemConfig.mcpRouter.baseUrl || 'https://api.mcprouter.to/v1',
-        });
-      }
-      if (data.success) {
-        if (data.data?.systemConfig?.oauthServer) {
-          const oauth = data.data.systemConfig.oauthServer;
-          const defaultOauthConfig = getDefaultOAuthServerConfig();
-          const defaultDynamic = defaultOauthConfig.dynamicRegistration;
-          const allowedScopes = Array.isArray(oauth.allowedScopes)
-            ? [...oauth.allowedScopes]
-            : [...defaultOauthConfig.allowedScopes];
-          const dynamicAllowedGrantTypes = Array.isArray(
-            oauth.dynamicRegistration?.allowedGrantTypes,
-          )
-            ? [...oauth.dynamicRegistration!.allowedGrantTypes!]
-            : [...defaultDynamic.allowedGrantTypes];
-
-          setOAuthServerConfig({
-            enabled: oauth.enabled ?? defaultOauthConfig.enabled,
-            accessTokenLifetime:
-              oauth.accessTokenLifetime ?? defaultOauthConfig.accessTokenLifetime,
-            refreshTokenLifetime:
-              oauth.refreshTokenLifetime ?? defaultOauthConfig.refreshTokenLifetime,
-            authorizationCodeLifetime:
-              oauth.authorizationCodeLifetime ?? defaultOauthConfig.authorizationCodeLifetime,
-            requireClientSecret:
-              oauth.requireClientSecret ?? defaultOauthConfig.requireClientSecret,
-            requireState: oauth.requireState ?? defaultOauthConfig.requireState,
-            allowedScopes,
-            dynamicRegistration: {
-              enabled: oauth.dynamicRegistration?.enabled ?? defaultDynamic.enabled,
-              allowedGrantTypes: dynamicAllowedGrantTypes,
-              requiresAuthentication:
-                oauth.dynamicRegistration?.requiresAuthentication ??
-                defaultDynamic.requiresAuthentication,
-            },
-          });
-        } else {
-          setOAuthServerConfig(getDefaultOAuthServerConfig());
-        }
-      }
-      if (data.success && data.data?.systemConfig?.nameSeparator !== undefined) {
-        setNameSeparator(data.data.systemConfig.nameSeparator);
-      }
-      if (data.success && data.data?.systemConfig?.enableSessionRebuild !== undefined) {
-        setEnableSessionRebuild(data.data.systemConfig.enableSessionRebuild);
-      }
-    } catch (error) {
-      console.error('Failed to fetch settings:', error);
-      setError(error instanceof Error ? error.message : 'Failed to fetch settings');
-      // 使用一个稳定的 showToast 引用，避免将其加入依赖数组
-      showToast(t('errors.failedToFetchSettings'));
-    } finally {
-      setLoading(false);
-    }
-  }, [t]); // 移除 showToast 依赖
-
-  // Update routing configuration
-  const updateRoutingConfig = async (key: keyof RoutingConfig, value: any) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        routing: {
-          [key]: value,
-        },
-      });
-
-      if (data.success) {
-        setRoutingConfig({
-          ...routingConfig,
-          [key]: value,
-        });
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateRouteConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update routing config:', error);
-      setError(error instanceof Error ? error.message : 'Failed to update routing config');
-      showToast(t('errors.failedToUpdateRouteConfig'));
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update install configuration
-  const updateInstallConfig = async (key: keyof InstallConfig, value: string) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        install: {
-          [key]: value,
-        },
-      });
-
-      if (data.success) {
-        setInstallConfig({
-          ...installConfig,
-          [key]: value,
-        });
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSystemConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update system config:', error);
-      setError(error instanceof Error ? error.message : 'Failed to update system config');
-      showToast(t('errors.failedToUpdateSystemConfig'));
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update smart routing configuration
-  const updateSmartRoutingConfig = async <T extends keyof SmartRoutingConfig>(
-    key: T,
-    value: SmartRoutingConfig[T],
-  ) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        smartRouting: {
-          [key]: value,
-        },
-      });
-
-      if (data.success) {
-        setSmartRoutingConfig({
-          ...smartRoutingConfig,
-          [key]: value,
-        });
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSmartRoutingConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update smart routing config:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update smart routing config';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update multiple smart routing configuration fields at once
-  const updateSmartRoutingConfigBatch = async (updates: Partial<SmartRoutingConfig>) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        smartRouting: updates,
-      });
-
-      if (data.success) {
-        setSmartRoutingConfig({
-          ...smartRoutingConfig,
-          ...updates,
-        });
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSmartRoutingConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update smart routing config:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update smart routing config';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update multiple routing configuration fields at once
-  const updateRoutingConfigBatch = async (updates: Partial<RoutingConfig>) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        routing: updates,
-      });
-
-      if (data.success) {
-        setRoutingConfig({
-          ...routingConfig,
-          ...updates,
-        });
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateRouteConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update routing config:', error);
-      setError(error instanceof Error ? error.message : 'Failed to update routing config');
-      showToast(t('errors.failedToUpdateRouteConfig'));
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update MCPRouter configuration
-  const updateMCPRouterConfig = async <T extends keyof MCPRouterConfig>(
-    key: T,
-    value: MCPRouterConfig[T],
-  ) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        mcpRouter: {
-          [key]: value,
-        },
-      });
-
-      if (data.success) {
-        setMCPRouterConfig({
-          ...mcpRouterConfig,
-          [key]: value,
-        });
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSystemConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update MCPRouter config:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update MCPRouter config';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update multiple MCPRouter configuration fields at once
-  const updateMCPRouterConfigBatch = async (updates: Partial<MCPRouterConfig>) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        mcpRouter: updates,
-      });
-
-      if (data.success) {
-        setMCPRouterConfig({
-          ...mcpRouterConfig,
-          ...updates,
-        });
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSystemConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update MCPRouter config:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update MCPRouter config';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update OAuth server configuration
-  const updateOAuthServerConfig = async <T extends keyof OAuthServerConfig>(
-    key: T,
-    value: OAuthServerConfig[T],
-  ) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        oauthServer: {
-          [key]: value,
-        },
-      });
-
-      if (data.success) {
-        setOAuthServerConfig((prev) => ({
-          ...prev,
-          [key]: value,
-        }));
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSystemConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update OAuth server config:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update OAuth server config';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update multiple OAuth server config fields
-  const updateOAuthServerConfigBatch = async (updates: Partial<OAuthServerConfig>) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        oauthServer: updates,
-      });
-
-      if (data.success) {
-        setOAuthServerConfig((prev) => ({
-          ...prev,
-          ...updates,
-        }));
-        showToast(t('settings.systemConfigUpdated'));
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSystemConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update OAuth server config:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update OAuth server config';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update name separator
-  const updateNameSeparator = async (value: string) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        nameSeparator: value,
-      });
-
-      if (data.success) {
-        setNameSeparator(value);
-        showToast(t('settings.restartRequired'), 'info');
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSystemConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update name separator:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update name separator';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Update session rebuild setting
-  const updateSessionRebuild = async (value: boolean) => {
-    setLoading(true);
-    setError(null);
-
-    try {
-      const data = await apiPut('/system-config', {
-        enableSessionRebuild: value,
-      });
-
-      if (data.success) {
-        setEnableSessionRebuild(value);
-        showToast(t('settings.restartRequired'), 'info');
-        return true;
-      } else {
-        showToast(data.message || t('errors.failedToUpdateSystemConfig'));
-        return false;
-      }
-    } catch (error) {
-      console.error('Failed to update session rebuild setting:', error);
-      const errorMessage =
-        error instanceof Error ? error.message : 'Failed to update session rebuild setting';
-      setError(errorMessage);
-      showToast(errorMessage);
-      return false;
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  const exportMCPSettings = async (serverName?: string) => {
-    setLoading(true);
-    setError(null);
-    try {
-      return await apiGet(`/mcp-settings/export?serverName=${serverName ? serverName : ''}`);
-    } catch (error) {
-      console.error('Failed to export MCP settings:', error);
-      const errorMessage = error instanceof Error ? error.message : 'Failed to export MCP settings';
-      setError(errorMessage);
-      showToast(errorMessage);
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  // Fetch settings when the component mounts or refreshKey changes
-  useEffect(() => {
-    fetchSettings();
-  }, [fetchSettings, refreshKey]);
-
-  useEffect(() => {
-    if (routingConfig) {
-      setTempRoutingConfig({
-        bearerAuthKey: routingConfig.bearerAuthKey,
-      });
-    }
-  }, [routingConfig]);
-
-  return {
-    routingConfig,
-    tempRoutingConfig,
-    setTempRoutingConfig,
-    installConfig,
-    smartRoutingConfig,
-    mcpRouterConfig,
-    oauthServerConfig,
-    nameSeparator,
-    enableSessionRebuild,
-    loading,
-    error,
-    setError,
-    triggerRefresh,
-    fetchSettings,
-    updateRoutingConfig,
-    updateInstallConfig,
-    updateSmartRoutingConfig,
-    updateSmartRoutingConfigBatch,
-    updateRoutingConfigBatch,
-    updateMCPRouterConfig,
-    updateMCPRouterConfigBatch,
-    updateOAuthServerConfig,
-    updateOAuthServerConfigBatch,
-    updateNameSeparator,
-    updateSessionRebuild,
-    exportMCPSettings,
-  };
+  return useSettings();
 };

frontend/src/pages/GroupsPage.tsx

@@ -6,6 +6,7 @@ import { useServerData } from '@/hooks/useServerData';
 import AddGroupForm from '@/components/AddGroupForm';
 import EditGroupForm from '@/components/EditGroupForm';
 import GroupCard from '@/components/GroupCard';
+import GroupImportForm from '@/components/GroupImportForm';
 
 const GroupsPage: React.FC = () => {
   const { t } = useTranslation();
@@ -15,12 +16,13 @@ const GroupsPage: React.FC = () => {
     error: groupError,
     setError: setGroupError,
     deleteGroup,
-    triggerRefresh
+    triggerRefresh,
   } = useGroupData();
   const { servers } = useServerData({ refreshOnMount: true });
 
   const [editingGroup, setEditingGroup] = useState<Group | null>(null);
   const [showAddForm, setShowAddForm] = useState(false);
+  const [showImportForm, setShowImportForm] = useState(false);
 
   const handleEditClick = (group: Group) => {
     setEditingGroup(group);
@@ -47,6 +49,11 @@ const GroupsPage: React.FC = () => {
     triggerRefresh(); // Refresh the groups list after adding
   };
 
+  const handleImportSuccess = () => {
+    setShowImportForm(false);
+    triggerRefresh(); // Refresh the groups list after import
+  };
+
   return (
     <div>
       <div className="flex justify-between items-center mb-8">
@@ -56,11 +63,38 @@ const GroupsPage: React.FC = () => {
             onClick={handleAddGroup}
             className="px-4 py-2 bg-blue-100 text-blue-800 rounded hover:bg-blue-200 flex items-center btn-primary transition-all duration-200"
           >
-            <svg xmlns="http://www.w3.org/2000/svg" className="h-4 w-4 mr-2" viewBox="0 0 20 20" fill="currentColor">
-              <path fillRule="evenodd" d="M10 3a1 1 0 00-1 1v5H4a1 1 0 100 2h5v5a1 1 0 102 0v-5h5a1 1 0 100-2h-5V4a1 1 0 00-1-1z" clipRule="evenodd" />
+            <svg
+              xmlns="http://www.w3.org/2000/svg"
+              className="h-4 w-4 mr-2"
+              viewBox="0 0 20 20"
+              fill="currentColor"
+            >
+              <path
+                fillRule="evenodd"
+                d="M10 3a1 1 0 00-1 1v5H4a1 1 0 100 2h5v5a1 1 0 102 0v-5h5a1 1 0 100-2h-5V4a1 1 0 00-1-1z"
+                clipRule="evenodd"
+              />
             </svg>
             {t('groups.add')}
           </button>
+          <button
+            onClick={() => setShowImportForm(true)}
+            className="px-4 py-2 bg-blue-100 text-blue-800 rounded hover:bg-blue-200 flex items-center btn-primary transition-all duration-200"
+          >
+            <svg
+              xmlns="http://www.w3.org/2000/svg"
+              className="h-4 w-4 mr-2"
+              viewBox="0 0 20 20"
+              fill="currentColor"
+            >
+              <path
+                fillRule="evenodd"
+                d="M3 17a1 1 0 011-1h12a1 1 0 110 2H4a1 1 0 01-1-1zm3.293-7.707a1 1 0 011.414 0L9 10.586V3a1 1 0 112 0v7.586l1.293-1.293a1 1 0 111.414 1.414l-3 3a1 1 0 01-1.414 0l-3-3a1 1 0 010-1.414z"
+                clipRule="evenodd"
+              />
+            </svg>
+            {t('groupImport.button')}
+          </button>
         </div>
       </div>
 
@@ -73,9 +107,25 @@ const GroupsPage: React.FC = () => {
       {groupsLoading ? (
         <div className="bg-white shadow rounded-lg p-6 loading-container">
           <div className="flex flex-col items-center justify-center">
-            <svg className="animate-spin h-10 w-10 text-blue-500 mb-4" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24">
-              <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4"></circle>
-              <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+            <svg
+              className="animate-spin h-10 w-10 text-blue-500 mb-4"
+              xmlns="http://www.w3.org/2000/svg"
+              fill="none"
+              viewBox="0 0 24 24"
+            >
+              <circle
+                className="opacity-25"
+                cx="12"
+                cy="12"
+                r="10"
+                stroke="currentColor"
+                strokeWidth="4"
+              ></circle>
+              <path
+                className="opacity-75"
+                fill="currentColor"
+                d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+              ></path>
             </svg>
             <p className="text-gray-600">{t('app.loading')}</p>
           </div>
@@ -98,8 +148,13 @@ const GroupsPage: React.FC = () => {
         </div>
       )}
 
-      {showAddForm && (
-        <AddGroupForm onAdd={handleAddComplete} onCancel={handleAddComplete} />
+      {showAddForm && <AddGroupForm onAdd={handleAddComplete} onCancel={handleAddComplete} />}
+
+      {showImportForm && (
+        <GroupImportForm
+          onSuccess={handleImportSuccess}
+          onCancel={() => setShowImportForm(false)}
+        />
       )}
 
       {editingGroup && (
@@ -113,4 +168,4 @@ const GroupsPage: React.FC = () => {
   );
 };
 
-export default GroupsPage;
+export default GroupsPage;

frontend/src/pages/ServersPage.tsx

@@ -21,6 +21,7 @@ const ServersPage: React.FC = () => {
     handleServerEdit,
     handleServerRemove,
     handleServerToggle,
+    handleServerReload,
     triggerRefresh
   } = useServerData({ refreshOnMount: true });
   const [editingServer, setEditingServer] = useState<Server | null>(null);
@@ -159,6 +160,7 @@ const ServersPage: React.FC = () => {
               onEdit={handleEditClick}
               onToggle={handleServerToggle}
               onRefresh={triggerRefresh}
+              onReload={handleServerReload}
             />
           ))}
         </div>
@@ -189,4 +191,4 @@ const ServersPage: React.FC = () => {
   );
 };
 
-export default ServersPage;
+export default ServersPage;

frontend/src/pages/SettingsPage.tsx

@@ -3,17 +3,317 @@ import { useTranslation } from 'react-i18next';
 import { useNavigate } from 'react-router-dom';
 import ChangePasswordForm from '@/components/ChangePasswordForm';
 import { Switch } from '@/components/ui/ToggleGroup';
+import { MultiSelect } from '@/components/ui/MultiSelect';
 import { useSettingsData } from '@/hooks/useSettingsData';
 import { useToast } from '@/contexts/ToastContext';
 import { generateRandomKey } from '@/utils/key';
 import { PermissionChecker } from '@/components/PermissionChecker';
 import { PERMISSIONS } from '@/constants/permissions';
-import { Copy, Check, Download } from 'lucide-react';
+import { Copy, Check, Download, Edit, Trash2 } from 'lucide-react';
+import type { BearerKey } from '@/types';
+import { useServerContext } from '@/contexts/ServerContext';
+import { useGroupData } from '@/hooks/useGroupData';
+
+interface BearerKeyRowProps {
+  keyData: BearerKey;
+  loading: boolean;
+  availableServers: { value: string; label: string }[];
+  availableGroups: { value: string; label: string }[];
+  onSave: (
+    id: string,
+    payload: {
+      name: string;
+      token: string;
+      enabled: boolean;
+      accessType: 'all' | 'groups' | 'servers';
+      allowedGroups: string;
+      allowedServers: string;
+    },
+  ) => Promise<void>;
+  onDelete: (id: string) => Promise<void>;
+}
+
+const BearerKeyRow: React.FC<BearerKeyRowProps> = ({
+  keyData,
+  loading,
+  availableServers,
+  availableGroups,
+  onSave,
+  onDelete,
+}) => {
+  const { t } = useTranslation();
+  const { showToast } = useToast();
+  const [isEditing, setIsEditing] = useState(false);
+  const [name, setName] = useState(keyData.name);
+  const [token, setToken] = useState(keyData.token);
+  const [enabled, setEnabled] = useState<boolean>(keyData.enabled);
+  const [accessType, setAccessType] = useState<'all' | 'groups' | 'servers'>(
+    keyData.accessType || 'all',
+  );
+  const [selectedGroups, setSelectedGroups] = useState<string[]>(keyData.allowedGroups || []);
+  const [selectedServers, setSelectedServers] = useState<string[]>(keyData.allowedServers || []);
+  const [saving, setSaving] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+
+  useEffect(() => {
+    if (!isEditing) {
+      setName(keyData.name);
+      setToken(keyData.token);
+      setEnabled(keyData.enabled);
+      setAccessType(keyData.accessType || 'all');
+      setSelectedGroups(keyData.allowedGroups || []);
+      setSelectedServers(keyData.allowedServers || []);
+    }
+  }, [keyData, isEditing]);
+
+  const handleCopyToken = async () => {
+    try {
+      if (navigator.clipboard && window.isSecureContext) {
+        await navigator.clipboard.writeText(keyData.token);
+        showToast(t('common.copySuccess') || 'Copied to clipboard', 'success');
+      } else {
+        const textArea = document.createElement('textarea');
+        textArea.value = keyData.token;
+        textArea.style.position = 'fixed';
+        textArea.style.left = '-9999px';
+        document.body.appendChild(textArea);
+        textArea.focus();
+        textArea.select();
+        try {
+          document.execCommand('copy');
+          showToast(t('common.copySuccess') || 'Copied to clipboard', 'success');
+        } catch (err) {
+          showToast(t('common.copyFailed') || 'Copy failed', 'error');
+        }
+        document.body.removeChild(textArea);
+      }
+    } catch (error) {
+      console.error('Failed to copy', error);
+      showToast(t('common.copyFailed') || 'Copy failed', 'error');
+    }
+  };
+
+  const handleSave = async () => {
+    if (accessType === 'groups' && selectedGroups.length === 0) {
+      showToast(t('settings.selectAtLeastOneGroup') || 'Please select at least one group', 'error');
+      return;
+    }
+    if (accessType === 'servers' && selectedServers.length === 0) {
+      showToast(
+        t('settings.selectAtLeastOneServer') || 'Please select at least one server',
+        'error',
+      );
+      return;
+    }
+
+    setSaving(true);
+    try {
+      await onSave(keyData.id, {
+        name,
+        token,
+        enabled,
+        accessType,
+        allowedGroups: selectedGroups.join(', '),
+        allowedServers: selectedServers.join(', '),
+      });
+      setIsEditing(false);
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const handleDelete = async () => {
+    if (!window.confirm(t('settings.deleteBearerKeyConfirm') || 'Delete this key?')) {
+      return;
+    }
+    setDeleting(true);
+    try {
+      await onDelete(keyData.id);
+    } finally {
+      setDeleting(false);
+    }
+  };
+
+  const isGroupsMode = accessType === 'groups';
+
+  if (isEditing) {
+    return (
+      <tr>
+        <td colSpan={5} className="p-0 border-b border-gray-200">
+          <div className="bg-gray-50 p-5">
+            <div className="grid grid-cols-1 md:grid-cols-12 gap-4 mb-4">
+              <div className="md:col-span-3">
+                <label className="block text-sm font-medium text-gray-700 mb-1">
+                  {t('settings.bearerKeyName') || 'Name'}
+                </label>
+                <input
+                  type="text"
+                  className="block w-full py-2 px-3 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-input transition-shadow duration-200"
+                  value={name}
+                  onChange={(e) => setName(e.target.value)}
+                  disabled={loading}
+                />
+              </div>
+              <div className="md:col-span-9">
+                <label className="block text-sm font-medium text-gray-700 mb-1">
+                  {t('settings.bearerKeyToken') || 'Token'}
+                </label>
+                <input
+                  type="text"
+                  className="block w-full py-2 px-3 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-input transition-shadow duration-200"
+                  value={token}
+                  onChange={(e) => setToken(e.target.value)}
+                  disabled={loading}
+                />
+              </div>
+            </div>
+
+            <div className="flex flex-wrap items-end gap-4">
+              <div className="w-40">
+                <label className="block text-sm font-medium text-gray-700 mb-1">
+                  {t('settings.bearerKeyEnabled') || 'Status'}
+                </label>
+                <div className="flex items-center h-[38px] px-3 bg-white border border-gray-300 rounded-md">
+                  <span
+                    className={`text-sm mr-3 ${enabled ? 'text-green-600 font-medium' : 'text-gray-500'}`}
+                  >
+                    {enabled ? 'Active' : 'Inactive'}
+                  </span>
+                  <Switch
+                    disabled={loading}
+                    checked={enabled}
+                    onCheckedChange={(checked) => setEnabled(checked)}
+                  />
+                </div>
+              </div>
+
+              <div className="w-48">
+                <label className="block text-sm font-medium text-gray-700 mb-1">
+                  {t('settings.bearerKeyAccessType') || 'Access scope'}
+                </label>
+                <select
+                  className="block w-full py-2 px-3 border border-gray-300 bg-white rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-select transition-shadow duration-200"
+                  value={accessType}
+                  onChange={(e) => setAccessType(e.target.value as 'all' | 'groups' | 'servers')}
+                  disabled={loading}
+                >
+                  <option value="all">{t('settings.bearerKeyAccessAll') || 'All Resources'}</option>
+                  <option value="groups">
+                    {t('settings.bearerKeyAccessGroups') || 'Specific Groups'}
+                  </option>
+                  <option value="servers">
+                    {t('settings.bearerKeyAccessServers') || 'Specific Servers'}
+                  </option>
+                </select>
+              </div>
+
+              <div className="flex-1 min-w-[200px]">
+                <label
+                  className={`block text-sm font-medium mb-1 ${accessType === 'all' ? 'text-gray-400' : 'text-gray-700'}`}
+                >
+                  {isGroupsMode
+                    ? t('settings.bearerKeyAllowedGroups') || 'Allowed groups'
+                    : t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
+                </label>
+                <MultiSelect
+                  options={isGroupsMode ? availableGroups : availableServers}
+                  selected={isGroupsMode ? selectedGroups : selectedServers}
+                  onChange={isGroupsMode ? setSelectedGroups : setSelectedServers}
+                  placeholder={
+                    isGroupsMode
+                      ? t('settings.selectGroups') || 'Select groups...'
+                      : t('settings.selectServers') || 'Select servers...'
+                  }
+                  disabled={loading || accessType === 'all'}
+                />
+              </div>
+
+              <div className="flex justify-end gap-2">
+                <button
+                  type="button"
+                  onClick={() => setIsEditing(false)}
+                  className="px-4 py-2 bg-white border border-gray-300 text-gray-700 rounded-md text-sm font-medium hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-500 h-[38px]"
+                >
+                  {t('common.cancel') || 'Cancel'}
+                </button>
+                <button
+                  type="button"
+                  onClick={handleSave}
+                  disabled={loading || saving}
+                  className="px-4 py-2 bg-blue-600 hover:bg-blue-700 text-white rounded-md text-sm font-medium disabled:opacity-50 btn-primary h-[38px]"
+                >
+                  {saving ? t('common.saving') || 'Saving...' : t('common.save') || 'Save'}
+                </button>
+              </div>
+            </div>
+          </div>
+        </td>
+      </tr>
+    );
+  }
+
+  return (
+    <tr className="hover:bg-gray-50">
+      <td className="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900">
+        {keyData.name}
+      </td>
+      <td className="px-6 py-4 whitespace-nowrap text-sm text-gray-500 font-mono">
+        <div className="flex items-center gap-2">
+          <span>
+            {keyData.token.length > 12
+              ? `${keyData.token.substring(0, 8)}...${keyData.token.substring(keyData.token.length - 4)}`
+              : keyData.token}
+          </span>
+          <button
+            onClick={handleCopyToken}
+            className="text-gray-400 hover:text-gray-600 transition-colors"
+            title={t('common.copy') || 'Copy'}
+          >
+            <Copy className="h-3.5 w-3.5" />
+          </button>
+        </div>
+      </td>
+      <td className="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
+        <span
+          className={`px-2 inline-flex text-xs leading-5 font-semibold rounded-full ${keyData.enabled ? 'bg-green-100 text-green-800' : 'bg-gray-100 text-gray-800'}`}
+        >
+          {keyData.enabled ? t('common.active') || 'Active' : t('common.inactive') || 'Inactive'}
+        </span>
+      </td>
+      <td className="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
+        {keyData.accessType === 'all'
+          ? t('settings.bearerKeyAccessAll') || 'All Resources'
+          : keyData.accessType === 'groups'
+            ? `${t('settings.bearerKeyAccessGroups') || 'Groups'}: ${keyData.allowedGroups}`
+            : `${t('settings.bearerKeyAccessServers') || 'Servers'}: ${keyData.allowedServers}`}
+      </td>
+      <td className="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
+        <button
+          onClick={() => setIsEditing(true)}
+          className="text-blue-600 hover:text-blue-900 mr-4 inline-flex items-center"
+          title={t('common.edit') || 'Edit'}
+        >
+          <Edit className="h-4 w-4" />
+        </button>
+        <button
+          onClick={handleDelete}
+          disabled={deleting}
+          className="text-red-600 hover:text-red-900 inline-flex items-center"
+          title={t('common.delete') || 'Delete'}
+        >
+          <Trash2 className="h-4 w-4" />
+        </button>
+      </td>
+    </tr>
+  );
+};
 
 const SettingsPage: React.FC = () => {
   const { t } = useTranslation();
   const navigate = useNavigate();
   const { showToast } = useToast();
+  const { servers } = useServerContext();
+  const { groups } = useGroupData();
 
   const [installConfig, setInstallConfig] = useState<{
     pythonIndexUrl: string;
@@ -64,6 +364,7 @@ const SettingsPage: React.FC = () => {
   });
 
   const [tempNameSeparator, setTempNameSeparator] = useState<string>('-');
+  const [showAddBearerKeyForm, setShowAddBearerKeyForm] = useState(false);
 
   const {
     routingConfig,
@@ -76,6 +377,7 @@ const SettingsPage: React.FC = () => {
     nameSeparator,
     enableSessionRebuild,
     loading,
+    bearerKeys,
     updateRoutingConfig,
     updateRoutingConfigBatch,
     updateInstallConfig,
@@ -86,6 +388,10 @@ const SettingsPage: React.FC = () => {
     updateNameSeparator,
     updateSessionRebuild,
     exportMCPSettings,
+    createBearerKey,
+    updateBearerKey,
+    deleteBearerKey,
+    refreshBearerKeys,
   } = useSettingsData();
 
   // Update local installConfig when savedInstallConfig changes
@@ -151,6 +457,11 @@ const SettingsPage: React.FC = () => {
     setTempNameSeparator(nameSeparator);
   }, [nameSeparator]);
 
+  // Refresh bearer keys when component mounts
+  useEffect(() => {
+    refreshBearerKeys();
+  }, []);
+
   const [sectionsVisible, setSectionsVisible] = useState({
     routingConfig: false,
     installConfig: false,
@@ -160,6 +471,7 @@ const SettingsPage: React.FC = () => {
     nameSeparator: false,
     password: false,
     exportConfig: false,
+    bearerKeys: false,
   });
 
   const toggleSection = (
@@ -171,7 +483,8 @@ const SettingsPage: React.FC = () => {
       | 'mcpRouterConfig'
       | 'nameSeparator'
       | 'password'
-      | 'exportConfig',
+      | 'exportConfig'
+      | 'bearerKeys',
   ) => {
     setSectionsVisible((prev) => ({
       ...prev,
@@ -221,10 +534,6 @@ const SettingsPage: React.FC = () => {
     }));
   };
 
-  const saveBearerAuthKey = async () => {
-    await updateRoutingConfig('bearerAuthKey', tempRoutingConfig.bearerAuthKey);
-  };
-
   const handleInstallConfigChange = (
     key: 'pythonIndexUrl' | 'npmRegistry' | 'baseUrl',
     value: string,
@@ -405,6 +714,46 @@ const SettingsPage: React.FC = () => {
   const [copiedConfig, setCopiedConfig] = useState(false);
   const [mcpSettingsJson, setMcpSettingsJson] = useState<string>('');
 
+  const [newBearerKey, setNewBearerKey] = useState<{
+    name: string;
+    token: string;
+    enabled: boolean;
+    accessType: 'all' | 'groups' | 'servers';
+    allowedGroups: string;
+    allowedServers: string;
+  }>({
+    name: '',
+    token: '',
+    enabled: true,
+    accessType: 'all',
+    allowedGroups: '',
+    allowedServers: '',
+  });
+
+  const [newSelectedGroups, setNewSelectedGroups] = useState<string[]>([]);
+  const [newSelectedServers, setNewSelectedServers] = useState<string[]>([]);
+
+  // Prepare options for MultiSelect
+  const availableServers = servers.map((server) => ({
+    value: server.name,
+    label: server.name,
+  }));
+
+  const availableGroups = groups.map((group) => ({
+    value: group.name,
+    label: group.name,
+  }));
+
+  // Reset selected arrays when accessType changes
+  useEffect(() => {
+    if (newBearerKey.accessType !== 'groups') {
+      setNewSelectedGroups([]);
+    }
+    if (newBearerKey.accessType !== 'servers') {
+      setNewSelectedServers([]);
+    }
+  }, [newBearerKey.accessType]);
+
   const fetchMcpSettings = async () => {
     try {
       const result = await exportMCPSettings();
@@ -473,15 +822,374 @@ const SettingsPage: React.FC = () => {
     showToast(t('settings.exportSuccess') || 'Settings exported successfully', 'success');
   };
 
+  const parseCommaSeparated = (value: string): string[] | undefined => {
+    const parts = value
+      .split(',')
+      .map((item) => item.trim())
+      .filter((item) => item.length > 0);
+    return parts.length > 0 ? parts : undefined;
+  };
+
+  const handleCreateBearerKey = async () => {
+    if (!newBearerKey.name || !newBearerKey.token) {
+      showToast(t('settings.bearerKeyRequired') || 'Name and token are required', 'error');
+      return;
+    }
+
+    if (newBearerKey.accessType === 'groups' && newSelectedGroups.length === 0) {
+      showToast(t('settings.selectAtLeastOneGroup') || 'Please select at least one group', 'error');
+      return;
+    }
+    if (newBearerKey.accessType === 'servers' && newSelectedServers.length === 0) {
+      showToast(
+        t('settings.selectAtLeastOneServer') || 'Please select at least one server',
+        'error',
+      );
+      return;
+    }
+
+    await createBearerKey({
+      name: newBearerKey.name,
+      token: newBearerKey.token,
+      enabled: newBearerKey.enabled,
+      accessType: newBearerKey.accessType,
+      allowedGroups:
+        newBearerKey.accessType === 'groups' && newSelectedGroups.length > 0
+          ? newSelectedGroups
+          : undefined,
+      allowedServers:
+        newBearerKey.accessType === 'servers' && newSelectedServers.length > 0
+          ? newSelectedServers
+          : undefined,
+    } as any);
+
+    setNewBearerKey({
+      name: '',
+      token: '',
+      enabled: true,
+      accessType: 'all',
+      allowedGroups: '',
+      allowedServers: '',
+    });
+    setNewSelectedGroups([]);
+    setNewSelectedServers([]);
+    await refreshBearerKeys();
+  };
+
+  const handleSaveExistingBearerKey = async (
+    id: string,
+    payload: {
+      name: string;
+      token: string;
+      enabled: boolean;
+      accessType: 'all' | 'groups' | 'servers';
+      allowedGroups: string;
+      allowedServers: string;
+    },
+  ) => {
+    await updateBearerKey(id, {
+      name: payload.name,
+      token: payload.token,
+      enabled: payload.enabled,
+      accessType: payload.accessType,
+      allowedGroups: parseCommaSeparated(payload.allowedGroups),
+      allowedServers: parseCommaSeparated(payload.allowedServers),
+    } as any);
+    await refreshBearerKeys();
+  };
+
+  const handleDeleteExistingBearerKey = async (id: string) => {
+    await deleteBearerKey(id);
+    await refreshBearerKeys();
+  };
+
   return (
     <div className="container mx-auto">
       <h1 className="text-2xl font-bold text-gray-900 mb-8">{t('pages.settings.title')}</h1>
 
+      {/* Bearer Keys Settings */}
+      <PermissionChecker permissions={PERMISSIONS.SETTINGS_ROUTE_CONFIG}>
+        <div className="bg-white shadow rounded-lg mb-6 page-card dashboard-card">
+          <div
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
+            onClick={() => toggleSection('bearerKeys')}
+          >
+            <h2 className="font-semibold text-gray-800">
+              {t('settings.bearerKeysSectionTitle') || 'Bearer authentication keys'}
+            </h2>
+            <span className="text-gray-500 transition-transform duration-200">
+              {sectionsVisible.bearerKeys ? '▼' : '►'}
+            </span>
+          </div>
+
+          {sectionsVisible.bearerKeys && (
+            <div className="space-y-4 pb-4 px-6">
+              <div className="flex justify-between items-center">
+                <p className="text-sm text-gray-600">
+                  {t('settings.bearerKeysSectionDescription') ||
+                    'Manage multiple bearer authentication keys with different access scopes.'}
+                </p>
+                {!showAddBearerKeyForm && (
+                  <button
+                    type="button"
+                    onClick={() => setShowAddBearerKeyForm(true)}
+                    className="flex items-center text-blue-600 hover:text-blue-800 font-medium transition-colors duration-200"
+                  >
+                    <svg
+                      xmlns="http://www.w3.org/2000/svg"
+                      className="h-5 w-5 mr-1"
+                      viewBox="0 0 20 20"
+                      fill="currentColor"
+                    >
+                      <path
+                        fillRule="evenodd"
+                        d="M10 3a1 1 0 011 1v5h5a1 1 0 110 2h-5v5a1 1 0 11-2 0v-5H4a1 1 0 110-2h5V4a1 1 0 011-1z"
+                        clipRule="evenodd"
+                      />
+                    </svg>
+                    {t('settings.addBearerKey') || 'Add bearer key'}
+                  </button>
+                )}
+              </div>
+
+              {/* Existing keys */}
+              {bearerKeys.length === 0 ? (
+                <p className="text-sm text-gray-500">
+                  {t('settings.noBearerKeys') || 'No bearer keys configured yet.'}
+                </p>
+              ) : (
+                <div className="mt-2 overflow-x-auto">
+                  <table className="min-w-full divide-y divide-gray-200 border border-gray-200 rounded-lg">
+                    <thead className="bg-gray-50">
+                      <tr>
+                        <th
+                          scope="col"
+                          className="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider"
+                        >
+                          {t('settings.bearerKeyName') || 'Name'}
+                        </th>
+                        <th
+                          scope="col"
+                          className="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider"
+                        >
+                          {t('settings.bearerKeyToken') || 'Token'}
+                        </th>
+                        <th
+                          scope="col"
+                          className="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider"
+                        >
+                          {t('settings.bearerKeyEnabled') || 'Status'}
+                        </th>
+                        <th
+                          scope="col"
+                          className="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider"
+                        >
+                          {t('settings.bearerKeyAccessType') || 'Access Scope'}
+                        </th>
+                        <th
+                          scope="col"
+                          className="px-6 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider"
+                        >
+                          {t('common.actions') || 'Actions'}
+                        </th>
+                      </tr>
+                    </thead>
+                    <tbody className="bg-white divide-y divide-gray-200">
+                      {bearerKeys.map((key) => (
+                        <BearerKeyRow
+                          key={key.id}
+                          keyData={key}
+                          loading={loading}
+                          availableServers={availableServers}
+                          availableGroups={availableGroups}
+                          onSave={handleSaveExistingBearerKey}
+                          onDelete={handleDeleteExistingBearerKey}
+                        />
+                      ))}
+                    </tbody>
+                  </table>
+                </div>
+              )}
+
+              {/* New key form */}
+              {showAddBearerKeyForm && (
+                <div className="mt-6 border-t border-gray-200 pt-6">
+                  <div className="bg-gray-50 rounded-lg p-5 border border-gray-200">
+                    <h3 className="font-medium text-gray-900 mb-4 flex items-center gap-2">
+                      <span className="bg-blue-100 text-blue-600 p-1 rounded">
+                        <svg
+                          xmlns="http://www.w3.org/2000/svg"
+                          className="h-4 w-4"
+                          viewBox="0 0 20 20"
+                          fill="currentColor"
+                        >
+                          <path
+                            fillRule="evenodd"
+                            d="M10 3a1 1 0 011 1v5h5a1 1 0 110 2h-5v5a1 1 0 11-2 0v-5H4a1 1 0 110-2h5V4a1 1 0 011-1z"
+                            clipRule="evenodd"
+                          />
+                        </svg>
+                      </span>
+                      {t('settings.addBearerKey') || 'Add bearer key'}
+                    </h3>
+
+                    <div className="grid grid-cols-1 md:grid-cols-12 gap-4 mb-4">
+                      <div className="md:col-span-3">
+                        <label className="block text-sm font-medium text-gray-700 mb-1">
+                          {t('settings.bearerKeyName') || 'Name'}
+                        </label>
+                        <input
+                          type="text"
+                          className="block w-full py-2 px-3 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-input transition-shadow duration-200"
+                          placeholder="e.g. My API Key"
+                          value={newBearerKey.name}
+                          onChange={(e) =>
+                            setNewBearerKey((prev) => ({ ...prev, name: e.target.value }))
+                          }
+                          disabled={loading}
+                        />
+                      </div>
+                      <div className="md:col-span-9">
+                        <label className="block text-sm font-medium text-gray-700 mb-1">
+                          {t('settings.bearerKeyToken') || 'Token'}
+                        </label>
+                        <div className="flex rounded-md shadow-sm">
+                          <input
+                            type="text"
+                            className="flex-1 block w-full py-2 px-3 border border-gray-300 rounded-l-md rounded-r-none border-r-0 focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-input transition-shadow duration-200"
+                            placeholder="sk-..."
+                            value={newBearerKey.token}
+                            onChange={(e) =>
+                              setNewBearerKey((prev) => ({ ...prev, token: e.target.value }))
+                            }
+                            disabled={loading}
+                          />
+                          <button
+                            type="button"
+                            onClick={() =>
+                              setNewBearerKey((prev) => ({ ...prev, token: generateRandomKey() }))
+                            }
+                            disabled={loading}
+                            className="relative -ml-[5px] inline-flex items-center px-4 py-2 border border-gray-300 bg-gray-100 text-gray-700 text-sm font-medium rounded-r-md rounded-l-none hover:bg-gray-200 focus:outline-none focus:ring-1 focus:ring-blue-500 focus:border-blue-500 transition-colors duration-200 z-10"
+                          >
+                            {t('settings.generate') || 'Generate'}
+                          </button>
+                        </div>
+                      </div>
+                    </div>
+
+                    <div className="flex flex-wrap items-end gap-4 mb-2">
+                      <div className="w-40">
+                        <label className="block text-sm font-medium text-gray-700 mb-1">
+                          {t('settings.bearerKeyEnabled') || 'Status'}
+                        </label>
+                        <div className="flex items-center h-[38px] px-3 bg-white border border-gray-300 rounded-md">
+                          <span
+                            className={`text-sm mr-3 ${newBearerKey.enabled ? 'text-green-600 font-medium' : 'text-gray-500'}`}
+                          >
+                            {newBearerKey.enabled ? 'Active' : 'Inactive'}
+                          </span>
+                          <Switch
+                            disabled={loading}
+                            checked={newBearerKey.enabled}
+                            onCheckedChange={(checked) =>
+                              setNewBearerKey((prev) => ({ ...prev, enabled: checked }))
+                            }
+                          />
+                        </div>
+                      </div>
+
+                      <div className="w-48">
+                        <label className="block text-sm font-medium text-gray-700 mb-1">
+                          {t('settings.bearerKeyAccessType') || 'Access scope'}
+                        </label>
+                        <select
+                          className="block w-full py-2 px-3 border border-gray-300 bg-white rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-select transition-shadow duration-200"
+                          value={newBearerKey.accessType}
+                          onChange={(e) =>
+                            setNewBearerKey((prev) => ({
+                              ...prev,
+                              accessType: e.target.value as 'all' | 'groups' | 'servers',
+                            }))
+                          }
+                          disabled={loading}
+                        >
+                          <option value="all">
+                            {t('settings.bearerKeyAccessAll') || 'All Resources'}
+                          </option>
+                          <option value="groups">
+                            {t('settings.bearerKeyAccessGroups') || 'Specific Groups'}
+                          </option>
+                          <option value="servers">
+                            {t('settings.bearerKeyAccessServers') || 'Specific Servers'}
+                          </option>
+                        </select>
+                      </div>
+
+                      <div className="flex-1 min-w-[200px]">
+                        <label
+                          className={`block text-sm font-medium mb-1 ${newBearerKey.accessType === 'all' ? 'text-gray-400' : 'text-gray-700'}`}
+                        >
+                          {newBearerKey.accessType === 'groups'
+                            ? t('settings.bearerKeyAllowedGroups') || 'Allowed groups'
+                            : t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
+                        </label>
+                        <MultiSelect
+                          options={
+                            newBearerKey.accessType === 'groups'
+                              ? availableGroups
+                              : availableServers
+                          }
+                          selected={
+                            newBearerKey.accessType === 'groups'
+                              ? newSelectedGroups
+                              : newSelectedServers
+                          }
+                          onChange={
+                            newBearerKey.accessType === 'groups'
+                              ? setNewSelectedGroups
+                              : setNewSelectedServers
+                          }
+                          placeholder={
+                            newBearerKey.accessType === 'groups'
+                              ? t('settings.selectGroups') || 'Select groups...'
+                              : t('settings.selectServers') || 'Select servers...'
+                          }
+                          disabled={loading || newBearerKey.accessType === 'all'}
+                        />
+                      </div>
+
+                      <div className="flex justify-end gap-2">
+                        <button
+                          type="button"
+                          onClick={() => setShowAddBearerKeyForm(false)}
+                          className="px-4 py-2 bg-white border border-gray-300 text-gray-700 rounded-md text-sm font-medium hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-500 h-[38px]"
+                        >
+                          {t('common.cancel') || 'Cancel'}
+                        </button>
+                        <button
+                          type="button"
+                          onClick={handleCreateBearerKey}
+                          disabled={loading}
+                          className="px-4 py-2 bg-blue-600 hover:bg-blue-700 text-white rounded-md text-sm font-medium disabled:opacity-50 btn-primary h-[38px]"
+                        >
+                          {t('settings.addBearerKeyButton') || 'Create Key'}
+                        </button>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              )}
+            </div>
+          )}
+        </div>
+      </PermissionChecker>
+
       {/* Smart Routing Configuration Settings */}
       <PermissionChecker permissions={PERMISSIONS.SETTINGS_SMART_ROUTING}>
-        <div className="bg-white shadow rounded-lg py-4 px-6 mb-6 page-card dashboard-card">
+        <div className="bg-white shadow rounded-lg mb-6 page-card dashboard-card">
           <div
-            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600"
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
             onClick={() => toggleSection('smartRoutingConfig')}
           >
             <h2 className="font-semibold text-gray-800">{t('pages.settings.smartRouting')}</h2>
@@ -491,7 +1199,7 @@ const SettingsPage: React.FC = () => {
           </div>
 
           {sectionsVisible.smartRoutingConfig && (
-            <div className="space-y-4 mt-4">
+            <div className="space-y-4 pb-4 px-6">
               <div className="flex items-center justify-between p-3 bg-gray-50 rounded-md">
                 <div>
                   <h3 className="font-medium text-gray-700">{t('settings.enableSmartRouting')}</h3>
@@ -616,9 +1324,9 @@ const SettingsPage: React.FC = () => {
 
       {/* OAuth Server Configuration Settings */}
       <PermissionChecker permissions={PERMISSIONS.SETTINGS_OAUTH_SERVER}>
-        <div className="bg-white shadow rounded-lg py-4 px-6 mb-6 dashboard-card">
+        <div className="bg-white shadow rounded-lg mb-6 dashboard-card">
           <div
-            className="flex justify-between items-center cursor-pointer"
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
             onClick={() => toggleSection('oauthServerConfig')}
           >
             <h2 className="font-semibold text-gray-800">{t('pages.settings.oauthServer')}</h2>
@@ -626,7 +1334,7 @@ const SettingsPage: React.FC = () => {
           </div>
 
           {sectionsVisible.oauthServerConfig && (
-            <div className="space-y-4 mt-4">
+            <div className="space-y-4 pb-4 px-6">
               <div className="flex items-center justify-between p-3 bg-gray-50 rounded-md">
                 <div>
                   <h3 className="font-medium text-gray-700">{t('settings.enableOauthServer')}</h3>
@@ -870,9 +1578,9 @@ const SettingsPage: React.FC = () => {
 
       {/* MCPRouter Configuration Settings */}
       <PermissionChecker permissions={PERMISSIONS.SETTINGS_INSTALL_CONFIG}>
-        <div className="bg-white shadow rounded-lg py-4 px-6 mb-6 page-card dashboard-card">
+        <div className="bg-white shadow rounded-lg mb-6 page-card dashboard-card">
           <div
-            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600"
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
             onClick={() => toggleSection('mcpRouterConfig')}
           >
             <h2 className="font-semibold text-gray-800">{t('settings.mcpRouterConfig')}</h2>
@@ -882,7 +1590,7 @@ const SettingsPage: React.FC = () => {
           </div>
 
           {sectionsVisible.mcpRouterConfig && (
-            <div className="space-y-4 mt-4">
+            <div className="space-y-4 pb-4 px-6">
               <div className="p-3 bg-gray-50 rounded-md">
                 <div className="mb-2">
                   <h3 className="font-medium text-gray-700">{t('settings.mcpRouterApiKey')}</h3>
@@ -941,9 +1649,9 @@ const SettingsPage: React.FC = () => {
 
       {/* System Settings */}
       <PermissionChecker permissions={PERMISSIONS.SETTINGS_SYSTEM_CONFIG}>
-        <div className="bg-white shadow rounded-lg py-4 px-6 mb-6 dashboard-card">
+        <div className="bg-white shadow rounded-lg mb-6 dashboard-card">
           <div
-            className="flex justify-between items-center cursor-pointer"
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
             onClick={() => toggleSection('nameSeparator')}
           >
             <h2 className="font-semibold text-gray-800">{t('settings.systemSettings')}</h2>
@@ -951,7 +1659,7 @@ const SettingsPage: React.FC = () => {
           </div>
 
           {sectionsVisible.nameSeparator && (
-            <div className="space-y-4 mt-4">
+            <div className="space-y-4 pb-4 px-6">
               <div className="p-3 bg-gray-50 rounded-md">
                 <div className="mb-2">
                   <h3 className="font-medium text-gray-700">{t('settings.nameSeparatorLabel')}</h3>
@@ -999,9 +1707,9 @@ const SettingsPage: React.FC = () => {
 
       {/* Route Configuration Settings */}
       <PermissionChecker permissions={PERMISSIONS.SETTINGS_ROUTE_CONFIG}>
-        <div className="bg-white shadow rounded-lg py-4 px-6 mb-6 dashboard-card">
+        <div className="bg-white shadow rounded-lg mb-6 dashboard-card">
           <div
-            className="flex justify-between items-center cursor-pointer"
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
             onClick={() => toggleSection('routingConfig')}
           >
             <h2 className="font-semibold text-gray-800">{t('pages.settings.routeConfig')}</h2>
@@ -1009,51 +1717,7 @@ const SettingsPage: React.FC = () => {
           </div>
 
           {sectionsVisible.routingConfig && (
-            <div className="space-y-4 mt-4">
-              <div className="flex items-center justify-between p-3 bg-gray-50 rounded-md">
-                <div>
-                  <h3 className="font-medium text-gray-700">{t('settings.enableBearerAuth')}</h3>
-                  <p className="text-sm text-gray-500">
-                    {t('settings.enableBearerAuthDescription')}
-                  </p>
-                </div>
-                <Switch
-                  disabled={loading}
-                  checked={routingConfig.enableBearerAuth}
-                  onCheckedChange={(checked) =>
-                    handleRoutingConfigChange('enableBearerAuth', checked)
-                  }
-                />
-              </div>
-
-              {routingConfig.enableBearerAuth && (
-                <div className="p-3 bg-gray-50 rounded-md">
-                  <div className="mb-2">
-                    <h3 className="font-medium text-gray-700">{t('settings.bearerAuthKey')}</h3>
-                    <p className="text-sm text-gray-500">
-                      {t('settings.bearerAuthKeyDescription')}
-                    </p>
-                  </div>
-                  <div className="flex items-center gap-3">
-                    <input
-                      type="text"
-                      value={tempRoutingConfig.bearerAuthKey}
-                      onChange={(e) => handleBearerAuthKeyChange(e.target.value)}
-                      placeholder={t('settings.bearerAuthKeyPlaceholder')}
-                      className="flex-1 mt-1 block w-full py-2 px-3 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-input"
-                      disabled={loading || !routingConfig.enableBearerAuth}
-                    />
-                    <button
-                      onClick={saveBearerAuthKey}
-                      disabled={loading || !routingConfig.enableBearerAuth}
-                      className="mt-1 px-4 py-2 bg-blue-600 hover:bg-blue-700 text-white rounded-md text-sm font-medium disabled:opacity-50 btn-primary"
-                    >
-                      {t('common.save')}
-                    </button>
-                  </div>
-                </div>
-              )}
-
+            <div className="space-y-4 pb-4 px-6">
               <div className="flex items-center justify-between p-3 bg-gray-50 rounded-md">
                 <div>
                   <h3 className="font-medium text-gray-700">{t('settings.enableGlobalRoute')}</h3>
@@ -1106,9 +1770,9 @@ const SettingsPage: React.FC = () => {
 
       {/* Installation Configuration Settings */}
       <PermissionChecker permissions={PERMISSIONS.SETTINGS_INSTALL_CONFIG}>
-        <div className="bg-white shadow rounded-lg py-4 px-6 mb-6 dashboard-card">
+        <div className="bg-white shadow rounded-lg mb-6 dashboard-card">
           <div
-            className="flex justify-between items-center cursor-pointer"
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
             onClick={() => toggleSection('installConfig')}
           >
             <h2 className="font-semibold text-gray-800">{t('settings.installConfig')}</h2>
@@ -1116,7 +1780,7 @@ const SettingsPage: React.FC = () => {
           </div>
 
           {sectionsVisible.installConfig && (
-            <div className="space-y-4 mt-4">
+            <div className="space-y-4 pb-4 px-6">
               <div className="p-3 bg-gray-50 rounded-md">
                 <div className="mb-2">
                   <h3 className="font-medium text-gray-700">{t('settings.baseUrl')}</h3>
@@ -1194,12 +1858,9 @@ const SettingsPage: React.FC = () => {
       </PermissionChecker>
 
       {/* Change Password */}
-      <div
-        className="bg-white shadow rounded-lg py-4 px-6 mb-6 dashboard-card"
-        data-section="password"
-      >
+      <div className="bg-white shadow rounded-lg mb-6 dashboard-card" data-section="password">
         <div
-          className="flex justify-between items-center cursor-pointer"
+          className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
           onClick={() => toggleSection('password')}
           role="button"
         >
@@ -1208,7 +1869,7 @@ const SettingsPage: React.FC = () => {
         </div>
 
         {sectionsVisible.password && (
-          <div className="max-w-lg mt-4">
+          <div className="max-w-lg pb-4 px-6">
             <ChangePasswordForm onSuccess={handlePasswordChangeSuccess} />
           </div>
         )}
@@ -1216,9 +1877,9 @@ const SettingsPage: React.FC = () => {
 
       {/* Export MCP Settings */}
       <PermissionChecker permissions={PERMISSIONS.SETTINGS_EXPORT_CONFIG}>
-        <div className="bg-white shadow rounded-lg py-4 px-6 mb-6 dashboard-card">
+        <div className="bg-white shadow rounded-lg mb-6 dashboard-card">
           <div
-            className="flex justify-between items-center cursor-pointer"
+            className="flex justify-between items-center cursor-pointer transition-colors duration-200 hover:text-blue-600 py-4 px-6"
             onClick={() => toggleSection('exportConfig')}
           >
             <h2 className="font-semibold text-gray-800">{t('settings.exportMcpSettings')}</h2>
@@ -1226,7 +1887,7 @@ const SettingsPage: React.FC = () => {
           </div>
 
           {sectionsVisible.exportConfig && (
-            <div className="space-y-4 mt-4">
+            <div className="space-y-4 pb-4 px-6">
               <div className="p-3 bg-gray-50 rounded-md">
                 <div className="mb-4">
                   <h3 className="font-medium text-gray-700">{t('settings.mcpSettingsJson')}</h3>

frontend/src/types/index.ts

@@ -309,6 +309,19 @@ export interface ApiResponse<T = any> {
   data?: T;
 }
 
+// Bearer authentication key configuration (frontend view model)
+export type BearerKeyAccessType = 'all' | 'groups' | 'servers';
+
+export interface BearerKey {
+  id: string;
+  name: string;
+  token: string;
+  enabled: boolean;
+  accessType: BearerKeyAccessType;
+  allowedGroups?: string[];
+  allowedServers?: string[];
+}
+
 // Auth types
 export interface IUser {
   username: string;

locales/en.json

@@ -116,6 +116,9 @@
     "enabled": "Enabled",
     "enable": "Enable",
     "disable": "Disable",
+    "reload": "Reload",
+    "reloadSuccess": "Server reloaded successfully",
+    "reloadError": "Failed to reload server {{serverName}}",
     "requestOptions": "Connection Configuration",
     "timeout": "Request Timeout",
     "timeoutDescription": "Timeout for requests to the MCP server (ms)",
@@ -250,7 +253,11 @@
     "type": "Type",
     "repeated": "Repeated",
     "valueHint": "Value Hint",
-    "choices": "Choices"
+    "choices": "Choices",
+    "actions": "Actions",
+    "saving": "Saving...",
+    "active": "Active",
+    "inactive": "Inactive"
   },
   "nav": {
     "dashboard": "Dashboard",
@@ -273,7 +280,7 @@
       "recentServers": "Recent Servers"
     },
     "servers": {
-      "title": "Servers Management"
+      "title": "Server Management"
     },
     "groups": {
       "title": "Group Management"
@@ -536,7 +543,9 @@
     "description": "Description",
     "messages": "Messages",
     "noDescription": "No description available",
-    "runPromptWithName": "Get Prompt: {{name}}"
+    "runPromptWithName": "Get Prompt: {{name}}",
+    "descriptionUpdateSuccess": "Prompt description updated successfully",
+    "descriptionUpdateFailed": "Failed to update prompt description"
   },
   "settings": {
     "enableGlobalRoute": "Enable Global Route",
@@ -548,6 +557,27 @@
     "bearerAuthKey": "Bearer Authentication Key",
     "bearerAuthKeyDescription": "The authentication key that will be required in the Bearer token",
     "bearerAuthKeyPlaceholder": "Enter bearer authentication key",
+    "bearerKeysSectionTitle": "Keys",
+    "bearerKeysSectionDescription": "Manage multiple keys with different access scopes.",
+    "noBearerKeys": "No keys configured yet.",
+    "bearerKeyName": "Name",
+    "bearerKeyToken": "Token",
+    "bearerKeyEnabled": "Enabled",
+    "bearerKeyAccessType": "Access scope",
+    "bearerKeyAccessAll": "All",
+    "bearerKeyAccessGroups": "Groups",
+    "bearerKeyAccessServers": "Servers",
+    "bearerKeyAllowedGroups": "Allowed groups",
+    "bearerKeyAllowedServers": "Allowed servers",
+    "addBearerKey": "Add key",
+    "addBearerKeyButton": "Create",
+    "bearerKeyRequired": "Name and token are required",
+    "deleteBearerKeyConfirm": "Are you sure you want to delete this key?",
+    "generate": "Generate",
+    "selectGroups": "Select Groups",
+    "selectServers": "Select Servers",
+    "selectAtLeastOneGroup": "Please select at least one group",
+    "selectAtLeastOneServer": "Please select at least one server",
     "skipAuth": "Skip Authentication",
     "skipAuthDescription": "Bypass login requirement for frontend and API access (DEFAULT OFF for security)",
     "pythonIndexUrl": "Python Package Repository URL",
@@ -667,6 +697,22 @@
     "importFailed": "Failed to import servers",
     "partialSuccess": "Imported {{count}} of {{total}} servers successfully. Some servers failed:"
   },
+  "groupImport": {
+    "button": "Import",
+    "title": "Import Groups from JSON",
+    "inputLabel": "Group Configuration JSON",
+    "inputHelp": "Paste your group configuration JSON. Each group can contain a list of servers.",
+    "preview": "Preview",
+    "previewTitle": "Preview Groups to Import",
+    "import": "Import",
+    "importing": "Importing...",
+    "invalidFormat": "Invalid JSON format. The JSON must contain a 'groups' array.",
+    "missingName": "Each group must have a 'name' field.",
+    "parseError": "Failed to parse JSON. Please check the format and try again.",
+    "addFailed": "Failed to add group",
+    "importFailed": "Failed to import groups",
+    "partialSuccess": "Imported {{count}} of {{total}} groups successfully. Some groups failed:"
+  },
   "users": {
     "add": "Add User",
     "addNew": "Add New User",
@@ -723,6 +769,7 @@
       "failedToRemoveServer": "Server not found or failed to remove",
       "internalServerError": "Internal server error",
       "failedToGetServers": "Failed to get servers information",
+      "failedToReloadServer": "Failed to reload server",
       "failedToGetServerSettings": "Failed to get server settings",
       "failedToGetServerConfig": "Failed to get server configuration",
       "failedToSaveSettings": "Failed to save settings",

locales/fr.json

@@ -116,6 +116,9 @@
     "enabled": "Activé",
     "enable": "Activer",
     "disable": "Désactiver",
+    "reload": "Recharger",
+    "reloadSuccess": "Serveur rechargé avec succès",
+    "reloadError": "Échec du rechargement du serveur {{serverName}}",
     "requestOptions": "Configuration de la connexion",
     "timeout": "Délai d'attente de la requête",
     "timeoutDescription": "Délai d'attente pour les requêtes vers le serveur MCP (ms)",
@@ -208,6 +211,7 @@
     "serverAdd": "Échec de l'ajout du serveur. Veuillez vérifier l'état du serveur",
     "serverUpdate": "Échec de la modification du serveur {{serverName}}. Veuillez vérifier l'état du serveur",
     "serverFetch": "Échec de la récupération des données du serveur. Veuillez réessayer plus tard",
+    "failedToReloadServer": "Échec du rechargement du serveur",
     "initialStartup": "Le serveur est peut-être en cours de démarrage. Veuillez patienter un instant car ce processus peut prendre du temps au premier lancement...",
     "serverInstall": "Échec de l'installation du serveur",
     "failedToFetchSettings": "Échec de la récupération des paramètres",
@@ -250,7 +254,11 @@
     "type": "Type",
     "repeated": "Répété",
     "valueHint": "Indice de valeur",
-    "choices": "Choix"
+    "choices": "Choix",
+    "actions": "Actions",
+    "saving": "Enregistrement...",
+    "active": "Actif",
+    "inactive": "Inactif"
   },
   "nav": {
     "dashboard": "Tableau de bord",
@@ -536,7 +544,9 @@
     "description": "Description",
     "messages": "Messages",
     "noDescription": "Aucune description disponible",
-    "runPromptWithName": "Obtenir l'invite : {{name}}"
+    "runPromptWithName": "Obtenir l'invite : {{name}}",
+    "descriptionUpdateSuccess": "Description de l'invite mise à jour avec succès",
+    "descriptionUpdateFailed": "Échec de la mise à jour de la description de l'invite"
   },
   "settings": {
     "enableGlobalRoute": "Activer la route globale",
@@ -548,6 +558,27 @@
     "bearerAuthKey": "Clé d'authentification Bearer",
     "bearerAuthKeyDescription": "La clé d'authentification qui sera requise dans le jeton Bearer",
     "bearerAuthKeyPlaceholder": "Entrez la clé d'authentification Bearer",
+    "bearerKeysSectionTitle": "Clés",
+    "bearerKeysSectionDescription": "Gérez plusieurs clés avec différentes portées d’accès.",
+    "noBearerKeys": "Aucune clé configurée pour le moment.",
+    "bearerKeyName": "Nom",
+    "bearerKeyToken": "Jeton",
+    "bearerKeyEnabled": "Activée",
+    "bearerKeyAccessType": "Portée d’accès",
+    "bearerKeyAccessAll": "Toutes",
+    "bearerKeyAccessGroups": "Groupes",
+    "bearerKeyAccessServers": "Serveurs",
+    "bearerKeyAllowedGroups": "Groupes autorisés",
+    "bearerKeyAllowedServers": "Serveurs autorisés",
+    "addBearerKey": "Ajouter une clé",
+    "addBearerKeyButton": "Créer",
+    "bearerKeyRequired": "Le nom et le jeton sont obligatoires",
+    "deleteBearerKeyConfirm": "Voulez-vous vraiment supprimer cette clé ?",
+    "generate": "Générer",
+    "selectGroups": "Sélectionner des groupes",
+    "selectServers": "Sélectionner des serveurs",
+    "selectAtLeastOneGroup": "Veuillez sélectionner au moins un groupe",
+    "selectAtLeastOneServer": "Veuillez sélectionner au moins un serveur",
     "skipAuth": "Ignorer l'authentification",
     "skipAuthDescription": "Contourner l'exigence de connexion pour l'accès au frontend et à l'API (DÉSACTIVÉ PAR DÉFAUT pour des raisons de sécurité)",
     "pythonIndexUrl": "URL du dépôt de paquets Python",
@@ -667,6 +698,22 @@
     "importFailed": "Échec de l'importation des serveurs",
     "partialSuccess": "{{count}} serveur(s) sur {{total}} importé(s) avec succès. Certains serveurs ont échoué :"
   },
+  "groupImport": {
+    "button": "Importer",
+    "title": "Importer des groupes depuis JSON",
+    "inputLabel": "Configuration JSON des groupes",
+    "inputHelp": "Collez votre configuration JSON de groupes. Chaque groupe peut contenir une liste de serveurs.",
+    "preview": "Aperçu",
+    "previewTitle": "Aperçu des groupes à importer",
+    "import": "Importer",
+    "importing": "Importation en cours...",
+    "invalidFormat": "Format JSON invalide. Le JSON doit contenir un tableau 'groups'.",
+    "missingName": "Chaque groupe doit avoir un champ 'name'.",
+    "parseError": "Échec de l'analyse du JSON. Veuillez vérifier le format et réessayer.",
+    "addFailed": "Échec de l'ajout du groupe",
+    "importFailed": "Échec de l'importation des groupes",
+    "partialSuccess": "{{count}} groupe(s) sur {{total}} importé(s) avec succès. Certains groupes ont échoué :"
+  },
   "users": {
     "add": "Ajouter un utilisateur",
     "addNew": "Ajouter un nouvel utilisateur",

locales/tr.json

@@ -116,6 +116,9 @@
     "enabled": "Etkin",
     "enable": "Etkinleştir",
     "disable": "Devre Dışı Bırak",
+    "reload": "Yeniden Yükle",
+    "reloadSuccess": "Sunucu başarıyla yeniden yüklendi",
+    "reloadError": "Sunucu {{serverName}} yeniden yüklenemedi",
     "requestOptions": "Bağlantı Yapılandırması",
     "timeout": "İstek Zaman Aşımı",
     "timeoutDescription": "MCP sunucusuna yapılan istekler için zaman aşımı (ms)",
@@ -208,6 +211,7 @@
     "serverAdd": "Sunucu eklenemedi. Lütfen sunucu durumunu kontrol edin",
     "serverUpdate": "{{serverName}} sunucusu düzenlenemedi. Lütfen sunucu durumunu kontrol edin",
     "serverFetch": "Sunucu verileri alınamadı. Lütfen daha sonra tekrar deneyin",
+    "failedToReloadServer": "Sunucu yeniden yüklenemedi",
     "initialStartup": "Sunucu başlatılıyor olabilir. İlk başlatmada bu işlem biraz zaman alabileceğinden lütfen bekleyin...",
     "serverInstall": "Sunucu yüklenemedi",
     "failedToFetchSettings": "Ayarlar getirilemedi",
@@ -250,7 +254,11 @@
     "type": "Tür",
     "repeated": "Tekrarlanan",
     "valueHint": "Değer İpucu",
-    "choices": "Seçenekler"
+    "choices": "Seçenekler",
+    "actions": "Eylemler",
+    "saving": "Kaydediliyor...",
+    "active": "Aktif",
+    "inactive": "Pasif"
   },
   "nav": {
     "dashboard": "Kontrol Paneli",
@@ -536,7 +544,9 @@
     "description": "Açıklama",
     "messages": "Mesajlar",
     "noDescription": "Kullanılabilir açıklama yok",
-    "runPromptWithName": "İsteği Getir: {{name}}"
+    "runPromptWithName": "İsteği Getir: {{name}}",
+    "descriptionUpdateSuccess": "İstek açıklaması başarıyla güncellendi",
+    "descriptionUpdateFailed": "İstek açıklaması güncellenemedi"
   },
   "settings": {
     "enableGlobalRoute": "Global Yönlendirmeyi Etkinleştir",
@@ -548,6 +558,27 @@
     "bearerAuthKey": "Bearer Kimlik Doğrulama Anahtarı",
     "bearerAuthKeyDescription": "Bearer token'da gerekli olacak kimlik doğrulama anahtarı",
     "bearerAuthKeyPlaceholder": "Bearer kimlik doğrulama anahtarını girin",
+    "bearerKeysSectionTitle": "Anahtarlar",
+    "bearerKeysSectionDescription": "Farklı erişim kapsamlarına sahip birden fazla anahtarı yönetin.",
+    "noBearerKeys": "Henüz yapılandırılmış herhangi bir anahtar yok.",
+    "bearerKeyName": "Ad",
+    "bearerKeyToken": "Token",
+    "bearerKeyEnabled": "Etkin",
+    "bearerKeyAccessType": "Erişim kapsamı",
+    "bearerKeyAccessAll": "Tümü",
+    "bearerKeyAccessGroups": "Gruplar",
+    "bearerKeyAccessServers": "Sunucular",
+    "bearerKeyAllowedGroups": "İzin verilen gruplar",
+    "bearerKeyAllowedServers": "İzin verilen sunucular",
+    "addBearerKey": "Anahtar ekle",
+    "addBearerKeyButton": "Oluştur",
+    "bearerKeyRequired": "Ad ve token zorunludur",
+    "deleteBearerKeyConfirm": "Bu anahtarı silmek istediğinizden emin misiniz?",
+    "generate": "Oluştur",
+    "selectGroups": "Grupları Seç",
+    "selectServers": "Sunucuları Seç",
+    "selectAtLeastOneGroup": "Lütfen en az bir grup seçin",
+    "selectAtLeastOneServer": "Lütfen en az bir sunucu seçin",
     "skipAuth": "Kimlik Doğrulamayı Atla",
     "skipAuthDescription": "Arayüz ve API erişimi için giriş gereksinimini atla (Güvenlik için VARSAYILAN KAPALI)",
     "pythonIndexUrl": "Python Paket Deposu URL'si",
@@ -667,6 +698,22 @@
     "importFailed": "Sunucular içe aktarılamadı",
     "partialSuccess": "{{total}} sunucudan {{count}} tanesi başarıyla içe aktarıldı. Bazı sunucular başarısız oldu:"
   },
+  "groupImport": {
+    "button": "İçe Aktar",
+    "title": "JSON'dan Grupları İçe Aktar",
+    "inputLabel": "Grup Yapılandırma JSON",
+    "inputHelp": "Grup yapılandırma JSON'unuzu yapıştırın. Her grup bir sunucu listesi içerebilir.",
+    "preview": "Önizle",
+    "previewTitle": "İçe Aktarılacak Grupları Önizle",
+    "import": "İçe Aktar",
+    "importing": "İçe aktarılıyor...",
+    "invalidFormat": "Geçersiz JSON formatı. JSON bir 'groups' dizisi içermelidir.",
+    "missingName": "Her grubun bir 'name' alanı olmalıdır.",
+    "parseError": "JSON ayrıştırılamadı. Lütfen formatı kontrol edip tekrar deneyin.",
+    "addFailed": "Grup eklenemedi",
+    "importFailed": "Gruplar içe aktarılamadı",
+    "partialSuccess": "{{total}} gruptan {{count}} tanesi başarıyla içe aktarıldı. Bazı gruplar başarısız oldu:"
+  },
   "users": {
     "add": "Kullanıcı Ekle",
     "addNew": "Yeni Kullanıcı Ekle",

locales/zh.json

@@ -116,6 +116,9 @@
     "enabled": "已启用",
     "enable": "启用",
     "disable": "禁用",
+    "reload": "重载",
+    "reloadSuccess": "服务器重载成功",
+    "reloadError": "重载服务器 {{serverName}} 失败",
     "requestOptions": "连接配置",
     "timeout": "请求超时",
     "timeoutDescription": "请求超时时间（毫秒）",
@@ -208,6 +211,7 @@
     "serverAdd": "添加服务器失败，请检查服务器状态",
     "serverUpdate": "编辑服务器 {{serverName}} 失败，请检查服务器状态",
     "serverFetch": "获取服务器数据失败，请稍后重试",
+    "failedToReloadServer": "重载服务器失败",
     "initialStartup": "服务器可能正在启动中。首次启动可能需要一些时间，请耐心等候...",
     "serverInstall": "安装服务器失败",
     "failedToFetchSettings": "获取设置失败",
@@ -251,7 +255,11 @@
     "type": "类型",
     "repeated": "可重复",
     "valueHint": "值提示",
-    "choices": "可选值"
+    "choices": "可选值",
+    "actions": "操作",
+    "saving": "保存中...",
+    "active": "已激活",
+    "inactive": "未激活"
   },
   "nav": {
     "dashboard": "仪表盘",
@@ -285,7 +293,7 @@
       "routeConfig": "安全配置",
       "installConfig": "安装",
       "smartRouting": "智能路由",
-      "oauthServer": "OAuth 服务器"
+      "oauthServer": "OAuth"
     },
     "groups": {
       "title": "分组管理"
@@ -537,7 +545,9 @@
     "description": "描述",
     "messages": "消息",
     "noDescription": "无描述信息",
-    "runPromptWithName": "获取提示词: {{name}}"
+    "runPromptWithName": "获取提示词: {{name}}",
+    "descriptionUpdateSuccess": "提示词描述更新成功",
+    "descriptionUpdateFailed": "更新提示词描述失败"
   },
   "settings": {
     "enableGlobalRoute": "启用全局路由",
@@ -549,6 +559,27 @@
     "bearerAuthKey": "Bearer 认证密钥",
     "bearerAuthKeyDescription": "Bearer 令牌中需要携带的认证密钥",
     "bearerAuthKeyPlaceholder": "请输入 Bearer 认证密钥",
+    "bearerKeysSectionTitle": "密钥",
+    "bearerKeysSectionDescription": "管理多条密钥，并为不同密钥配置不同的访问范围。",
+    "noBearerKeys": "当前还没有配置任何密钥。",
+    "bearerKeyName": "名称",
+    "bearerKeyToken": "密钥值",
+    "bearerKeyEnabled": "启用",
+    "bearerKeyAccessType": "访问范围",
+    "bearerKeyAccessAll": "全部",
+    "bearerKeyAccessGroups": "指定分组",
+    "bearerKeyAccessServers": "指定服务器",
+    "bearerKeyAllowedGroups": "允许访问的分组",
+    "bearerKeyAllowedServers": "允许访问的服务器",
+    "addBearerKey": "新增密钥",
+    "addBearerKeyButton": "创建",
+    "bearerKeyRequired": "名称和密钥值为必填项",
+    "deleteBearerKeyConfirm": "确定要删除这条密钥吗？",
+    "generate": "生成",
+    "selectGroups": "选择分组",
+    "selectServers": "选择服务器",
+    "selectAtLeastOneGroup": "请至少选择一个分组",
+    "selectAtLeastOneServer": "请至少选择一个服务",
     "skipAuth": "免登录开关",
     "skipAuthDescription": "跳过前端和 API 访问的登录要求（默认关闭确保安全性）",
     "pythonIndexUrl": "Python 包仓库地址",
@@ -669,6 +700,22 @@
     "importFailed": "导入服务器失败",
     "partialSuccess": "成功导入 {{count}} / {{total}} 个服务器。部分服务器失败："
   },
+  "groupImport": {
+    "button": "导入",
+    "title": "从 JSON 导入分组",
+    "inputLabel": "分组配置 JSON",
+    "inputHelp": "粘贴您的分组配置 JSON。每个分组可以包含一个服务器列表。",
+    "preview": "预览",
+    "previewTitle": "预览要导入的分组",
+    "import": "导入",
+    "importing": "导入中...",
+    "invalidFormat": "无效的 JSON 格式。JSON 必须包含 'groups' 数组。",
+    "missingName": "每个分组必须有 'name' 字段。",
+    "parseError": "解析 JSON 失败。请检查格式后重试。",
+    "addFailed": "添加分组失败",
+    "importFailed": "导入分组失败",
+    "partialSuccess": "成功导入 {{count}} / {{total}} 个分组。部分分组失败："
+  },
   "users": {
     "add": "添加",
     "addNew": "添加新用户",

package.json

@@ -60,7 +60,7 @@
     "dotenv": "^16.6.1",
     "dotenv-expand": "^12.0.2",
     "express": "^4.21.2",
-    "express-validator": "^7.2.1",
+    "express-validator": "^7.3.1",
     "i18next": "^25.5.0",
     "i18next-fs-backend": "^2.6.0",
     "jsonwebtoken": "^9.0.2",
@@ -110,8 +110,8 @@
     "next": "^15.5.0",
     "postcss": "^8.5.6",
     "prettier": "^3.6.2",
-    "react": "19.1.1",
-    "react-dom": "19.1.1",
+    "react": "19.2.1",
+    "react-dom": "19.2.1",
     "react-i18next": "^15.7.2",
     "react-router-dom": "^7.8.2",
     "supertest": "^7.1.4",
@@ -132,7 +132,10 @@
   "pnpm": {
     "overrides": {
       "brace-expansion@1.1.11": "1.1.12",
-      "brace-expansion@2.0.1": "2.0.2"
+      "brace-expansion@2.0.1": "2.0.2",
+      "glob@10.4.5": "10.5.0",
+      "js-yaml": "4.1.1",
+      "jws@3.2.2": "4.0.1"
     }
   }
-}
+}

src/controllers/bearerKeyController.ts

@@ -0,0 +1,169 @@
+import { Request, Response } from 'express';
+import { ApiResponse, BearerKey } from '../types/index.js';
+import { getBearerKeyDao, getSystemConfigDao } from '../dao/index.js';
+
+const requireAdmin = async (req: Request, res: Response): Promise<boolean> => {
+  const systemConfigDao = getSystemConfigDao();
+  const systemConfig = await systemConfigDao.get();
+  if (systemConfig?.routing?.skipAuth) {
+    return true;
+  }
+
+  const user = (req as any).user;
+  if (!user || !user.isAdmin) {
+    res.status(403).json({
+      success: false,
+      message: 'Admin privileges required',
+    });
+    return false;
+  }
+  return true;
+};
+
+export const getBearerKeys = async (req: Request, res: Response): Promise<void> => {
+  if (!(await requireAdmin(req, res))) return;
+
+  try {
+    const dao = getBearerKeyDao();
+    const keys = await dao.findAll();
+    const response: ApiResponse = {
+      success: true,
+      data: keys,
+    };
+    res.json(response);
+  } catch (error) {
+    console.error('Failed to get bearer keys:', error);
+    res.status(500).json({
+      success: false,
+      message: 'Failed to get bearer keys',
+    });
+  }
+};
+
+export const createBearerKey = async (req: Request, res: Response): Promise<void> => {
+  if (!(await requireAdmin(req, res))) return;
+
+  try {
+    const { name, token, enabled, accessType, allowedGroups, allowedServers } =
+      req.body as Partial<BearerKey>;
+
+    if (!name || typeof name !== 'string') {
+      res.status(400).json({ success: false, message: 'Key name is required' });
+      return;
+    }
+
+    if (!token || typeof token !== 'string') {
+      res.status(400).json({ success: false, message: 'Token value is required' });
+      return;
+    }
+
+    if (!accessType || !['all', 'groups', 'servers'].includes(accessType)) {
+      res.status(400).json({ success: false, message: 'Invalid accessType' });
+      return;
+    }
+
+    const dao = getBearerKeyDao();
+    const key = await dao.create({
+      name,
+      token,
+      enabled: enabled ?? true,
+      accessType,
+      allowedGroups: Array.isArray(allowedGroups) ? allowedGroups : [],
+      allowedServers: Array.isArray(allowedServers) ? allowedServers : [],
+    });
+
+    const response: ApiResponse = {
+      success: true,
+      data: key,
+    };
+    res.status(201).json(response);
+  } catch (error) {
+    console.error('Failed to create bearer key:', error);
+    res.status(500).json({
+      success: false,
+      message: 'Failed to create bearer key',
+    });
+  }
+};
+
+export const updateBearerKey = async (req: Request, res: Response): Promise<void> => {
+  if (!(await requireAdmin(req, res))) return;
+
+  try {
+    const { id } = req.params;
+    if (!id) {
+      res.status(400).json({ success: false, message: 'Key id is required' });
+      return;
+    }
+
+    const { name, token, enabled, accessType, allowedGroups, allowedServers } =
+      req.body as Partial<BearerKey>;
+
+    const updates: Partial<BearerKey> = {};
+    if (name !== undefined) updates.name = name;
+    if (token !== undefined) updates.token = token;
+    if (enabled !== undefined) updates.enabled = enabled;
+    if (accessType !== undefined) {
+      if (!['all', 'groups', 'servers'].includes(accessType)) {
+        res.status(400).json({ success: false, message: 'Invalid accessType' });
+        return;
+      }
+      updates.accessType = accessType as BearerKey['accessType'];
+    }
+    if (allowedGroups !== undefined) {
+      updates.allowedGroups = Array.isArray(allowedGroups) ? allowedGroups : [];
+    }
+    if (allowedServers !== undefined) {
+      updates.allowedServers = Array.isArray(allowedServers) ? allowedServers : [];
+    }
+
+    const dao = getBearerKeyDao();
+    const updated = await dao.update(id, updates);
+    if (!updated) {
+      res.status(404).json({ success: false, message: 'Bearer key not found' });
+      return;
+    }
+
+    const response: ApiResponse = {
+      success: true,
+      data: updated,
+    };
+    res.json(response);
+  } catch (error) {
+    console.error('Failed to update bearer key:', error);
+    res.status(500).json({
+      success: false,
+      message: 'Failed to update bearer key',
+    });
+  }
+};
+
+export const deleteBearerKey = async (req: Request, res: Response): Promise<void> => {
+  if (!(await requireAdmin(req, res))) return;
+
+  try {
+    const { id } = req.params;
+    if (!id) {
+      res.status(400).json({ success: false, message: 'Key id is required' });
+      return;
+    }
+
+    const dao = getBearerKeyDao();
+    const deleted = await dao.delete(id);
+    if (!deleted) {
+      res.status(404).json({ success: false, message: 'Bearer key not found' });
+      return;
+    }
+
+    const response: ApiResponse = {
+      success: true,
+    };
+    res.json(response);
+  } catch (error) {
+    console.error('Failed to delete bearer key:', error);
+    res.status(500).json({
+      success: false,
+      message: 'Failed to delete bearer key',
+    });
+  }
+};

src/controllers/configController.ts

@@ -1,9 +1,19 @@
 import { Request, Response } from 'express';
 import config from '../config/index.js';
-import { loadSettings, loadOriginalSettings } from '../config/index.js';
+import { loadSettings } from '../config/index.js';
 import { getDataService } from '../services/services.js';
 import { DataService } from '../services/dataService.js';
 import { IUser } from '../types/index.js';
+import {
+  getGroupDao,
+  getOAuthClientDao,
+  getOAuthTokenDao,
+  getServerDao,
+  getSystemConfigDao,
+  getUserConfigDao,
+  getUserDao,
+  getBearerKeyDao,
+} from '../dao/DaoFactory.js';
 
 const dataService: DataService = getDataService();
 
@@ -73,17 +83,39 @@ export const getPublicConfig = (req: Request, res: Response): void => {
   }
 };
 
+/**
+ * Recursively remove null values from an object
+ */
+const removeNullValues = <T>(obj: T): T => {
+  if (obj === null || obj === undefined) {
+    return obj;
+  }
+  if (Array.isArray(obj)) {
+    return obj.map((item) => removeNullValues(item)) as T;
+  }
+  if (typeof obj === 'object') {
+    const result: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(obj)) {
+      if (value !== null) {
+        result[key] = removeNullValues(value);
+      }
+    }
+    return result as T;
+  }
+  return obj;
+};
+
 /**
  * Get MCP settings in JSON format for export/copy
  * Supports both full settings and individual server configuration
  */
-export const getMcpSettingsJson = (req: Request, res: Response): void => {
+export const getMcpSettingsJson = async (req: Request, res: Response): Promise<void> => {
   try {
     const { serverName } = req.query;
-    const settings = loadOriginalSettings();
     if (serverName && typeof serverName === 'string') {
-      // Return individual server configuration
-      const serverConfig = settings.mcpServers[serverName];
+      // Return individual server configuration using DAO
+      const serverDao = getServerDao();
+      const serverConfig = await serverDao.findById(serverName);
       if (!serverConfig) {
         res.status(404).json({
           success: false,
@@ -92,16 +124,56 @@ export const getMcpSettingsJson = (req: Request, res: Response): void => {
         return;
       }
 
+      // Remove the 'name' field from config as it's used as the key
+      const { name, ...configWithoutName } = serverConfig;
+      // Remove null values from the config
+      const cleanedConfig = removeNullValues(configWithoutName);
       res.json({
         success: true,
         data: {
           mcpServers: {
-            [serverName]: serverConfig,
+            [name]: cleanedConfig,
           },
         },
       });
     } else {
-      // Return full settings
+      // Return full settings via DAO layer (supports both file and database modes)
+      const [
+        servers,
+        users,
+        groups,
+        systemConfig,
+        userConfigs,
+        oauthClients,
+        oauthTokens,
+        bearerKeys,
+      ] = await Promise.all([
+        getServerDao().findAll(),
+        getUserDao().findAll(),
+        getGroupDao().findAll(),
+        getSystemConfigDao().get(),
+        getUserConfigDao().getAll(),
+        getOAuthClientDao().findAll(),
+        getOAuthTokenDao().findAll(),
+        getBearerKeyDao().findAll(),
+      ]);
+
+      const mcpServers: Record<string, any> = {};
+      for (const { name: serverConfigName, ...config } of servers) {
+        mcpServers[serverConfigName] = removeNullValues(config);
+      }
+
+      const settings = {
+        mcpServers,
+        users,
+        groups,
+        systemConfig,
+        userConfigs,
+        oauthClients,
+        oauthTokens,
+        bearerKeys,
+      };
+
       res.json({
         success: true,
         data: settings,

src/controllers/groupController.ts

@@ -1,5 +1,11 @@
 import { Request, Response } from 'express';
-import { ApiResponse } from '../types/index.js';
+import {
+  ApiResponse,
+  AddGroupRequest,
+  BatchCreateGroupsRequest,
+  BatchCreateGroupsResponse,
+  BatchGroupResult,
+} from '../types/index.js';
 import {
   getAllGroups,
   getGroupByIdOrName,
@@ -106,6 +112,143 @@ export const createNewGroup = async (req: Request, res: Response): Promise<void>
   }
 };
 
+// Batch create groups - validates and creates multiple groups in one request
+export const batchCreateGroups = async (req: Request, res: Response): Promise<void> => {
+  try {
+    const { groups } = req.body as BatchCreateGroupsRequest;
+
+    // Validate request body
+    if (!groups || !Array.isArray(groups)) {
+      res.status(400).json({
+        success: false,
+        message: 'Request body must contain a "groups" array',
+      });
+      return;
+    }
+
+    if (groups.length === 0) {
+      res.status(400).json({
+        success: false,
+        message: 'Groups array cannot be empty',
+      });
+      return;
+    }
+
+    // Helper function to validate a single group configuration
+    const validateGroupConfig = (group: AddGroupRequest): { valid: boolean; message?: string } => {
+      if (!group.name || typeof group.name !== 'string') {
+        return { valid: false, message: 'Group name is required and must be a string' };
+      }
+
+      if (group.description !== undefined && typeof group.description !== 'string') {
+        return { valid: false, message: 'Group description must be a string' };
+      }
+
+      if (group.servers !== undefined && !Array.isArray(group.servers)) {
+        return { valid: false, message: 'Group servers must be an array' };
+      }
+
+      // Validate server configurations if provided in new format
+      if (group.servers) {
+        for (const server of group.servers) {
+          if (typeof server === 'object' && server !== null) {
+            if (!server.name || typeof server.name !== 'string') {
+              return {
+                valid: false,
+                message: 'Server configuration must have a name property',
+              };
+            }
+
+            if (
+              server.tools !== undefined &&
+              server.tools !== 'all' &&
+              !Array.isArray(server.tools)
+            ) {
+              return {
+                valid: false,
+                message: 'Server tools must be "all" or an array of tool names',
+              };
+            }
+          }
+        }
+      }
+
+      return { valid: true };
+    };
+
+    // Process each group
+    const results: BatchGroupResult[] = [];
+    let successCount = 0;
+    let failureCount = 0;
+
+    // Get current user for owner field
+    const currentUser = (req as any).user;
+    const defaultOwner = currentUser?.username || 'admin';
+
+    for (const groupData of groups) {
+      const { name, description, servers } = groupData;
+
+      // Validate group configuration
+      const validation = validateGroupConfig(groupData);
+      if (!validation.valid) {
+        results.push({
+          name: name || 'unknown',
+          success: false,
+          message: validation.message,
+        });
+        failureCount++;
+        continue;
+      }
+
+      try {
+        const serverList = Array.isArray(servers) ? servers : [];
+        const newGroup = await createGroup(name, description, serverList, defaultOwner);
+
+        if (newGroup) {
+          results.push({
+            name,
+            success: true,
+            message: 'Group created successfully',
+          });
+          successCount++;
+        } else {
+          results.push({
+            name,
+            success: false,
+            message: 'Failed to create group or group name already exists',
+          });
+          failureCount++;
+        }
+      } catch (error) {
+        results.push({
+          name,
+          success: false,
+          message: error instanceof Error ? error.message : 'Failed to create group',
+        });
+        failureCount++;
+      }
+    }
+
+    // Return response
+    const response: BatchCreateGroupsResponse = {
+      success: successCount > 0,
+      successCount,
+      failureCount,
+      results,
+    };
+
+    // Use 207 Multi-Status if there were partial failures, 200 if all succeeded
+    const statusCode = failureCount > 0 && successCount > 0 ? 207 : successCount > 0 ? 200 : 400;
+    res.status(statusCode).json(response);
+  } catch (error) {
+    console.error('Batch create groups error:', error);
+    res.status(500).json({
+      success: false,
+      message: 'Internal server error',
+    });
+  }
+};
+
 // Update an existing group
 export const updateExistingGroup = async (req: Request, res: Response): Promise<void> => {
   try {

src/controllers/oauthClientController.ts

@@ -14,10 +14,10 @@ import { IOAuthClient } from '../types/index.js';
  * GET /api/oauth/clients
  * Get all OAuth clients
  */
-export const getAllClients = (req: Request, res: Response): void => {
+export const getAllClients = async (req: Request, res: Response): Promise<void> => {
   try {
-    const clients = getOAuthClients();
-    
+    const clients = await getOAuthClients();
+
     // Don't expose client secrets in the list
     const sanitizedClients = clients.map((client) => ({
       clientId: client.clientId,
@@ -45,10 +45,10 @@ export const getAllClients = (req: Request, res: Response): void => {
  * GET /api/oauth/clients/:clientId
  * Get a specific OAuth client
  */
-export const getClient = (req: Request, res: Response): void => {
+export const getClient = async (req: Request, res: Response): Promise<void> => {
   try {
     const { clientId } = req.params;
-    const client = findOAuthClientById(clientId);
+    const client = await findOAuthClientById(clientId);
 
     if (!client) {
       res.status(404).json({
@@ -85,7 +85,7 @@ export const getClient = (req: Request, res: Response): void => {
  * POST /api/oauth/clients
  * Create a new OAuth client
  */
-export const createClient = (req: Request, res: Response): void => {
+export const createClient = async (req: Request, res: Response): Promise<void> => {
   try {
     // Validate request
     const errors = validationResult(req);
@@ -105,7 +105,8 @@ export const createClient = (req: Request, res: Response): void => {
     const clientId = crypto.randomBytes(16).toString('hex');
 
     // Generate client secret if required
-    const clientSecret = requireSecret !== false ? crypto.randomBytes(32).toString('hex') : undefined;
+    const clientSecret =
+      requireSecret !== false ? crypto.randomBytes(32).toString('hex') : undefined;
 
     // Create client
     const client: IOAuthClient = {
@@ -118,7 +119,7 @@ export const createClient = (req: Request, res: Response): void => {
       owner: user?.username || 'admin',
     };
 
-    const createdClient = createOAuthClient(client);
+    const createdClient = await createOAuthClient(client);
 
     // Return client with secret (only shown once)
     res.status(201).json({
@@ -139,7 +140,7 @@ export const createClient = (req: Request, res: Response): void => {
     });
   } catch (error) {
     console.error('Create OAuth client error:', error);
-    
+
     if (error instanceof Error && error.message.includes('already exists')) {
       res.status(409).json({
         success: false,
@@ -158,18 +159,19 @@ export const createClient = (req: Request, res: Response): void => {
  * PUT /api/oauth/clients/:clientId
  * Update an OAuth client
  */
-export const updateClient = (req: Request, res: Response): void => {
+export const updateClient = async (req: Request, res: Response): Promise<void> => {
   try {
     const { clientId } = req.params;
     const { name, redirectUris, grants, scopes } = req.body;
 
     const updates: Partial<IOAuthClient> = {};
     if (name) updates.name = name;
-    if (redirectUris) updates.redirectUris = Array.isArray(redirectUris) ? redirectUris : [redirectUris];
+    if (redirectUris)
+      updates.redirectUris = Array.isArray(redirectUris) ? redirectUris : [redirectUris];
     if (grants) updates.grants = grants;
     if (scopes) updates.scopes = scopes;
 
-    const updatedClient = updateOAuthClient(clientId, updates);
+    const updatedClient = await updateOAuthClient(clientId, updates);
 
     if (!updatedClient) {
       res.status(404).json({
@@ -205,10 +207,10 @@ export const updateClient = (req: Request, res: Response): void => {
  * DELETE /api/oauth/clients/:clientId
  * Delete an OAuth client
  */
-export const deleteClient = (req: Request, res: Response): void => {
+export const deleteClient = async (req: Request, res: Response): Promise<void> => {
   try {
     const { clientId } = req.params;
-    const deleted = deleteOAuthClient(clientId);
+    const deleted = await deleteOAuthClient(clientId);
 
     if (!deleted) {
       res.status(404).json({
@@ -235,10 +237,10 @@ export const deleteClient = (req: Request, res: Response): void => {
  * POST /api/oauth/clients/:clientId/regenerate-secret
  * Regenerate client secret
  */
-export const regenerateSecret = (req: Request, res: Response): void => {
+export const regenerateSecret = async (req: Request, res: Response): Promise<void> => {
   try {
     const { clientId } = req.params;
-    const client = findOAuthClientById(clientId);
+    const client = await findOAuthClientById(clientId);
 
     if (!client) {
       res.status(404).json({
@@ -250,7 +252,7 @@ export const regenerateSecret = (req: Request, res: Response): void => {
 
     // Generate new secret
     const newSecret = crypto.randomBytes(32).toString('hex');
-    const updatedClient = updateOAuthClient(clientId, { clientSecret: newSecret });
+    const updatedClient = await updateOAuthClient(clientId, { clientSecret: newSecret });
 
     if (!updatedClient) {
       res.status(500).json({

src/controllers/oauthDynamicRegistrationController.ts

@@ -48,7 +48,7 @@ const verifyRegistrationToken = (token: string): string | null => {
  * RFC 7591 Dynamic Client Registration
  * Public endpoint for registering new OAuth clients
  */
-export const registerClient = (req: Request, res: Response): void => {
+export const registerClient = async (req: Request, res: Response): Promise<void> => {
   try {
     const settings = loadSettings();
     const oauthConfig = settings.systemConfig?.oauthServer;
@@ -183,7 +183,7 @@ export const registerClient = (req: Request, res: Response): void => {
       },
     };
 
-    const createdClient = createOAuthClient(client);
+    const createdClient = await createOAuthClient(client);
 
     // Build response according to RFC 7591
     const response: any = {
@@ -238,7 +238,7 @@ export const registerClient = (req: Request, res: Response): void => {
  * RFC 7591 Client Configuration Endpoint
  * Read client configuration
  */
-export const getClientConfiguration = (req: Request, res: Response): void => {
+export const getClientConfiguration = async (req: Request, res: Response): Promise<void> => {
   try {
     const { clientId } = req.params;
     const authHeader = req.headers.authorization;
@@ -262,7 +262,7 @@ export const getClientConfiguration = (req: Request, res: Response): void => {
       return;
     }
 
-    const client = findOAuthClientById(clientId);
+    const client = await findOAuthClientById(clientId);
     if (!client) {
       res.status(404).json({
         error: 'invalid_client',
@@ -311,7 +311,7 @@ export const getClientConfiguration = (req: Request, res: Response): void => {
  * RFC 7591 Client Update Endpoint
  * Update client configuration
  */
-export const updateClientConfiguration = (req: Request, res: Response): void => {
+export const updateClientConfiguration = async (req: Request, res: Response): Promise<void> => {
   try {
     const { clientId } = req.params;
     const authHeader = req.headers.authorization;
@@ -335,7 +335,7 @@ export const updateClientConfiguration = (req: Request, res: Response): void =>
       return;
     }
 
-    const client = findOAuthClientById(clientId);
+    const client = await findOAuthClientById(clientId);
     if (!client) {
       res.status(404).json({
         error: 'invalid_client',
@@ -443,7 +443,7 @@ export const updateClientConfiguration = (req: Request, res: Response): void =>
       };
     }
 
-    const updatedClient = updateOAuthClient(clientId, updates);
+    const updatedClient = await updateOAuthClient(clientId, updates);
 
     if (!updatedClient) {
       res.status(500).json({
@@ -495,7 +495,7 @@ export const updateClientConfiguration = (req: Request, res: Response): void =>
  * RFC 7591 Client Delete Endpoint
  * Delete client registration
  */
-export const deleteClientRegistration = (req: Request, res: Response): void => {
+export const deleteClientRegistration = async (req: Request, res: Response): Promise<void> => {
   try {
     const { clientId } = req.params;
     const authHeader = req.headers.authorization;
@@ -519,7 +519,7 @@ export const deleteClientRegistration = (req: Request, res: Response): void => {
       return;
     }
 
-    const deleted = deleteOAuthClient(clientId);
+    const deleted = await deleteOAuthClient(clientId);
 
     if (!deleted) {
       res.status(404).json({

src/controllers/oauthServerController.ts

@@ -212,7 +212,7 @@ export const getAuthorize = async (req: Request, res: Response): Promise<void> =
     }
 
     // Verify client
-    const client = findOAuthClientById(client_id as string);
+    const client = await findOAuthClientById(client_id as string);
     if (!client) {
       res.status(400).json({ error: 'invalid_client', error_description: 'Client not found' });
       return;

src/controllers/serverController.ts

@@ -1,5 +1,13 @@
 import { Request, Response } from 'express';
-import { ApiResponse, AddServerRequest, McpSettings } from '../types/index.js';
+import {
+  ApiResponse,
+  AddServerRequest,
+  McpSettings,
+  BatchCreateServersRequest,
+  BatchCreateServersResponse,
+  BatchServerResult,
+  ServerConfig,
+} from '../types/index.js';
 import {
   getServersInfo,
   addServer,
@@ -8,12 +16,14 @@ import {
   notifyToolChanged,
   syncToolEmbedding,
   toggleServerStatus,
+  reconnectServer,
 } from '../services/mcpService.js';
-import { loadSettings, saveSettings } from '../config/index.js';
+import { loadSettings } from '../config/index.js';
 import { syncAllServerToolsEmbeddings } from '../services/vectorSearchService.js';
 import { createSafeJSON } from '../utils/serialization.js';
 import { cloneDefaultOAuthServerConfig } from '../constants/oauthServerDefaults.js';
 import { getServerDao, getGroupDao, getSystemConfigDao } from '../dao/DaoFactory.js';
+import { getBearerKeyDao } from '../dao/DaoFactory.js';
 
 export const getAllServers = async (_: Request, res: Response): Promise<void> => {
   try {
@@ -56,12 +66,17 @@ export const getAllSettings = async (_: Request, res: Response): Promise<void> =
     const systemConfigDao = getSystemConfigDao();
     const systemConfig = await systemConfigDao.get();
 
+    // Get bearer auth keys from DAO
+    const bearerKeyDao = getBearerKeyDao();
+    const bearerKeys = await bearerKeyDao.findAll();
+
     // Merge all data into settings object
     const settings: McpSettings = {
       ...fileSettings,
       mcpServers,
       groups,
       systemConfig,
+      bearerKeys,
     };
 
     const response: ApiResponse = {
@@ -188,6 +203,177 @@ export const createServer = async (req: Request, res: Response): Promise<void> =
   }
 };
 
+// Batch create servers - validates and creates multiple servers in one request
+export const batchCreateServers = async (req: Request, res: Response): Promise<void> => {
+  try {
+    const { servers } = req.body as BatchCreateServersRequest;
+
+    // Validate request body
+    if (!servers || !Array.isArray(servers)) {
+      res.status(400).json({
+        success: false,
+        message: 'Request body must contain a "servers" array',
+      });
+      return;
+    }
+
+    if (servers.length === 0) {
+      res.status(400).json({
+        success: false,
+        message: 'Servers array cannot be empty',
+      });
+      return;
+    }
+
+    // Helper function to validate a single server configuration
+    const validateServerConfig = (
+      name: string,
+      config: ServerConfig,
+    ): { valid: boolean; message?: string } => {
+      if (!name || typeof name !== 'string') {
+        return { valid: false, message: 'Server name is required and must be a string' };
+      }
+
+      if (!config || typeof config !== 'object') {
+        return { valid: false, message: 'Server configuration is required and must be an object' };
+      }
+
+      if (
+        !config.url &&
+        !config.openapi?.url &&
+        !config.openapi?.schema &&
+        (!config.command || !config.args)
+      ) {
+        return {
+          valid: false,
+          message:
+            'Server configuration must include either a URL, OpenAPI specification URL or schema, or command with arguments',
+        };
+      }
+
+      // Validate server type if specified
+      if (config.type && !['stdio', 'sse', 'streamable-http', 'openapi'].includes(config.type)) {
+        return {
+          valid: false,
+          message: 'Server type must be one of: stdio, sse, streamable-http, openapi',
+        };
+      }
+
+      // Validate URL is provided for sse and streamable-http types
+      if ((config.type === 'sse' || config.type === 'streamable-http') && !config.url) {
+        return { valid: false, message: `URL is required for ${config.type} server type` };
+      }
+
+      // Validate OpenAPI specification URL or schema is provided for openapi type
+      if (config.type === 'openapi' && !config.openapi?.url && !config.openapi?.schema) {
+        return {
+          valid: false,
+          message: 'OpenAPI specification URL or schema is required for openapi server type',
+        };
+      }
+
+      // Validate headers if provided
+      if (config.headers && typeof config.headers !== 'object') {
+        return { valid: false, message: 'Headers must be an object' };
+      }
+
+      // Validate that headers are only used with sse, streamable-http, and openapi types
+      if (config.headers && config.type === 'stdio') {
+        return { valid: false, message: 'Headers are not supported for stdio server type' };
+      }
+
+      return { valid: true };
+    };
+
+    // Process each server
+    const results: BatchServerResult[] = [];
+    let successCount = 0;
+    let failureCount = 0;
+
+    // Get current user for owner field
+    const currentUser = (req as any).user;
+    const defaultOwner = currentUser?.username || 'admin';
+
+    for (const server of servers) {
+      const { name, config } = server;
+
+      // Validate server configuration
+      const validation = validateServerConfig(name, config);
+      if (!validation.valid) {
+        results.push({
+          name: name || 'unknown',
+          success: false,
+          message: validation.message,
+        });
+        failureCount++;
+        continue;
+      }
+
+      try {
+        // Set default keep-alive interval for SSE servers if not specified
+        if ((config.type === 'sse' || (!config.type && config.url)) && !config.keepAliveInterval) {
+          config.keepAliveInterval = 60000; // Default 60 seconds for SSE servers
+        }
+
+        // Set owner property if not provided
+        if (!config.owner) {
+          config.owner = defaultOwner;
+        }
+
+        // Attempt to add server
+        const result = await addServer(name, config);
+        if (result.success) {
+          results.push({
+            name,
+            success: true,
+          });
+          successCount++;
+        } else {
+          results.push({
+            name,
+            success: false,
+            message: result.message || 'Failed to add server',
+          });
+          failureCount++;
+        }
+      } catch (error) {
+        results.push({
+          name,
+          success: false,
+          message: error instanceof Error ? error.message : 'Internal server error',
+        });
+        failureCount++;
+      }
+    }
+
+    // Notify tool changes if any server was added successfully
+    if (successCount > 0) {
+      notifyToolChanged();
+    }
+
+    // Prepare response
+    const response: ApiResponse<BatchCreateServersResponse> = {
+      success: successCount > 0, // Success if at least one server was created
+      data: {
+        success: successCount > 0,
+        successCount,
+        failureCount,
+        results,
+      },
+    };
+
+    // Return 207 Multi-Status if there were partial failures, 200 if all succeeded, 400 if all failed
+    const statusCode = failureCount === 0 ? 200 : successCount === 0 ? 400 : 207;
+    res.status(statusCode).json(response);
+  } catch (error) {
+    console.error('Batch create servers error:', error);
+    res.status(500).json({
+      success: false,
+      message: 'Internal server error',
+    });
+  }
+};
+
 export const deleteServer = async (req: Request, res: Response): Promise<void> => {
   try {
     const { name } = req.params;
@@ -415,6 +601,32 @@ export const toggleServer = async (req: Request, res: Response): Promise<void> =
   }
 };
 
+export const reloadServer = async (req: Request, res: Response): Promise<void> => {
+  try {
+    const { name } = req.params;
+    if (!name) {
+      res.status(400).json({
+        success: false,
+        message: 'Server name is required',
+      });
+      return;
+    }
+
+    await reconnectServer(name);
+
+    res.json({
+      success: true,
+      message: `Server ${name} reloaded successfully`,
+    });
+  } catch (error) {
+    console.error('Failed to reload server:', error);
+    res.status(500).json({
+      success: false,
+      message: 'Failed to reload server',
+    });
+  }
+};
+
 // Toggle tool status for a specific server
 export const toggleTool = async (req: Request, res: Response): Promise<void> => {
   try {
@@ -439,8 +651,10 @@ export const toggleTool = async (req: Request, res: Response): Promise<void> =>
       return;
     }
 
-    const settings = loadSettings();
-    if (!settings.mcpServers[serverName]) {
+    const serverDao = getServerDao();
+    const server = await serverDao.findById(serverName);
+
+    if (!server) {
       res.status(404).json({
         success: false,
         message: 'Server not found',
@@ -449,14 +663,15 @@ export const toggleTool = async (req: Request, res: Response): Promise<void> =>
     }
 
     // Initialize tools config if it doesn't exist
-    if (!settings.mcpServers[serverName].tools) {
-      settings.mcpServers[serverName].tools = {};
-    }
+    const tools = server.tools || {};
 
-    // Set the tool's enabled state
-    settings.mcpServers[serverName].tools![toolName] = { enabled };
+    // Set the tool's enabled state (preserve existing description if any)
+    tools[toolName] = { ...tools[toolName], enabled };
 
-    if (!saveSettings(settings)) {
+    // Update via DAO (supports both file and database modes)
+    const result = await serverDao.updateTools(serverName, tools);
+
+    if (!result) {
       res.status(500).json({
         success: false,
         message: 'Failed to save settings',
@@ -503,8 +718,10 @@ export const updateToolDescription = async (req: Request, res: Response): Promis
       return;
     }
 
-    const settings = loadSettings();
-    if (!settings.mcpServers[serverName]) {
+    const serverDao = getServerDao();
+    const server = await serverDao.findById(serverName);
+
+    if (!server) {
       res.status(404).json({
         success: false,
         message: 'Server not found',
@@ -513,18 +730,18 @@ export const updateToolDescription = async (req: Request, res: Response): Promis
     }
 
     // Initialize tools config if it doesn't exist
-    if (!settings.mcpServers[serverName].tools) {
-      settings.mcpServers[serverName].tools = {};
-    }
+    const tools = server.tools || {};
 
     // Set the tool's description
-    if (!settings.mcpServers[serverName].tools![toolName]) {
-      settings.mcpServers[serverName].tools![toolName] = { enabled: true };
+    if (!tools[toolName]) {
+      tools[toolName] = { enabled: true };
     }
+    tools[toolName].description = description;
 
-    settings.mcpServers[serverName].tools![toolName].description = description;
+    // Update via DAO (supports both file and database modes)
+    const result = await serverDao.updateTools(serverName, tools);
 
-    if (!saveSettings(settings)) {
+    if (!result) {
       res.status(500).json({
         success: false,
         message: 'Failed to save settings',
@@ -939,8 +1156,10 @@ export const togglePrompt = async (req: Request, res: Response): Promise<void> =
       return;
     }
 
-    const settings = loadSettings();
-    if (!settings.mcpServers[serverName]) {
+    const serverDao = getServerDao();
+    const server = await serverDao.findById(serverName);
+
+    if (!server) {
       res.status(404).json({
         success: false,
         message: 'Server not found',
@@ -949,14 +1168,15 @@ export const togglePrompt = async (req: Request, res: Response): Promise<void> =
     }
 
     // Initialize prompts config if it doesn't exist
-    if (!settings.mcpServers[serverName].prompts) {
-      settings.mcpServers[serverName].prompts = {};
-    }
+    const prompts = server.prompts || {};
 
-    // Set the prompt's enabled state
-    settings.mcpServers[serverName].prompts![promptName] = { enabled };
+    // Set the prompt's enabled state (preserve existing description if any)
+    prompts[promptName] = { ...prompts[promptName], enabled };
 
-    if (!saveSettings(settings)) {
+    // Update via DAO (supports both file and database modes)
+    const result = await serverDao.updatePrompts(serverName, prompts);
+
+    if (!result) {
       res.status(500).json({
         success: false,
         message: 'Failed to save settings',
@@ -1003,8 +1223,10 @@ export const updatePromptDescription = async (req: Request, res: Response): Prom
       return;
     }
 
-    const settings = loadSettings();
-    if (!settings.mcpServers[serverName]) {
+    const serverDao = getServerDao();
+    const server = await serverDao.findById(serverName);
+
+    if (!server) {
       res.status(404).json({
         success: false,
         message: 'Server not found',
@@ -1013,18 +1235,18 @@ export const updatePromptDescription = async (req: Request, res: Response): Prom
     }
 
     // Initialize prompts config if it doesn't exist
-    if (!settings.mcpServers[serverName].prompts) {
-      settings.mcpServers[serverName].prompts = {};
-    }
+    const prompts = server.prompts || {};
 
     // Set the prompt's description
-    if (!settings.mcpServers[serverName].prompts![promptName]) {
-      settings.mcpServers[serverName].prompts![promptName] = { enabled: true };
+    if (!prompts[promptName]) {
+      prompts[promptName] = { enabled: true };
     }
+    prompts[promptName].description = description;
 
-    settings.mcpServers[serverName].prompts![promptName].description = description;
+    // Update via DAO (supports both file and database modes)
+    const result = await serverDao.updatePrompts(serverName, prompts);
 
-    if (!saveSettings(settings)) {
+    if (!result) {
       res.status(500).json({
         success: false,
         message: 'Failed to save settings',

src/dao/BearerKeyDao.ts

@@ -0,0 +1,122 @@
+import { randomUUID } from 'node:crypto';
+import { BearerKey } from '../types/index.js';
+import { JsonFileBaseDao } from './base/JsonFileBaseDao.js';
+
+/**
+ * DAO interface for bearer authentication keys
+ */
+export interface BearerKeyDao {
+  findAll(): Promise<BearerKey[]>;
+  findEnabled(): Promise<BearerKey[]>;
+  findById(id: string): Promise<BearerKey | undefined>;
+  findByToken(token: string): Promise<BearerKey | undefined>;
+  create(data: Omit<BearerKey, 'id'>): Promise<BearerKey>;
+  update(id: string, data: Partial<Omit<BearerKey, 'id'>>): Promise<BearerKey | null>;
+  delete(id: string): Promise<boolean>;
+}
+
+/**
+ * JSON file-based BearerKey DAO implementation
+ * Stores keys under the top-level `bearerKeys` field in mcp_settings.json
+ * and performs one-time migration from legacy routing.enableBearerAuth/bearerAuthKey.
+ */
+export class BearerKeyDaoImpl extends JsonFileBaseDao implements BearerKeyDao {
+  private async loadKeysWithMigration(): Promise<BearerKey[]> {
+    const settings = await this.loadSettings();
+
+    if (Array.isArray(settings.bearerKeys) && settings.bearerKeys.length > 0) {
+      return settings.bearerKeys;
+    }
+
+    // Perform one-time migration from legacy routing config if present
+    const routing = settings.systemConfig?.routing || {};
+    const enableBearerAuth: boolean = !!routing.enableBearerAuth;
+    const rawKey: string = (routing.bearerAuthKey || '').trim();
+
+    let migrated: BearerKey[] = [];
+
+    if (rawKey) {
+      // Cases 2 and 3 in migration rules
+      migrated = [
+        {
+          id: randomUUID(),
+          name: 'default',
+          token: rawKey,
+          enabled: enableBearerAuth,
+          accessType: 'all',
+          allowedGroups: [],
+          allowedServers: [],
+        },
+      ];
+    }
+
+    // Cases 1 and 4 both result in empty keys list
+    settings.bearerKeys = migrated;
+    await this.saveSettings(settings);
+
+    return migrated;
+  }
+
+  private async saveKeys(keys: BearerKey[]): Promise<void> {
+    const settings = await this.loadSettings();
+    settings.bearerKeys = keys;
+    await this.saveSettings(settings);
+  }
+
+  async findAll(): Promise<BearerKey[]> {
+    return await this.loadKeysWithMigration();
+  }
+
+  async findEnabled(): Promise<BearerKey[]> {
+    const keys = await this.loadKeysWithMigration();
+    return keys.filter((key) => key.enabled);
+  }
+
+  async findById(id: string): Promise<BearerKey | undefined> {
+    const keys = await this.loadKeysWithMigration();
+    return keys.find((key) => key.id === id);
+  }
+
+  async findByToken(token: string): Promise<BearerKey | undefined> {
+    const keys = await this.loadKeysWithMigration();
+    return keys.find((key) => key.token === token);
+  }
+
+  async create(data: Omit<BearerKey, 'id'>): Promise<BearerKey> {
+    const keys = await this.loadKeysWithMigration();
+    const newKey: BearerKey = {
+      id: randomUUID(),
+      ...data,
+    };
+    keys.push(newKey);
+    await this.saveKeys(keys);
+    return newKey;
+  }
+
+  async update(id: string, data: Partial<Omit<BearerKey, 'id'>>): Promise<BearerKey | null> {
+    const keys = await this.loadKeysWithMigration();
+    const index = keys.findIndex((key) => key.id === id);
+    if (index === -1) {
+      return null;
+    }
+
+    const updated: BearerKey = {
+      ...keys[index],
+      ...data,
+      id: keys[index].id,
+    };
+    keys[index] = updated;
+    await this.saveKeys(keys);
+    return updated;
+  }
+
+  async delete(id: string): Promise<boolean> {
+    const keys = await this.loadKeysWithMigration();
+    const next = keys.filter((key) => key.id !== id);
+    if (next.length === keys.length) {
+      return false;
+    }
+    await this.saveKeys(next);
+    return true;
+  }
+}

src/dao/BearerKeyDaoDbImpl.ts

@@ -0,0 +1,77 @@
+import { BearerKeyDao } from './BearerKeyDao.js';
+import { BearerKey as BearerKeyModel } from '../types/index.js';
+import { BearerKeyRepository } from '../db/repositories/BearerKeyRepository.js';
+
+/**
+ * Database-backed implementation of BearerKeyDao
+ */
+export class BearerKeyDaoDbImpl implements BearerKeyDao {
+  private repository: BearerKeyRepository;
+
+  constructor() {
+    this.repository = new BearerKeyRepository();
+  }
+
+  private toModel(entity: import('../db/entities/BearerKey.js').BearerKey): BearerKeyModel {
+    return {
+      id: entity.id,
+      name: entity.name,
+      token: entity.token,
+      enabled: entity.enabled,
+      accessType: entity.accessType,
+      allowedGroups: entity.allowedGroups ?? [],
+      allowedServers: entity.allowedServers ?? [],
+    };
+  }
+
+  async findAll(): Promise<BearerKeyModel[]> {
+    const entities = await this.repository.findAll();
+    return entities.map((e) => this.toModel(e));
+  }
+
+  async findEnabled(): Promise<BearerKeyModel[]> {
+    const entities = await this.repository.findAll();
+    return entities.filter((e) => e.enabled).map((e) => this.toModel(e));
+  }
+
+  async findById(id: string): Promise<BearerKeyModel | undefined> {
+    const entity = await this.repository.findById(id);
+    return entity ? this.toModel(entity) : undefined;
+  }
+
+  async findByToken(token: string): Promise<BearerKeyModel | undefined> {
+    const entity = await this.repository.findByToken(token);
+    return entity ? this.toModel(entity) : undefined;
+  }
+
+  async create(data: Omit<BearerKeyModel, 'id'>): Promise<BearerKeyModel> {
+    const entity = await this.repository.create({
+      name: data.name,
+      token: data.token,
+      enabled: data.enabled,
+      accessType: data.accessType,
+      allowedGroups: data.allowedGroups ?? [],
+      allowedServers: data.allowedServers ?? [],
+    } as any);
+    return this.toModel(entity as any);
+  }
+
+  async update(
+    id: string,
+    data: Partial<Omit<BearerKeyModel, 'id'>>,
+  ): Promise<BearerKeyModel | null> {
+    const entity = await this.repository.update(id, {
+      name: data.name,
+      token: data.token,
+      enabled: data.enabled,
+      accessType: data.accessType,
+      allowedGroups: data.allowedGroups,
+      allowedServers: data.allowedServers,
+    } as any);
+    return entity ? this.toModel(entity as any) : null;
+  }
+
+  async delete(id: string): Promise<boolean> {
+    return await this.repository.delete(id);
+  }
+}

src/dao/DaoFactory.ts

@@ -3,6 +3,9 @@ import { ServerDao, ServerDaoImpl } from './ServerDao.js';
 import { GroupDao, GroupDaoImpl } from './GroupDao.js';
 import { SystemConfigDao, SystemConfigDaoImpl } from './SystemConfigDao.js';
 import { UserConfigDao, UserConfigDaoImpl } from './UserConfigDao.js';
+import { OAuthClientDao, OAuthClientDaoImpl } from './OAuthClientDao.js';
+import { OAuthTokenDao, OAuthTokenDaoImpl } from './OAuthTokenDao.js';
+import { BearerKeyDao, BearerKeyDaoImpl } from './BearerKeyDao.js';
 
 /**
  * DAO Factory interface for creating DAO instances
@@ -13,6 +16,9 @@ export interface DaoFactory {
   getGroupDao(): GroupDao;
   getSystemConfigDao(): SystemConfigDao;
   getUserConfigDao(): UserConfigDao;
+  getOAuthClientDao(): OAuthClientDao;
+  getOAuthTokenDao(): OAuthTokenDao;
+  getBearerKeyDao(): BearerKeyDao;
 }
 
 /**
@@ -26,6 +32,9 @@ export class JsonFileDaoFactory implements DaoFactory {
   private groupDao: GroupDao | null = null;
   private systemConfigDao: SystemConfigDao | null = null;
   private userConfigDao: UserConfigDao | null = null;
+  private oauthClientDao: OAuthClientDao | null = null;
+  private oauthTokenDao: OAuthTokenDao | null = null;
+  private bearerKeyDao: BearerKeyDao | null = null;
 
   /**
    * Get singleton instance
@@ -76,6 +85,27 @@ export class JsonFileDaoFactory implements DaoFactory {
     return this.userConfigDao;
   }
 
+  getOAuthClientDao(): OAuthClientDao {
+    if (!this.oauthClientDao) {
+      this.oauthClientDao = new OAuthClientDaoImpl();
+    }
+    return this.oauthClientDao;
+  }
+
+  getOAuthTokenDao(): OAuthTokenDao {
+    if (!this.oauthTokenDao) {
+      this.oauthTokenDao = new OAuthTokenDaoImpl();
+    }
+    return this.oauthTokenDao;
+  }
+
+  getBearerKeyDao(): BearerKeyDao {
+    if (!this.bearerKeyDao) {
+      this.bearerKeyDao = new BearerKeyDaoImpl();
+    }
+    return this.bearerKeyDao;
+  }
+
   /**
    * Reset all cached DAO instances (useful for testing)
    */
@@ -85,6 +115,9 @@ export class JsonFileDaoFactory implements DaoFactory {
     this.groupDao = null;
     this.systemConfigDao = null;
     this.userConfigDao = null;
+    this.oauthClientDao = null;
+    this.oauthTokenDao = null;
+    this.bearerKeyDao = null;
   }
 }
 
@@ -149,3 +182,15 @@ export function getSystemConfigDao(): SystemConfigDao {
 export function getUserConfigDao(): UserConfigDao {
   return getDaoFactory().getUserConfigDao();
 }
+
+export function getOAuthClientDao(): OAuthClientDao {
+  return getDaoFactory().getOAuthClientDao();
+}
+
+export function getOAuthTokenDao(): OAuthTokenDao {
+  return getDaoFactory().getOAuthTokenDao();
+}
+
+export function getBearerKeyDao(): BearerKeyDao {
+  return getDaoFactory().getBearerKeyDao();
+}

src/dao/DatabaseDaoFactory.ts

@@ -1,9 +1,22 @@
-import { DaoFactory, UserDao, ServerDao, GroupDao, SystemConfigDao, UserConfigDao } from './index.js';
+import {
+  DaoFactory,
+  UserDao,
+  ServerDao,
+  GroupDao,
+  SystemConfigDao,
+  UserConfigDao,
+  OAuthClientDao,
+  OAuthTokenDao,
+  BearerKeyDao,
+} from './index.js';
 import { UserDaoDbImpl } from './UserDaoDbImpl.js';
 import { ServerDaoDbImpl } from './ServerDaoDbImpl.js';
 import { GroupDaoDbImpl } from './GroupDaoDbImpl.js';
 import { SystemConfigDaoDbImpl } from './SystemConfigDaoDbImpl.js';
 import { UserConfigDaoDbImpl } from './UserConfigDaoDbImpl.js';
+import { OAuthClientDaoDbImpl } from './OAuthClientDaoDbImpl.js';
+import { OAuthTokenDaoDbImpl } from './OAuthTokenDaoDbImpl.js';
+import { BearerKeyDaoDbImpl } from './BearerKeyDaoDbImpl.js';
 
 /**
  * Database-backed DAO factory implementation
@@ -16,6 +29,9 @@ export class DatabaseDaoFactory implements DaoFactory {
   private groupDao: GroupDao | null = null;
   private systemConfigDao: SystemConfigDao | null = null;
   private userConfigDao: UserConfigDao | null = null;
+  private oauthClientDao: OAuthClientDao | null = null;
+  private oauthTokenDao: OAuthTokenDao | null = null;
+  private bearerKeyDao: BearerKeyDao | null = null;
 
   /**
    * Get singleton instance
@@ -66,6 +82,27 @@ export class DatabaseDaoFactory implements DaoFactory {
     return this.userConfigDao!;
   }
 
+  getOAuthClientDao(): OAuthClientDao {
+    if (!this.oauthClientDao) {
+      this.oauthClientDao = new OAuthClientDaoDbImpl();
+    }
+    return this.oauthClientDao!;
+  }
+
+  getOAuthTokenDao(): OAuthTokenDao {
+    if (!this.oauthTokenDao) {
+      this.oauthTokenDao = new OAuthTokenDaoDbImpl();
+    }
+    return this.oauthTokenDao!;
+  }
+
+  getBearerKeyDao(): BearerKeyDao {
+    if (!this.bearerKeyDao) {
+      this.bearerKeyDao = new BearerKeyDaoDbImpl();
+    }
+    return this.bearerKeyDao!;
+  }
+
   /**
    * Reset all cached DAO instances (useful for testing)
    */
@@ -75,5 +112,8 @@ export class DatabaseDaoFactory implements DaoFactory {
     this.groupDao = null;
     this.systemConfigDao = null;
     this.userConfigDao = null;
+    this.oauthClientDao = null;
+    this.oauthTokenDao = null;
+    this.bearerKeyDao = null;
   }
 }

src/dao/OAuthClientDao.ts

@@ -0,0 +1,146 @@
+import { IOAuthClient } from '../types/index.js';
+import { BaseDao } from './base/BaseDao.js';
+import { JsonFileBaseDao } from './base/JsonFileBaseDao.js';
+
+/**
+ * OAuth Client DAO interface with OAuth client-specific operations
+ */
+export interface OAuthClientDao extends BaseDao<IOAuthClient, string> {
+  /**
+   * Find OAuth client by client ID
+   */
+  findByClientId(clientId: string): Promise<IOAuthClient | null>;
+
+  /**
+   * Find OAuth clients by owner
+   */
+  findByOwner(owner: string): Promise<IOAuthClient[]>;
+
+  /**
+   * Validate client credentials
+   */
+  validateCredentials(clientId: string, clientSecret?: string): Promise<boolean>;
+}
+
+/**
+ * JSON file-based OAuth Client DAO implementation
+ */
+export class OAuthClientDaoImpl extends JsonFileBaseDao implements OAuthClientDao {
+  protected async getAll(): Promise<IOAuthClient[]> {
+    const settings = await this.loadSettings();
+    return settings.oauthClients || [];
+  }
+
+  protected async saveAll(clients: IOAuthClient[]): Promise<void> {
+    const settings = await this.loadSettings();
+    settings.oauthClients = clients;
+    await this.saveSettings(settings);
+  }
+
+  protected getEntityId(client: IOAuthClient): string {
+    return client.clientId;
+  }
+
+  protected createEntity(_data: Omit<IOAuthClient, 'clientId'>): IOAuthClient {
+    throw new Error('clientId must be provided');
+  }
+
+  protected updateEntity(existing: IOAuthClient, updates: Partial<IOAuthClient>): IOAuthClient {
+    return {
+      ...existing,
+      ...updates,
+      clientId: existing.clientId, // clientId should not be updated
+    };
+  }
+
+  async findAll(): Promise<IOAuthClient[]> {
+    return this.getAll();
+  }
+
+  async findById(clientId: string): Promise<IOAuthClient | null> {
+    return this.findByClientId(clientId);
+  }
+
+  async findByClientId(clientId: string): Promise<IOAuthClient | null> {
+    const clients = await this.getAll();
+    return clients.find((client) => client.clientId === clientId) || null;
+  }
+
+  async findByOwner(owner: string): Promise<IOAuthClient[]> {
+    const clients = await this.getAll();
+    return clients.filter((client) => client.owner === owner);
+  }
+
+  async create(data: IOAuthClient): Promise<IOAuthClient> {
+    const clients = await this.getAll();
+
+    // Check if client already exists
+    if (clients.find((client) => client.clientId === data.clientId)) {
+      throw new Error(`OAuth client ${data.clientId} already exists`);
+    }
+
+    const newClient: IOAuthClient = {
+      ...data,
+      owner: data.owner || 'admin',
+    };
+
+    clients.push(newClient);
+    await this.saveAll(clients);
+
+    return newClient;
+  }
+
+  async update(clientId: string, updates: Partial<IOAuthClient>): Promise<IOAuthClient | null> {
+    const clients = await this.getAll();
+    const index = clients.findIndex((client) => client.clientId === clientId);
+
+    if (index === -1) {
+      return null;
+    }
+
+    // Don't allow clientId changes
+    const { clientId: _, ...allowedUpdates } = updates;
+    const updatedClient = this.updateEntity(clients[index], allowedUpdates);
+    clients[index] = updatedClient;
+
+    await this.saveAll(clients);
+    return updatedClient;
+  }
+
+  async delete(clientId: string): Promise<boolean> {
+    const clients = await this.getAll();
+    const index = clients.findIndex((client) => client.clientId === clientId);
+    if (index === -1) {
+      return false;
+    }
+
+    clients.splice(index, 1);
+    await this.saveAll(clients);
+    return true;
+  }
+
+  async exists(clientId: string): Promise<boolean> {
+    const client = await this.findByClientId(clientId);
+    return client !== null;
+  }
+
+  async count(): Promise<number> {
+    const clients = await this.getAll();
+    return clients.length;
+  }
+
+  async validateCredentials(clientId: string, clientSecret?: string): Promise<boolean> {
+    const client = await this.findByClientId(clientId);
+    if (!client) {
+      return false;
+    }
+
+    // If client has no secret (public client), accept if no secret provided
+    if (!client.clientSecret) {
+      return !clientSecret;
+    }
+
+    // If client has a secret, it must match
+    return client.clientSecret === clientSecret;
+  }
+}

src/dao/OAuthClientDaoDbImpl.ts

@@ -0,0 +1,109 @@
+import { OAuthClientDao } from './OAuthClientDao.js';
+import { OAuthClientRepository } from '../db/repositories/OAuthClientRepository.js';
+import { IOAuthClient } from '../types/index.js';
+
+/**
+ * Database-backed implementation of OAuthClientDao
+ */
+export class OAuthClientDaoDbImpl implements OAuthClientDao {
+  private repository: OAuthClientRepository;
+
+  constructor() {
+    this.repository = new OAuthClientRepository();
+  }
+
+  async findAll(): Promise<IOAuthClient[]> {
+    const clients = await this.repository.findAll();
+    return clients.map((c) => this.mapToOAuthClient(c));
+  }
+
+  async findById(clientId: string): Promise<IOAuthClient | null> {
+    const client = await this.repository.findByClientId(clientId);
+    return client ? this.mapToOAuthClient(client) : null;
+  }
+
+  async findByClientId(clientId: string): Promise<IOAuthClient | null> {
+    return this.findById(clientId);
+  }
+
+  async findByOwner(owner: string): Promise<IOAuthClient[]> {
+    const clients = await this.repository.findByOwner(owner);
+    return clients.map((c) => this.mapToOAuthClient(c));
+  }
+
+  async create(entity: IOAuthClient): Promise<IOAuthClient> {
+    const client = await this.repository.create({
+      clientId: entity.clientId,
+      clientSecret: entity.clientSecret,
+      name: entity.name,
+      redirectUris: entity.redirectUris,
+      grants: entity.grants,
+      scopes: entity.scopes,
+      owner: entity.owner || 'admin',
+      metadata: entity.metadata,
+    });
+    return this.mapToOAuthClient(client);
+  }
+
+  async update(clientId: string, entity: Partial<IOAuthClient>): Promise<IOAuthClient | null> {
+    const client = await this.repository.update(clientId, {
+      clientSecret: entity.clientSecret,
+      name: entity.name,
+      redirectUris: entity.redirectUris,
+      grants: entity.grants,
+      scopes: entity.scopes,
+      owner: entity.owner,
+      metadata: entity.metadata,
+    });
+    return client ? this.mapToOAuthClient(client) : null;
+  }
+
+  async delete(clientId: string): Promise<boolean> {
+    return await this.repository.delete(clientId);
+  }
+
+  async exists(clientId: string): Promise<boolean> {
+    return await this.repository.exists(clientId);
+  }
+
+  async count(): Promise<number> {
+    return await this.repository.count();
+  }
+
+  async validateCredentials(clientId: string, clientSecret?: string): Promise<boolean> {
+    const client = await this.findByClientId(clientId);
+    if (!client) {
+      return false;
+    }
+
+    // If client has no secret (public client), accept if no secret provided
+    if (!client.clientSecret) {
+      return !clientSecret;
+    }
+
+    // If client has a secret, it must match
+    return client.clientSecret === clientSecret;
+  }
+
+  private mapToOAuthClient(client: {
+    clientId: string;
+    clientSecret?: string;
+    name: string;
+    redirectUris: string[];
+    grants: string[];
+    scopes?: string[];
+    owner?: string;
+    metadata?: Record<string, any>;
+  }): IOAuthClient {
+    return {
+      clientId: client.clientId,
+      clientSecret: client.clientSecret,
+      name: client.name,
+      redirectUris: client.redirectUris,
+      grants: client.grants,
+      scopes: client.scopes,
+      owner: client.owner,
+      metadata: client.metadata as IOAuthClient['metadata'],
+    };
+  }
+}

src/dao/OAuthTokenDao.ts

@@ -0,0 +1,259 @@
+import { IOAuthToken } from '../types/index.js';
+import { BaseDao } from './base/BaseDao.js';
+import { JsonFileBaseDao } from './base/JsonFileBaseDao.js';
+
+/**
+ * OAuth Token DAO interface with OAuth token-specific operations
+ */
+export interface OAuthTokenDao extends BaseDao<IOAuthToken, string> {
+  /**
+   * Find token by access token
+   */
+  findByAccessToken(accessToken: string): Promise<IOAuthToken | null>;
+
+  /**
+   * Find token by refresh token
+   */
+  findByRefreshToken(refreshToken: string): Promise<IOAuthToken | null>;
+
+  /**
+   * Find tokens by client ID
+   */
+  findByClientId(clientId: string): Promise<IOAuthToken[]>;
+
+  /**
+   * Find tokens by username
+   */
+  findByUsername(username: string): Promise<IOAuthToken[]>;
+
+  /**
+   * Revoke token (delete by access token or refresh token)
+   */
+  revokeToken(token: string): Promise<boolean>;
+
+  /**
+   * Revoke all tokens for a user
+   */
+  revokeUserTokens(username: string): Promise<number>;
+
+  /**
+   * Revoke all tokens for a client
+   */
+  revokeClientTokens(clientId: string): Promise<number>;
+
+  /**
+   * Clean up expired tokens
+   */
+  cleanupExpired(): Promise<number>;
+
+  /**
+   * Check if access token is valid (exists and not expired)
+   */
+  isAccessTokenValid(accessToken: string): Promise<boolean>;
+
+  /**
+   * Check if refresh token is valid (exists and not expired)
+   */
+  isRefreshTokenValid(refreshToken: string): Promise<boolean>;
+}
+
+/**
+ * JSON file-based OAuth Token DAO implementation
+ */
+export class OAuthTokenDaoImpl extends JsonFileBaseDao implements OAuthTokenDao {
+  protected async getAll(): Promise<IOAuthToken[]> {
+    const settings = await this.loadSettings();
+    // Convert stored dates back to Date objects
+    return (settings.oauthTokens || []).map((token) => ({
+      ...token,
+      accessTokenExpiresAt: new Date(token.accessTokenExpiresAt),
+      refreshTokenExpiresAt: token.refreshTokenExpiresAt
+        ? new Date(token.refreshTokenExpiresAt)
+        : undefined,
+    }));
+  }
+
+  protected async saveAll(tokens: IOAuthToken[]): Promise<void> {
+    const settings = await this.loadSettings();
+    settings.oauthTokens = tokens;
+    await this.saveSettings(settings);
+  }
+
+  protected getEntityId(token: IOAuthToken): string {
+    return token.accessToken;
+  }
+
+  protected createEntity(_data: Omit<IOAuthToken, 'accessToken'>): IOAuthToken {
+    throw new Error('accessToken must be provided');
+  }
+
+  protected updateEntity(existing: IOAuthToken, updates: Partial<IOAuthToken>): IOAuthToken {
+    return {
+      ...existing,
+      ...updates,
+      accessToken: existing.accessToken, // accessToken should not be updated
+    };
+  }
+
+  async findAll(): Promise<IOAuthToken[]> {
+    return this.getAll();
+  }
+
+  async findById(accessToken: string): Promise<IOAuthToken | null> {
+    return this.findByAccessToken(accessToken);
+  }
+
+  async findByAccessToken(accessToken: string): Promise<IOAuthToken | null> {
+    const tokens = await this.getAll();
+    return tokens.find((token) => token.accessToken === accessToken) || null;
+  }
+
+  async findByRefreshToken(refreshToken: string): Promise<IOAuthToken | null> {
+    const tokens = await this.getAll();
+    return tokens.find((token) => token.refreshToken === refreshToken) || null;
+  }
+
+  async findByClientId(clientId: string): Promise<IOAuthToken[]> {
+    const tokens = await this.getAll();
+    return tokens.filter((token) => token.clientId === clientId);
+  }
+
+  async findByUsername(username: string): Promise<IOAuthToken[]> {
+    const tokens = await this.getAll();
+    return tokens.filter((token) => token.username === username);
+  }
+
+  async create(data: IOAuthToken): Promise<IOAuthToken> {
+    const tokens = await this.getAll();
+
+    // Remove any existing tokens with the same access token or refresh token
+    const filteredTokens = tokens.filter(
+      (t) => t.accessToken !== data.accessToken && t.refreshToken !== data.refreshToken,
+    );
+
+    const newToken: IOAuthToken = {
+      ...data,
+    };
+
+    filteredTokens.push(newToken);
+    await this.saveAll(filteredTokens);
+
+    return newToken;
+  }
+
+  async update(accessToken: string, updates: Partial<IOAuthToken>): Promise<IOAuthToken | null> {
+    const tokens = await this.getAll();
+    const index = tokens.findIndex((token) => token.accessToken === accessToken);
+
+    if (index === -1) {
+      return null;
+    }
+
+    // Don't allow accessToken changes
+    const { accessToken: _, ...allowedUpdates } = updates;
+    const updatedToken = this.updateEntity(tokens[index], allowedUpdates);
+    tokens[index] = updatedToken;
+
+    await this.saveAll(tokens);
+    return updatedToken;
+  }
+
+  async delete(accessToken: string): Promise<boolean> {
+    const tokens = await this.getAll();
+    const index = tokens.findIndex((token) => token.accessToken === accessToken);
+    if (index === -1) {
+      return false;
+    }
+
+    tokens.splice(index, 1);
+    await this.saveAll(tokens);
+    return true;
+  }
+
+  async exists(accessToken: string): Promise<boolean> {
+    const token = await this.findByAccessToken(accessToken);
+    return token !== null;
+  }
+
+  async count(): Promise<number> {
+    const tokens = await this.getAll();
+    return tokens.length;
+  }
+
+  async revokeToken(token: string): Promise<boolean> {
+    const tokens = await this.getAll();
+    const tokenData = tokens.find((t) => t.accessToken === token || t.refreshToken === token);
+
+    if (!tokenData) {
+      return false;
+    }
+
+    const filteredTokens = tokens.filter(
+      (t) => t.accessToken !== tokenData.accessToken && t.refreshToken !== tokenData.refreshToken,
+    );
+
+    await this.saveAll(filteredTokens);
+    return true;
+  }
+
+  async revokeUserTokens(username: string): Promise<number> {
+    const tokens = await this.getAll();
+    const userTokens = tokens.filter((token) => token.username === username);
+    const remainingTokens = tokens.filter((token) => token.username !== username);
+
+    await this.saveAll(remainingTokens);
+    return userTokens.length;
+  }
+
+  async revokeClientTokens(clientId: string): Promise<number> {
+    const tokens = await this.getAll();
+    const clientTokens = tokens.filter((token) => token.clientId === clientId);
+    const remainingTokens = tokens.filter((token) => token.clientId !== clientId);
+
+    await this.saveAll(remainingTokens);
+    return clientTokens.length;
+  }
+
+  async cleanupExpired(): Promise<number> {
+    const tokens = await this.getAll();
+    const now = new Date();
+
+    const validTokens = tokens.filter((token) => {
+      // Keep if access token is still valid
+      if (token.accessTokenExpiresAt > now) {
+        return true;
+      }
+      // Or if refresh token exists and is still valid
+      if (token.refreshToken && token.refreshTokenExpiresAt && token.refreshTokenExpiresAt > now) {
+        return true;
+      }
+      return false;
+    });
+
+    const expiredCount = tokens.length - validTokens.length;
+    if (expiredCount > 0) {
+      await this.saveAll(validTokens);
+    }
+
+    return expiredCount;
+  }
+
+  async isAccessTokenValid(accessToken: string): Promise<boolean> {
+    const token = await this.findByAccessToken(accessToken);
+    if (!token) {
+      return false;
+    }
+    return token.accessTokenExpiresAt > new Date();
+  }
+
+  async isRefreshTokenValid(refreshToken: string): Promise<boolean> {
+    const token = await this.findByRefreshToken(refreshToken);
+    if (!token) {
+      return false;
+    }
+    if (!token.refreshTokenExpiresAt) {
+      return true; // No expiration means always valid
+    }
+    return token.refreshTokenExpiresAt > new Date();
+  }
+}

src/dao/OAuthTokenDaoDbImpl.ts

@@ -0,0 +1,122 @@
+import { OAuthTokenDao } from './OAuthTokenDao.js';
+import { OAuthTokenRepository } from '../db/repositories/OAuthTokenRepository.js';
+import { IOAuthToken } from '../types/index.js';
+
+/**
+ * Database-backed implementation of OAuthTokenDao
+ */
+export class OAuthTokenDaoDbImpl implements OAuthTokenDao {
+  private repository: OAuthTokenRepository;
+
+  constructor() {
+    this.repository = new OAuthTokenRepository();
+  }
+
+  async findAll(): Promise<IOAuthToken[]> {
+    const tokens = await this.repository.findAll();
+    return tokens.map((t) => this.mapToOAuthToken(t));
+  }
+
+  async findById(accessToken: string): Promise<IOAuthToken | null> {
+    const token = await this.repository.findByAccessToken(accessToken);
+    return token ? this.mapToOAuthToken(token) : null;
+  }
+
+  async findByAccessToken(accessToken: string): Promise<IOAuthToken | null> {
+    return this.findById(accessToken);
+  }
+
+  async findByRefreshToken(refreshToken: string): Promise<IOAuthToken | null> {
+    const token = await this.repository.findByRefreshToken(refreshToken);
+    return token ? this.mapToOAuthToken(token) : null;
+  }
+
+  async findByClientId(clientId: string): Promise<IOAuthToken[]> {
+    const tokens = await this.repository.findByClientId(clientId);
+    return tokens.map((t) => this.mapToOAuthToken(t));
+  }
+
+  async findByUsername(username: string): Promise<IOAuthToken[]> {
+    const tokens = await this.repository.findByUsername(username);
+    return tokens.map((t) => this.mapToOAuthToken(t));
+  }
+
+  async create(entity: IOAuthToken): Promise<IOAuthToken> {
+    const token = await this.repository.create({
+      accessToken: entity.accessToken,
+      accessTokenExpiresAt: entity.accessTokenExpiresAt,
+      refreshToken: entity.refreshToken,
+      refreshTokenExpiresAt: entity.refreshTokenExpiresAt,
+      scope: entity.scope,
+      clientId: entity.clientId,
+      username: entity.username,
+    });
+    return this.mapToOAuthToken(token);
+  }
+
+  async update(accessToken: string, entity: Partial<IOAuthToken>): Promise<IOAuthToken | null> {
+    const token = await this.repository.update(accessToken, {
+      accessTokenExpiresAt: entity.accessTokenExpiresAt,
+      refreshToken: entity.refreshToken,
+      refreshTokenExpiresAt: entity.refreshTokenExpiresAt,
+      scope: entity.scope,
+    });
+    return token ? this.mapToOAuthToken(token) : null;
+  }
+
+  async delete(accessToken: string): Promise<boolean> {
+    return await this.repository.delete(accessToken);
+  }
+
+  async exists(accessToken: string): Promise<boolean> {
+    return await this.repository.exists(accessToken);
+  }
+
+  async count(): Promise<number> {
+    return await this.repository.count();
+  }
+
+  async revokeToken(token: string): Promise<boolean> {
+    return await this.repository.revokeToken(token);
+  }
+
+  async revokeUserTokens(username: string): Promise<number> {
+    return await this.repository.revokeUserTokens(username);
+  }
+
+  async revokeClientTokens(clientId: string): Promise<number> {
+    return await this.repository.revokeClientTokens(clientId);
+  }
+
+  async cleanupExpired(): Promise<number> {
+    return await this.repository.cleanupExpired();
+  }
+
+  async isAccessTokenValid(accessToken: string): Promise<boolean> {
+    return await this.repository.isAccessTokenValid(accessToken);
+  }
+
+  async isRefreshTokenValid(refreshToken: string): Promise<boolean> {
+    return await this.repository.isRefreshTokenValid(refreshToken);
+  }
+
+  private mapToOAuthToken(token: {
+    accessToken: string;
+    accessTokenExpiresAt: Date;
+    refreshToken?: string;
+    refreshTokenExpiresAt?: Date;
+    scope?: string;
+    clientId: string;
+    username: string;
+  }): IOAuthToken {
+    return {
+      accessToken: token.accessToken,
+      accessTokenExpiresAt: token.accessTokenExpiresAt,
+      refreshToken: token.refreshToken,
+      refreshTokenExpiresAt: token.refreshTokenExpiresAt,
+      scope: token.scope,
+      clientId: token.clientId,
+      username: token.username,
+    };
+  }
+}

src/dao/ServerDaoDbImpl.ts

@@ -38,6 +38,7 @@ export class ServerDaoDbImpl implements ServerDao {
       prompts: entity.prompts,
       options: entity.options,
       oauth: entity.oauth,
+      openapi: entity.openapi,
     });
     return this.mapToServerConfig(server);
   }
@@ -61,6 +62,7 @@ export class ServerDaoDbImpl implements ServerDao {
       prompts: entity.prompts,
       options: entity.options,
       oauth: entity.oauth,
+      openapi: entity.openapi,
     });
     return server ? this.mapToServerConfig(server) : null;
   }
@@ -129,6 +131,7 @@ export class ServerDaoDbImpl implements ServerDao {
     prompts?: Record<string, { enabled: boolean; description?: string }>;
     options?: Record<string, any>;
     oauth?: Record<string, any>;
+    openapi?: Record<string, any>;
   }): ServerConfigWithName {
     return {
       name: server.name,
@@ -146,6 +149,7 @@ export class ServerDaoDbImpl implements ServerDao {
       prompts: server.prompts,
       options: server.options,
       oauth: server.oauth,
+      openapi: server.openapi,
     };
   }
 }

src/dao/index.ts

@@ -6,6 +6,9 @@ export * from './ServerDao.js';
 export * from './GroupDao.js';
 export * from './SystemConfigDao.js';
 export * from './UserConfigDao.js';
+export * from './OAuthClientDao.js';
+export * from './OAuthTokenDao.js';
+export * from './BearerKeyDao.js';
 
 // Export database implementations
 export * from './UserDaoDbImpl.js';
@@ -13,6 +16,9 @@ export * from './ServerDaoDbImpl.js';
 export * from './GroupDaoDbImpl.js';
 export * from './SystemConfigDaoDbImpl.js';
 export * from './UserConfigDaoDbImpl.js';
+export * from './OAuthClientDaoDbImpl.js';
+export * from './OAuthTokenDaoDbImpl.js';
+export * from './BearerKeyDaoDbImpl.js';
 
 // Export the DAO factory and convenience functions
 export * from './DaoFactory.js';

src/db/entities/BearerKey.ts

@@ -0,0 +1,43 @@
+import {
+  Entity,
+  Column,
+  PrimaryGeneratedColumn,
+  CreateDateColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+/**
+ * Bearer authentication key entity
+ * Stores multiple bearer keys with per-key enable/disable and scoped access control
+ */
+@Entity({ name: 'bearer_keys' })
+export class BearerKey {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ type: 'varchar', length: 100 })
+  name: string;
+
+  @Column({ type: 'varchar', length: 512 })
+  token: string;
+
+  @Column({ type: 'boolean', default: true })
+  enabled: boolean;
+
+  @Column({ type: 'varchar', length: 20, default: 'all' })
+  accessType: 'all' | 'groups' | 'servers';
+
+  @Column({ type: 'simple-json', nullable: true })
+  allowedGroups?: string[];
+
+  @Column({ type: 'simple-json', nullable: true })
+  allowedServers?: string[];
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamp' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamp' })
+  updatedAt: Date;
+}
+
+export default BearerKey;

src/db/entities/OAuthClient.ts

@@ -0,0 +1,60 @@
+import {
+  Entity,
+  Column,
+  PrimaryGeneratedColumn,
+  CreateDateColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+/**
+ * OAuth Client entity for database storage
+ * Represents OAuth clients registered with MCPHub's authorization server
+ */
+@Entity({ name: 'oauth_clients' })
+export class OAuthClient {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ name: 'client_id', type: 'varchar', length: 255, unique: true })
+  clientId: string;
+
+  @Column({ name: 'client_secret', type: 'varchar', length: 255, nullable: true })
+  clientSecret?: string;
+
+  @Column({ type: 'varchar', length: 255 })
+  name: string;
+
+  @Column({ name: 'redirect_uris', type: 'simple-json' })
+  redirectUris: string[];
+
+  @Column({ type: 'simple-json' })
+  grants: string[];
+
+  @Column({ type: 'simple-json', nullable: true })
+  scopes?: string[];
+
+  @Column({ type: 'varchar', length: 255, nullable: true })
+  owner?: string;
+
+  @Column({ type: 'simple-json', nullable: true })
+  metadata?: {
+    application_type?: 'web' | 'native';
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+    contacts?: string[];
+    logo_uri?: string;
+    client_uri?: string;
+    policy_uri?: string;
+    tos_uri?: string;
+    jwks_uri?: string;
+    jwks?: object;
+  };
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamp' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamp' })
+  updatedAt: Date;
+}
+
+export default OAuthClient;

src/db/entities/OAuthToken.ts

@@ -0,0 +1,51 @@
+import {
+  Entity,
+  Column,
+  PrimaryGeneratedColumn,
+  CreateDateColumn,
+  UpdateDateColumn,
+  Index,
+} from 'typeorm';
+
+/**
+ * OAuth Token entity for database storage
+ * Represents OAuth tokens issued by MCPHub's authorization server
+ */
+@Entity({ name: 'oauth_tokens' })
+export class OAuthToken {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Index()
+  @Column({ name: 'access_token', type: 'varchar', length: 512, unique: true })
+  accessToken: string;
+
+  @Column({ name: 'access_token_expires_at', type: 'timestamp' })
+  accessTokenExpiresAt: Date;
+
+  @Index()
+  @Column({ name: 'refresh_token', type: 'varchar', length: 512, nullable: true, unique: true })
+  refreshToken?: string;
+
+  @Column({ name: 'refresh_token_expires_at', type: 'timestamp', nullable: true })
+  refreshTokenExpiresAt?: Date;
+
+  @Column({ type: 'varchar', length: 512, nullable: true })
+  scope?: string;
+
+  @Index()
+  @Column({ name: 'client_id', type: 'varchar', length: 255 })
+  clientId: string;
+
+  @Index()
+  @Column({ type: 'varchar', length: 255 })
+  username: string;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamp' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamp' })
+  updatedAt: Date;
+}
+
+export default OAuthToken;

src/db/entities/Server.ts

@@ -59,6 +59,9 @@ export class Server {
   @Column({ type: 'simple-json', nullable: true })
   oauth?: Record<string, any>;
 
+  @Column({ type: 'simple-json', nullable: true })
+  openapi?: Record<string, any>;
+
   @CreateDateColumn({ name: 'created_at', type: 'timestamp' })
   createdAt: Date;
 

src/db/entities/index.ts

@@ -4,9 +4,32 @@ import Server from './Server.js';
 import Group from './Group.js';
 import SystemConfig from './SystemConfig.js';
 import UserConfig from './UserConfig.js';
+import OAuthClient from './OAuthClient.js';
+import OAuthToken from './OAuthToken.js';
+import BearerKey from './BearerKey.js';
 
 // Export all entities
-export default [VectorEmbedding, User, Server, Group, SystemConfig, UserConfig];
+export default [
+  VectorEmbedding,
+  User,
+  Server,
+  Group,
+  SystemConfig,
+  UserConfig,
+  OAuthClient,
+  OAuthToken,
+  BearerKey,
+];
 
 // Export individual entities for direct use
-export { VectorEmbedding, User, Server, Group, SystemConfig, UserConfig };
+export {
+  VectorEmbedding,
+  User,
+  Server,
+  Group,
+  SystemConfig,
+  UserConfig,
+  OAuthClient,
+  OAuthToken,
+  BearerKey,
+};

src/db/repositories/BearerKeyRepository.ts

@@ -0,0 +1,75 @@
+import { Repository } from 'typeorm';
+import { BearerKey } from '../entities/BearerKey.js';
+import { getAppDataSource } from '../connection.js';
+
+/**
+ * Repository for BearerKey entity
+ */
+export class BearerKeyRepository {
+  private repository: Repository<BearerKey>;
+
+  constructor() {
+    this.repository = getAppDataSource().getRepository(BearerKey);
+  }
+
+  /**
+   * Find all bearer keys
+   */
+  async findAll(): Promise<BearerKey[]> {
+    return await this.repository.find({ order: { createdAt: 'ASC' } });
+  }
+
+  /**
+   * Count bearer keys
+   */
+  async count(): Promise<number> {
+    return await this.repository.count();
+  }
+
+  /**
+   * Find bearer key by id
+   */
+  async findById(id: string): Promise<BearerKey | null> {
+    return await this.repository.findOne({ where: { id } });
+  }
+
+  /**
+   * Find bearer key by token value
+   */
+  async findByToken(token: string): Promise<BearerKey | null> {
+    return await this.repository.findOne({ where: { token } });
+  }
+
+  /**
+   * Create a new bearer key
+   */
+  async create(data: Omit<BearerKey, 'id' | 'createdAt' | 'updatedAt'>): Promise<BearerKey> {
+    const entity = this.repository.create(data);
+    return await this.repository.save(entity);
+  }
+
+  /**
+   * Update an existing bearer key
+   */
+  async update(
+    id: string,
+    updates: Partial<Omit<BearerKey, 'id' | 'createdAt' | 'updatedAt'>>,
+  ): Promise<BearerKey | null> {
+    const existing = await this.findById(id);
+    if (!existing) {
+      return null;
+    }
+    const merged = this.repository.merge(existing, updates);
+    return await this.repository.save(merged);
+  }
+
+  /**
+   * Delete a bearer key
+   */
+  async delete(id: string): Promise<boolean> {
+    const result = await this.repository.delete({ id });
+    return (result.affected ?? 0) > 0;
+  }
+}
+
+export default BearerKeyRepository;

src/db/repositories/GroupRepository.ts

@@ -16,7 +16,7 @@ export class GroupRepository {
    * Find all groups
    */
   async findAll(): Promise<Group[]> {
-    return await this.repository.find();
+    return await this.repository.find({ order: { createdAt: 'ASC' } });
   }
 
   /**
@@ -88,7 +88,7 @@ export class GroupRepository {
    * Find groups by owner
    */
   async findByOwner(owner: string): Promise<Group[]> {
-    return await this.repository.find({ where: { owner } });
+    return await this.repository.find({ where: { owner }, order: { createdAt: 'ASC' } });
   }
 }
 

src/db/repositories/OAuthClientRepository.ts

@@ -0,0 +1,80 @@
+import { Repository } from 'typeorm';
+import { OAuthClient } from '../entities/OAuthClient.js';
+import { getAppDataSource } from '../connection.js';
+
+/**
+ * Repository for OAuthClient entity
+ */
+export class OAuthClientRepository {
+  private repository: Repository<OAuthClient>;
+
+  constructor() {
+    this.repository = getAppDataSource().getRepository(OAuthClient);
+  }
+
+  /**
+   * Find all OAuth clients
+   */
+  async findAll(): Promise<OAuthClient[]> {
+    return await this.repository.find();
+  }
+
+  /**
+   * Find OAuth client by client ID
+   */
+  async findByClientId(clientId: string): Promise<OAuthClient | null> {
+    return await this.repository.findOne({ where: { clientId } });
+  }
+
+  /**
+   * Find OAuth clients by owner
+   */
+  async findByOwner(owner: string): Promise<OAuthClient[]> {
+    return await this.repository.find({ where: { owner } });
+  }
+
+  /**
+   * Create a new OAuth client
+   */
+  async create(client: Omit<OAuthClient, 'id' | 'createdAt' | 'updatedAt'>): Promise<OAuthClient> {
+    const newClient = this.repository.create(client);
+    return await this.repository.save(newClient);
+  }
+
+  /**
+   * Update an existing OAuth client
+   */
+  async update(clientId: string, clientData: Partial<OAuthClient>): Promise<OAuthClient | null> {
+    const client = await this.findByClientId(clientId);
+    if (!client) {
+      return null;
+    }
+    const updated = this.repository.merge(client, clientData);
+    return await this.repository.save(updated);
+  }
+
+  /**
+   * Delete an OAuth client
+   */
+  async delete(clientId: string): Promise<boolean> {
+    const result = await this.repository.delete({ clientId });
+    return (result.affected ?? 0) > 0;
+  }
+
+  /**
+   * Check if OAuth client exists
+   */
+  async exists(clientId: string): Promise<boolean> {
+    const count = await this.repository.count({ where: { clientId } });
+    return count > 0;
+  }
+
+  /**
+   * Count total OAuth clients
+   */
+  async count(): Promise<number> {
+    return await this.repository.count();
+  }
+}
+
+export default OAuthClientRepository;

src/db/repositories/OAuthTokenRepository.ts

@@ -0,0 +1,183 @@
+import { Repository, MoreThan } from 'typeorm';
+import { OAuthToken } from '../entities/OAuthToken.js';
+import { getAppDataSource } from '../connection.js';
+
+/**
+ * Repository for OAuthToken entity
+ */
+export class OAuthTokenRepository {
+  private repository: Repository<OAuthToken>;
+
+  constructor() {
+    this.repository = getAppDataSource().getRepository(OAuthToken);
+  }
+
+  /**
+   * Find all OAuth tokens
+   */
+  async findAll(): Promise<OAuthToken[]> {
+    return await this.repository.find();
+  }
+
+  /**
+   * Find OAuth token by access token
+   */
+  async findByAccessToken(accessToken: string): Promise<OAuthToken | null> {
+    return await this.repository.findOne({ where: { accessToken } });
+  }
+
+  /**
+   * Find OAuth token by refresh token
+   */
+  async findByRefreshToken(refreshToken: string): Promise<OAuthToken | null> {
+    return await this.repository.findOne({ where: { refreshToken } });
+  }
+
+  /**
+   * Find OAuth tokens by client ID
+   */
+  async findByClientId(clientId: string): Promise<OAuthToken[]> {
+    return await this.repository.find({ where: { clientId } });
+  }
+
+  /**
+   * Find OAuth tokens by username
+   */
+  async findByUsername(username: string): Promise<OAuthToken[]> {
+    return await this.repository.find({ where: { username } });
+  }
+
+  /**
+   * Create a new OAuth token
+   */
+  async create(token: Omit<OAuthToken, 'id' | 'createdAt' | 'updatedAt'>): Promise<OAuthToken> {
+    // Remove any existing tokens with the same access token or refresh token
+    if (token.accessToken) {
+      await this.repository.delete({ accessToken: token.accessToken });
+    }
+    if (token.refreshToken) {
+      await this.repository.delete({ refreshToken: token.refreshToken });
+    }
+
+    const newToken = this.repository.create(token);
+    return await this.repository.save(newToken);
+  }
+
+  /**
+   * Update an existing OAuth token
+   */
+  async update(accessToken: string, tokenData: Partial<OAuthToken>): Promise<OAuthToken | null> {
+    const token = await this.findByAccessToken(accessToken);
+    if (!token) {
+      return null;
+    }
+    const updated = this.repository.merge(token, tokenData);
+    return await this.repository.save(updated);
+  }
+
+  /**
+   * Delete an OAuth token by access token
+   */
+  async delete(accessToken: string): Promise<boolean> {
+    const result = await this.repository.delete({ accessToken });
+    return (result.affected ?? 0) > 0;
+  }
+
+  /**
+   * Check if OAuth token exists by access token
+   */
+  async exists(accessToken: string): Promise<boolean> {
+    const count = await this.repository.count({ where: { accessToken } });
+    return count > 0;
+  }
+
+  /**
+   * Count total OAuth tokens
+   */
+  async count(): Promise<number> {
+    return await this.repository.count();
+  }
+
+  /**
+   * Revoke token by access token or refresh token
+   */
+  async revokeToken(token: string): Promise<boolean> {
+    // Try to find by access token first
+    let tokenEntity = await this.findByAccessToken(token);
+    if (!tokenEntity) {
+      // Try to find by refresh token
+      tokenEntity = await this.findByRefreshToken(token);
+    }
+
+    if (!tokenEntity) {
+      return false;
+    }
+
+    const result = await this.repository.delete({ id: tokenEntity.id });
+    return (result.affected ?? 0) > 0;
+  }
+
+  /**
+   * Revoke all tokens for a user
+   */
+  async revokeUserTokens(username: string): Promise<number> {
+    const result = await this.repository.delete({ username });
+    return result.affected ?? 0;
+  }
+
+  /**
+   * Revoke all tokens for a client
+   */
+  async revokeClientTokens(clientId: string): Promise<number> {
+    const result = await this.repository.delete({ clientId });
+    return result.affected ?? 0;
+  }
+
+  /**
+   * Clean up expired tokens
+   */
+  async cleanupExpired(): Promise<number> {
+    const now = new Date();
+
+    // Delete tokens where both access token and refresh token are expired
+    // (or refresh token doesn't exist)
+    const result = await this.repository
+      .createQueryBuilder()
+      .delete()
+      .from(OAuthToken)
+      .where('access_token_expires_at < :now', { now })
+      .andWhere('(refresh_token_expires_at IS NULL OR refresh_token_expires_at < :now)', { now })
+      .execute();
+
+    return result.affected ?? 0;
+  }
+
+  /**
+   * Check if access token is valid (exists and not expired)
+   */
+  async isAccessTokenValid(accessToken: string): Promise<boolean> {
+    const count = await this.repository.count({
+      where: {
+        accessToken,
+        accessTokenExpiresAt: MoreThan(new Date()),
+      },
+    });
+    return count > 0;
+  }
+
+  /**
+   * Check if refresh token is valid (exists and not expired)
+   */
+  async isRefreshTokenValid(refreshToken: string): Promise<boolean> {
+    const token = await this.findByRefreshToken(refreshToken);
+    if (!token) {
+      return false;
+    }
+    if (!token.refreshTokenExpiresAt) {
+      return true; // No expiration means always valid
+    }
+    return token.refreshTokenExpiresAt > new Date();
+  }
+}
+
+export default OAuthTokenRepository;

src/db/repositories/ServerRepository.ts

@@ -16,7 +16,7 @@ export class ServerRepository {
    * Find all servers
    */
   async findAll(): Promise<Server[]> {
-    return await this.repository.find();
+    return await this.repository.find({ order: { createdAt: 'ASC' } });
   }
 
   /**
@@ -73,14 +73,14 @@ export class ServerRepository {
    * Find servers by owner
    */
   async findByOwner(owner: string): Promise<Server[]> {
-    return await this.repository.find({ where: { owner } });
+    return await this.repository.find({ where: { owner }, order: { createdAt: 'ASC' } });
   }
 
   /**
    * Find enabled servers
    */
   async findEnabled(): Promise<Server[]> {
-    return await this.repository.find({ where: { enabled: true } });
+    return await this.repository.find({ where: { enabled: true }, order: { createdAt: 'ASC' } });
   }
 
   /**

src/db/repositories/UserRepository.ts

@@ -16,7 +16,7 @@ export class UserRepository {
    * Find all users
    */
   async findAll(): Promise<User[]> {
-    return await this.repository.find();
+    return await this.repository.find({ order: { createdAt: 'ASC' } });
   }
 
   /**
@@ -73,7 +73,7 @@ export class UserRepository {
    * Find all admin users
    */
   async findAdmins(): Promise<User[]> {
-    return await this.repository.find({ where: { isAdmin: true } });
+    return await this.repository.find({ where: { isAdmin: true }, order: { createdAt: 'ASC' } });
   }
 }
 

src/db/repositories/index.ts

@@ -4,6 +4,9 @@ import { ServerRepository } from './ServerRepository.js';
 import { GroupRepository } from './GroupRepository.js';
 import { SystemConfigRepository } from './SystemConfigRepository.js';
 import { UserConfigRepository } from './UserConfigRepository.js';
+import { OAuthClientRepository } from './OAuthClientRepository.js';
+import { OAuthTokenRepository } from './OAuthTokenRepository.js';
+import { BearerKeyRepository } from './BearerKeyRepository.js';
 
 // Export all repositories
 export {
@@ -13,4 +16,7 @@ export {
   GroupRepository,
   SystemConfigRepository,
   UserConfigRepository,
+  OAuthClientRepository,
+  OAuthTokenRepository,
+  BearerKeyRepository,
 };

src/middlewares/auth.ts

@@ -5,9 +5,15 @@ import defaultConfig from '../config/index.js';
 import { JWT_SECRET } from '../config/jwt.js';
 import { getToken } from '../models/OAuth.js';
 import { isOAuthServerEnabled } from '../services/oauthServerService.js';
+import { getBearerKeyDao } from '../dao/index.js';
+import { BearerKey } from '../types/index.js';
 
-const validateBearerAuth = (req: Request, routingConfig: any): boolean => {
-  if (!routingConfig.enableBearerAuth) {
+const validateBearerAuth = async (req: Request): Promise<boolean> => {
+  const bearerKeyDao = getBearerKeyDao();
+  const enabledKeys = await bearerKeyDao.findEnabled();
+
+  // If there are no enabled keys, bearer auth via static keys is disabled
+  if (enabledKeys.length === 0) {
     return false;
   }
 
@@ -16,7 +22,21 @@ const validateBearerAuth = (req: Request, routingConfig: any): boolean => {
     return false;
   }
 
-  return authHeader.substring(7) === routingConfig.bearerAuthKey;
+  const token = authHeader.substring(7).trim();
+  if (!token) {
+    return false;
+  }
+
+  const matchingKey: BearerKey | undefined = enabledKeys.find((key) => key.token === token);
+  if (!matchingKey) {
+    console.warn('Bearer auth failed: token did not match any configured bearer key');
+    return false;
+  }
+
+  console.log(
+    `Bearer auth succeeded with key id=${matchingKey.id}, name=${matchingKey.name}, accessType=${matchingKey.accessType}`,
+  );
+  return true;
 };
 
 const readonlyAllowPaths = ['/tools/call/'];
@@ -47,8 +67,6 @@ export const auth = async (req: Request, res: Response, next: NextFunction): Pro
   const routingConfig = loadSettings().systemConfig?.routing || {
     enableGlobalRoute: true,
     enableGroupNameRoute: true,
-    enableBearerAuth: false,
-    bearerAuthKey: '',
     skipAuth: false,
   };
 
@@ -57,8 +75,8 @@ export const auth = async (req: Request, res: Response, next: NextFunction): Pro
     return;
   }
 
-  // Check if bearer auth is enabled and validate it
-  if (validateBearerAuth(req, routingConfig)) {
+  // Check if bearer auth via configured keys can validate this request
+  if (await validateBearerAuth(req)) {
     next();
     return;
   }
@@ -67,7 +85,7 @@ export const auth = async (req: Request, res: Response, next: NextFunction): Pro
   const authHeader = req.headers.authorization;
   if (authHeader && authHeader.startsWith('Bearer ') && isOAuthServerEnabled()) {
     const accessToken = authHeader.substring(7);
-    const oauthToken = getToken(accessToken);
+    const oauthToken = await getToken(accessToken);
 
     if (oauthToken && oauthToken.accessToken === accessToken) {
       // Valid OAuth token - look up user to get admin status

src/models/OAuth.ts

@@ -1,112 +1,89 @@
 import crypto from 'crypto';
-import { loadSettings, saveSettings } from '../config/index.js';
+import { getOAuthClientDao, getOAuthTokenDao } from '../dao/index.js';
 import { IOAuthClient, IOAuthAuthorizationCode, IOAuthToken } from '../types/index.js';
 
-// In-memory storage for authorization codes and tokens
-// Authorization codes are short-lived and kept in memory only.
-// Tokens are mirrored to settings (mcp_settings.json) for persistence.
+// In-memory storage for authorization codes (short-lived, no persistence needed)
 const authorizationCodes = new Map<string, IOAuthAuthorizationCode>();
-const tokens = new Map<string, IOAuthToken>();
 
-// Initialize token store from settings on first import
-(() => {
+// In-memory cache for tokens (also persisted via DAO)
+const tokensCache = new Map<string, IOAuthToken>();
+
+// Flag to track if we've initialized from DAO
+let initialized = false;
+
+/**
+ * Initialize token cache from DAO (async)
+ */
+const initializeTokenCache = async (): Promise<void> => {
+  if (initialized) return;
+  initialized = true;
+
   try {
-    const settings = loadSettings();
-    if (Array.isArray(settings.oauthTokens)) {
-      for (const stored of settings.oauthTokens) {
-        const token: IOAuthToken = {
-          ...stored,
-          accessTokenExpiresAt: new Date(stored.accessTokenExpiresAt),
-          refreshTokenExpiresAt: stored.refreshTokenExpiresAt
-            ? new Date(stored.refreshTokenExpiresAt)
-            : undefined,
-        };
-        tokens.set(token.accessToken, token);
-        if (token.refreshToken) {
-          tokens.set(token.refreshToken, token);
-        }
+    const tokenDao = getOAuthTokenDao();
+    const allTokens = await tokenDao.findAll();
+    for (const token of allTokens) {
+      tokensCache.set(token.accessToken, token);
+      if (token.refreshToken) {
+        tokensCache.set(token.refreshToken, token);
       }
     }
   } catch (error) {
-    console.error('Failed to initialize OAuth tokens from settings:', error);
+    console.error('Failed to initialize OAuth tokens from DAO:', error);
   }
-})();
+};
+
+// Initialize on module load (fire and forget for backward compatibility)
+initializeTokenCache().catch(console.error);
 
 /**
  * Get all OAuth clients from configuration
  */
-export const getOAuthClients = (): IOAuthClient[] => {
-  const settings = loadSettings();
-  return settings.oauthClients || [];
+export const getOAuthClients = async (): Promise<IOAuthClient[]> => {
+  const clientDao = getOAuthClientDao();
+  return clientDao.findAll();
 };
 
 /**
  * Find OAuth client by client ID
  */
-export const findOAuthClientById = (clientId: string): IOAuthClient | undefined => {
-  const clients = getOAuthClients();
-  return clients.find((c) => c.clientId === clientId);
+export const findOAuthClientById = async (clientId: string): Promise<IOAuthClient | undefined> => {
+  const clientDao = getOAuthClientDao();
+  const client = await clientDao.findByClientId(clientId);
+  return client || undefined;
 };
 
 /**
  * Create a new OAuth client
  */
-export const createOAuthClient = (client: IOAuthClient): IOAuthClient => {
-  const settings = loadSettings();
-  if (!settings.oauthClients) {
-    settings.oauthClients = [];
-  }
+export const createOAuthClient = async (client: IOAuthClient): Promise<IOAuthClient> => {
+  const clientDao = getOAuthClientDao();
 
   // Check if client already exists
-  const existing = settings.oauthClients.find((c) => c.clientId === client.clientId);
+  const existing = await clientDao.findByClientId(client.clientId);
   if (existing) {
     throw new Error(`OAuth client with ID ${client.clientId} already exists`);
   }
 
-  settings.oauthClients.push(client);
-  saveSettings(settings);
-  return client;
+  return clientDao.create(client);
 };
 
 /**
  * Update an existing OAuth client
  */
-export const updateOAuthClient = (
+export const updateOAuthClient = async (
   clientId: string,
   updates: Partial<IOAuthClient>,
-): IOAuthClient | null => {
-  const settings = loadSettings();
-  if (!settings.oauthClients) {
-    return null;
-  }
-
-  const index = settings.oauthClients.findIndex((c) => c.clientId === clientId);
-  if (index === -1) {
-    return null;
-  }
-
-  settings.oauthClients[index] = { ...settings.oauthClients[index], ...updates };
-  saveSettings(settings);
-  return settings.oauthClients[index];
+): Promise<IOAuthClient | null> => {
+  const clientDao = getOAuthClientDao();
+  return clientDao.update(clientId, updates);
 };
 
 /**
  * Delete an OAuth client
  */
-export const deleteOAuthClient = (clientId: string): boolean => {
-  const settings = loadSettings();
-  if (!settings.oauthClients) {
-    return false;
-  }
-
-  const index = settings.oauthClients.findIndex((c) => c.clientId === clientId);
-  if (index === -1) {
-    return false;
-  }
-
-  settings.oauthClients.splice(index, 1);
-  saveSettings(settings);
-  return true;
+export const deleteOAuthClient = async (clientId: string): Promise<boolean> => {
+  const clientDao = getOAuthClientDao();
+  return clientDao.delete(clientId);
 };
 
 /**
@@ -163,11 +140,11 @@ export const revokeAuthorizationCode = (code: string): void => {
 /**
  * Save access token and optionally refresh token
  */
-export const saveToken = (
+export const saveToken = async (
   tokenData: Omit<IOAuthToken, 'accessToken' | 'accessTokenExpiresAt'>,
   accessTokenLifetime: number = 3600,
   refreshTokenLifetime?: number,
-): IOAuthToken => {
+): Promise<IOAuthToken> => {
   const accessToken = generateToken();
   const accessTokenExpiresAt = new Date(Date.now() + accessTokenLifetime * 1000);
 
@@ -187,30 +164,18 @@ export const saveToken = (
     ...tokenData,
   };
 
-  tokens.set(accessToken, token);
+  // Update cache
+  tokensCache.set(accessToken, token);
   if (refreshToken) {
-    tokens.set(refreshToken, token);
+    tokensCache.set(refreshToken, token);
   }
 
-  // Persist tokens to settings
+  // Persist to DAO
   try {
-    const settings = loadSettings();
-    const existing = settings.oauthTokens || [];
-    const filtered = existing.filter(
-      (t) => t.accessToken !== token.accessToken && t.refreshToken !== token.refreshToken,
-    );
-    const updated = [
-      ...filtered,
-      {
-        ...token,
-        accessTokenExpiresAt: token.accessTokenExpiresAt,
-        refreshTokenExpiresAt: token.refreshTokenExpiresAt,
-      },
-    ];
-    settings.oauthTokens = updated;
-    saveSettings(settings);
+    const tokenDao = getOAuthTokenDao();
+    await tokenDao.create(token);
   } catch (error) {
-    console.error('Failed to persist OAuth token to settings:', error);
+    console.error('Failed to persist OAuth token to DAO:', error);
   }
 
   return token;
@@ -219,8 +184,27 @@ export const saveToken = (
 /**
  * Get token by access token or refresh token
  */
-export const getToken = (token: string): IOAuthToken | undefined => {
-  const tokenData = tokens.get(token);
+export const getToken = async (token: string): Promise<IOAuthToken | undefined> => {
+  // First check cache
+  let tokenData = tokensCache.get(token);
+
+  // If not in cache, try DAO
+  if (!tokenData) {
+    const tokenDao = getOAuthTokenDao();
+    tokenData =
+      (await tokenDao.findByAccessToken(token)) ||
+      (await tokenDao.findByRefreshToken(token)) ||
+      undefined;
+
+    // Update cache if found
+    if (tokenData) {
+      tokensCache.set(tokenData.accessToken, tokenData);
+      if (tokenData.refreshToken) {
+        tokensCache.set(tokenData.refreshToken, tokenData);
+      }
+    }
+  }
+
   if (!tokenData) {
     return undefined;
   }
@@ -245,34 +229,28 @@ export const getToken = (token: string): IOAuthToken | undefined => {
 /**
  * Revoke token (both access and refresh tokens)
  */
-export const revokeToken = (token: string): void => {
-  const tokenData = tokens.get(token);
+export const revokeToken = async (token: string): Promise<void> => {
+  const tokenData = tokensCache.get(token);
   if (tokenData) {
-    tokens.delete(tokenData.accessToken);
+    tokensCache.delete(tokenData.accessToken);
     if (tokenData.refreshToken) {
-      tokens.delete(tokenData.refreshToken);
+      tokensCache.delete(tokenData.refreshToken);
     }
+  }
 
-    // Also remove from persisted settings
-    try {
-      const settings = loadSettings();
-      if (Array.isArray(settings.oauthTokens)) {
-        settings.oauthTokens = settings.oauthTokens.filter(
-          (t) =>
-            t.accessToken !== tokenData.accessToken && t.refreshToken !== tokenData.refreshToken,
-        );
-        saveSettings(settings);
-      }
-    } catch (error) {
-      console.error('Failed to remove OAuth token from settings:', error);
-    }
+  // Also remove from DAO
+  try {
+    const tokenDao = getOAuthTokenDao();
+    await tokenDao.revokeToken(token);
+  } catch (error) {
+    console.error('Failed to remove OAuth token from DAO:', error);
   }
 };
 
 /**
  * Clean up expired codes and tokens (should be called periodically)
  */
-export const cleanupExpired = (): void => {
+export const cleanupExpired = async (): Promise<void> => {
   const now = new Date();
 
   // Clean up expired authorization codes
@@ -282,9 +260,9 @@ export const cleanupExpired = (): void => {
     }
   }
 
-  // Clean up expired tokens
+  // Clean up expired tokens from cache
   const processedTokens = new Set<string>();
-  for (const [_key, token] of tokens.entries()) {
+  for (const [_key, token] of tokensCache.entries()) {
     // Skip if we've already processed this token
     if (processedTokens.has(token.accessToken)) {
       continue;
@@ -294,35 +272,19 @@ export const cleanupExpired = (): void => {
     const accessExpired = token.accessTokenExpiresAt < now;
     const refreshExpired = token.refreshTokenExpiresAt && token.refreshTokenExpiresAt < now;
 
-    // If both are expired, remove the token
+    // If both are expired, remove from cache
     if (accessExpired && (!token.refreshToken || refreshExpired)) {
-      tokens.delete(token.accessToken);
+      tokensCache.delete(token.accessToken);
       if (token.refreshToken) {
-        tokens.delete(token.refreshToken);
+        tokensCache.delete(token.refreshToken);
       }
     }
   }
 
-  // Sync persisted tokens: keep only non-expired ones
+  // Clean up expired tokens from DAO
   try {
-    const settings = loadSettings();
-    if (Array.isArray(settings.oauthTokens)) {
-      const validTokens: IOAuthToken[] = [];
-      for (const stored of settings.oauthTokens) {
-        const accessExpiresAt = new Date(stored.accessTokenExpiresAt);
-        const refreshExpiresAt = stored.refreshTokenExpiresAt
-          ? new Date(stored.refreshTokenExpiresAt)
-          : undefined;
-        const accessExpired = accessExpiresAt < now;
-        const refreshExpired = refreshExpiresAt && refreshExpiresAt < now;
-
-        if (!accessExpired || (stored.refreshToken && !refreshExpired)) {
-          validTokens.push(stored);
-        }
-      }
-      settings.oauthTokens = validTokens;
-      saveSettings(settings);
-    }
+    const tokenDao = getOAuthTokenDao();
+    await tokenDao.cleanupExpired();
   } catch (error) {
     console.error('Failed to cleanup persisted OAuth tokens:', error);
   }
@@ -331,7 +293,12 @@ export const cleanupExpired = (): void => {
 // Run cleanup every 5 minutes in production
 let cleanupIntervalId: NodeJS.Timeout | null = null;
 if (process.env.NODE_ENV !== 'test') {
-  cleanupIntervalId = setInterval(cleanupExpired, 5 * 60 * 1000);
+  cleanupIntervalId = setInterval(
+    () => {
+      cleanupExpired().catch(console.error);
+    },
+    5 * 60 * 1000,
+  );
   // Allow the interval to not keep the process alive
   cleanupIntervalId.unref();
 }

src/routes/index.ts

@@ -6,9 +6,11 @@ import {
   getAllSettings,
   getServerConfig,
   createServer,
+  batchCreateServers,
   updateServer,
   deleteServer,
   toggleServer,
+  reloadServer,
   toggleTool,
   updateToolDescription,
   togglePrompt,
@@ -19,6 +21,7 @@ import {
   getGroups,
   getGroup,
   createNewGroup,
+  batchCreateGroups,
   updateExistingGroup,
   deleteExistingGroup,
   addServerToExistingGroup,
@@ -103,6 +106,12 @@ import {
   updateClientConfiguration,
   deleteClientRegistration,
 } from '../controllers/oauthDynamicRegistrationController.js';
+import {
+  getBearerKeys,
+  createBearerKey,
+  updateBearerKey,
+  deleteBearerKey,
+} from '../controllers/bearerKeyController.js';
 import { auth } from '../middlewares/auth.js';
 
 const router = express.Router();
@@ -133,9 +142,11 @@ export const initRoutes = (app: express.Application): void => {
   router.get('/servers/:name', getServerConfig);
   router.get('/settings', getAllSettings);
   router.post('/servers', createServer);
+  router.post('/servers/batch', batchCreateServers);
   router.put('/servers/:name', updateServer);
   router.delete('/servers/:name', deleteServer);
   router.post('/servers/:name/toggle', toggleServer);
+  router.post('/servers/:name/reload', reloadServer);
   router.post('/servers/:serverName/tools/:toolName/toggle', toggleTool);
   router.put('/servers/:serverName/tools/:toolName/description', updateToolDescription);
   router.post('/servers/:serverName/prompts/:promptName/toggle', togglePrompt);
@@ -146,6 +157,7 @@ export const initRoutes = (app: express.Application): void => {
   router.get('/groups', getGroups);
   router.get('/groups/:id', getGroup);
   router.post('/groups', createNewGroup);
+  router.post('/groups/batch', batchCreateGroups);
   router.put('/groups/:id', updateExistingGroup);
   router.delete('/groups/:id', deleteExistingGroup);
   router.post('/groups/:id/servers', addServerToExistingGroup);
@@ -181,6 +193,12 @@ export const initRoutes = (app: express.Application): void => {
   router.delete('/oauth/clients/:clientId', deleteClient);
   router.post('/oauth/clients/:clientId/regenerate-secret', regenerateSecret);
 
+  // Bearer authentication key management (admin only)
+  router.get('/auth/keys', getBearerKeys);
+  router.post('/auth/keys', createBearerKey);
+  router.put('/auth/keys/:id', updateBearerKey);
+  router.delete('/auth/keys/:id', deleteBearerKey);
+
   // Tool management routes
   router.post('/tools/call/:server', callTool);
 

src/services/groupService.ts

@@ -29,9 +29,9 @@ export const getGroupByIdOrName = async (key: string): Promise<IGroup | undefine
   const systemConfigDao = getSystemConfigDao();
 
   const systemConfig = await systemConfigDao.get();
-  const routingConfig = systemConfig?.routing || {
-    enableGlobalRoute: true,
-    enableGroupNameRoute: true,
+  const routingConfig = {
+    enableGlobalRoute: systemConfig?.routing?.enableGlobalRoute ?? true,
+    enableGroupNameRoute: systemConfig?.routing?.enableGroupNameRoute ?? true,
   };
 
   const groups = await getAllGroups();

src/services/mcpOAuthProvider.ts

@@ -26,6 +26,7 @@ import {
   getRegisteredClient,
   removeRegisteredClient,
   fetchScopesFromServer,
+  refreshAccessToken,
 } from './oauthClientRegistration.js';
 import {
   clearOAuthData,
@@ -40,6 +41,9 @@ import {
 // Import getServerByName to access ServerInfo
 import { getServerByName } from './mcpService.js';
 
+// Refresh tokens one minute before expiry to avoid sending requests with stale credentials.
+const ACCESS_TOKEN_REFRESH_THRESHOLD_MS = 60_000;
+
 /**
  * MCPHub OAuth Provider for server-side OAuth flows
  *
@@ -292,21 +296,8 @@ export class MCPHubOAuthProvider implements OAuthClientProvider {
   /**
    * Get stored OAuth tokens
    */
-  tokens(): OAuthTokens | undefined {
-    // Use cached config only (tokens are updated via saveTokens which updates cache)
-    const serverConfig = this.serverConfig;
-
-    if (!serverConfig?.oauth?.accessToken) {
-      return undefined;
-    }
-
-    return {
-      access_token: serverConfig.oauth.accessToken,
-      token_type: 'Bearer',
-      refresh_token: serverConfig.oauth.refreshToken,
-      // Note: expires_in is not typically stored, only the token itself
-      // The SDK will handle token refresh when needed
-    };
+  async tokens(): Promise<OAuthTokens | undefined> {
+    return this.getValidTokens();
   }
 
   /**
@@ -330,6 +321,7 @@ export class MCPHubOAuthProvider implements OAuthClientProvider {
     const updatedConfig = await persistTokens(this.serverName, {
       accessToken: tokens.access_token,
       refreshToken: refreshTokenProvided ? (tokens.refresh_token ?? null) : undefined,
+      expiresIn: tokens.expires_in,
       clearPendingAuthorization: hadPending,
     });
 
@@ -348,6 +340,89 @@ export class MCPHubOAuthProvider implements OAuthClientProvider {
     console.log(`Saved OAuth tokens for server: ${this.serverName}`);
   }
 
+  /**
+   * Returns tokens refreshed when expired or close to expiring.
+   * When an access token already exists and refresh fails, the existing token is returned.
+   */
+  private async getValidTokens(): Promise<OAuthTokens | undefined> {
+    const oauth = this.serverConfig.oauth;
+    if (!oauth) {
+      return undefined;
+    }
+
+    if (!oauth.accessToken) {
+      return this.refreshAccessTokenIfNeeded(oauth.refreshToken);
+    }
+
+    // Refresh if token is expired or about to expire
+    const expiresAt = this.getAccessTokenExpiryMs(oauth);
+    const now = Date.now();
+    if (expiresAt && expiresAt - now <= ACCESS_TOKEN_REFRESH_THRESHOLD_MS) {
+      const refreshed = await this.refreshAccessTokenIfNeeded(oauth.refreshToken);
+      if (refreshed) {
+        return refreshed;
+      }
+    }
+
+    return {
+      access_token: oauth.accessToken,
+      token_type: 'Bearer',
+      refresh_token: oauth.refreshToken,
+    };
+  }
+
+  private getAccessTokenExpiryMs(oauth: NonNullable<ServerConfig['oauth']>): number | undefined {
+    return oauth.accessTokenExpiresAt;
+  }
+
+  private async refreshAccessTokenIfNeeded(
+    refreshToken?: string | null,
+  ): Promise<OAuthTokens | undefined> {
+    if (!refreshToken) {
+      return undefined;
+    }
+
+    try {
+      const clientInfo = await initializeOAuthForServer(this.serverName, this.serverConfig);
+      if (!clientInfo) {
+        return undefined;
+      }
+
+      const tokens = await refreshAccessToken(
+        this.serverName,
+        this.serverConfig,
+        clientInfo,
+        refreshToken,
+      );
+
+      // Reload latest config to sync updated tokens/expiry
+      const updatedConfig = await loadServerConfig(this.serverName);
+      if (updatedConfig) {
+        this.serverConfig = updatedConfig;
+      }
+
+      const nextRefreshToken = tokens.refreshToken ?? refreshToken;
+      if (tokens.refreshToken === undefined) {
+        console.warn(
+          `Refresh response missing refresh_token for ${this.serverName}; reusing existing refresh token (some providers omit refresh_token on refresh)`,
+        );
+      }
+
+      return {
+        access_token: tokens.accessToken,
+        refresh_token: nextRefreshToken,
+        token_type: 'Bearer',
+        expires_in: tokens.expiresIn,
+      };
+    } catch (error) {
+      console.warn(
+        `Failed to auto-refresh OAuth token for server ${this.serverName}:`,
+        error instanceof Error ? error.message : error,
+      );
+      return undefined;
+    }
+  }
+
   /**
    * Redirect to authorization URL
    * In a server environment, we can't directly redirect the user

src/services/mcpService.ts

@@ -277,11 +277,7 @@ const callToolWithReconnect = async (
               version: '1.0.0',
             },
             {
-              capabilities: {
-                prompts: {},
-                resources: {},
-                tools: {},
-              },
+              capabilities: {},
             },
           );
 
@@ -463,11 +459,7 @@ export const initializeClientsFromSettings = async (
           version: '1.0.0',
         },
         {
-          capabilities: {
-            prompts: {},
-            resources: {},
-            tools: {},
-          },
+          capabilities: {},
         },
       );
 
@@ -622,9 +614,37 @@ export const registerAllTools = async (isInit: boolean, serverName?: string): Pr
 export const getServersInfo = async (): Promise<Omit<ServerInfo, 'client' | 'transport'>[]> => {
   const allServers: ServerConfigWithName[] = await getServerDao().findAll();
   const dataService = getDataService();
+
+  // Ensure that servers recently added via DAO but not yet initialized in serverInfos
+  // are still visible in the servers list. This avoids a race condition where
+  // a POST /api/servers immediately followed by GET /api/servers would not
+  // return the newly created server until background initialization completes.
+  const combinedServerInfos: ServerInfo[] = [...serverInfos];
+  const existingNames = new Set(combinedServerInfos.map((s) => s.name));
+
+  for (const server of allServers) {
+    if (!existingNames.has(server.name)) {
+      const isEnabled = server.enabled === undefined ? true : server.enabled;
+      combinedServerInfos.push({
+        name: server.name,
+        owner: server.owner,
+        // Newly created servers that are enabled should appear as "connecting"
+        // until the MCP client initialization completes. Disabled servers remain
+        // in the "disconnected" state.
+        status: isEnabled ? 'connecting' : 'disconnected',
+        error: null,
+        tools: [],
+        prompts: [],
+        createTime: Date.now(),
+        enabled: isEnabled,
+      });
+    }
+  }
+
   const filterServerInfos: ServerInfo[] = dataService.filterData
-    ? dataService.filterData(serverInfos)
-    : serverInfos;
+    ? dataService.filterData(combinedServerInfos)
+    : combinedServerInfos;
+
   const infos = filterServerInfos.map(
     ({ name, status, tools, prompts, createTime, error, oauth }) => {
       const serverConfig = allServers.find((server) => server.name === name);
@@ -964,23 +984,14 @@ Available servers: ${serversList}`,
   for (const serverInfo of filteredServerInfos) {
     if (serverInfo.tools && serverInfo.tools.length > 0) {
       // Filter tools based on server configuration
-      let enabledTools = await filterToolsByConfig(serverInfo.name, serverInfo.tools);
+      let tools = await filterToolsByConfig(serverInfo.name, serverInfo.tools);
 
       // If this is a group request, apply group-level tool filtering
-      if (group) {
-        const serverConfig = await getServerConfigInGroup(group, serverInfo.name);
-        if (serverConfig && serverConfig.tools !== 'all' && Array.isArray(serverConfig.tools)) {
-          // Filter tools based on group configuration
-          const allowedToolNames = serverConfig.tools.map(
-            (toolName: string) => `${serverInfo.name}${getNameSeparator()}${toolName}`,
-          );
-          enabledTools = enabledTools.filter((tool) => allowedToolNames.includes(tool.name));
-        }
-      }
+      tools = await filterToolsByGroup(group, serverInfo.name, tools);
 
       // Apply custom descriptions from server configuration
       const serverConfig = await getServerDao().findById(serverInfo.name);
-      const toolsWithCustomDescriptions = enabledTools.map((tool) => {
+      const toolsWithCustomDescriptions = tools.map((tool) => {
         const toolConfig = serverConfig?.tools?.[tool.name];
         return {
           ...tool,
@@ -1027,12 +1038,15 @@ export const handleCallToolRequest = async (request: any, extra: any) => {
 
       // Determine server filtering based on group
       const sessionId = extra.sessionId || '';
-      const group = getGroup(sessionId);
+      let group = getGroup(sessionId);
       let servers: string[] | undefined = undefined; // No server filtering by default
 
       // If group is in format $smart/{group}, filter servers to that group
       if (group?.startsWith('$smart/')) {
         const targetGroup = group.substring(7);
+        if (targetGroup) {
+          group = targetGroup;
+        }
         const serversInGroup = await getServersInGroup(targetGroup);
         if (serversInGroup !== undefined && serversInGroup !== null) {
           servers = serversInGroup;
@@ -1064,8 +1078,8 @@ export const handleCallToolRequest = async (request: any, extra: any) => {
             const actualTool = server.tools.find((tool) => tool.name === result.toolName);
             if (actualTool) {
               // Check if the tool is enabled in configuration
-              const enabledTools = await filterToolsByConfig(server.name, [actualTool]);
-              if (enabledTools.length > 0) {
+              const tools = await filterToolsByConfig(server.name, [actualTool]);
+              if (tools.length > 0) {
                 // Apply custom description from configuration
                 const serverConfig = await getServerDao().findById(server.name);
                 const toolConfig = serverConfig?.tools?.[actualTool.name];
@@ -1091,19 +1105,24 @@ export const handleCallToolRequest = async (request: any, extra: any) => {
       );
 
       // Now filter the resolved tools
-      const tools = await Promise.all(
-        resolvedTools.filter(async (tool) => {
-          // Additional filter to remove tools that are disabled
+      const filterResults = await Promise.all(
+        resolvedTools.map(async (tool) => {
           if (tool.name) {
             const serverName = tool.serverName;
             if (serverName) {
-              const enabledTools = await filterToolsByConfig(serverName, [tool as Tool]);
-              return enabledTools.length > 0;
+              let tools = await filterToolsByConfig(serverName, [tool as Tool]);
+              if (tools.length === 0) {
+                return false;
+              }
+
+              tools = await filterToolsByGroup(group, serverName, tools);
+              return tools.length > 0;
             }
           }
-          return true; // Keep fallback results
+          return true;
         }),
       );
+      const tools = resolvedTools.filter((_, i) => filterResults[i]);
 
       // Add usage guidance to the response
       const response = {
@@ -1495,3 +1514,18 @@ export const createMcpServer = (name: string, version: string, group?: string):
   server.setRequestHandler(ListPromptsRequestSchema, handleListPromptsRequest);
   return server;
 };
+
+// Filter tools based on group configuration
+async function filterToolsByGroup(group: string | undefined, serverName: string, tools: Tool[]) {
+  if (group) {
+    const serverConfig = await getServerConfigInGroup(group, serverName);
+    if (serverConfig && serverConfig.tools !== 'all' && Array.isArray(serverConfig.tools)) {
+      // Filter tools based on group configuration
+      const allowedToolNames = serverConfig.tools.map(
+        (toolName: string) => `${serverName}${getNameSeparator()}${toolName}`,
+      );
+      tools = tools.filter((tool) => allowedToolNames.includes(tool.name));
+    }
+  }
+  return tools;
+}

src/services/oauthClientRegistration.ts

@@ -397,6 +397,7 @@ export const exchangeCodeForToken = async (
     await persistTokens(serverName, {
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? undefined,
+      expiresIn: tokens.expires_in,
     });
 
     return {
@@ -437,6 +438,7 @@ export const refreshAccessToken = async (
     await persistTokens(serverName, {
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? undefined,
+      expiresIn: tokens.expires_in,
     });
 
     return {

src/services/oauthServerService.ts

@@ -21,7 +21,7 @@ const oauthModel: OAuth2Server.AuthorizationCodeModel & OAuth2Server.RefreshToke
    * Get client by client ID
    */
   getClient: async (clientId: string, clientSecret?: string) => {
-    const client = findOAuthClientById(clientId);
+    const client = await findOAuthClientById(clientId);
     if (!client) {
       return false;
     }
@@ -92,7 +92,7 @@ const oauthModel: OAuth2Server.AuthorizationCodeModel & OAuth2Server.RefreshToke
       return false;
     }
 
-    const client = findOAuthClientById(code.clientId);
+    const client = await findOAuthClientById(code.clientId);
     if (!client) {
       return false;
     }
@@ -143,7 +143,7 @@ const oauthModel: OAuth2Server.AuthorizationCodeModel & OAuth2Server.RefreshToke
 
     const scopeString = Array.isArray(token.scope) ? token.scope.join(' ') : token.scope;
 
-    const savedToken = saveToken(
+    const savedToken = await saveToken(
       {
         scope: scopeString,
         clientId: client.id,
@@ -172,12 +172,12 @@ const oauthModel: OAuth2Server.AuthorizationCodeModel & OAuth2Server.RefreshToke
    * Get access token
    */
   getAccessToken: async (accessToken: string) => {
-    const token = getToken(accessToken);
+    const token = await getToken(accessToken);
     if (!token) {
       return false;
     }
 
-    const client = findOAuthClientById(token.clientId);
+    const client = await findOAuthClientById(token.clientId);
     if (!client) {
       return false;
     }
@@ -205,12 +205,12 @@ const oauthModel: OAuth2Server.AuthorizationCodeModel & OAuth2Server.RefreshToke
    * Get refresh token
    */
   getRefreshToken: async (refreshToken: string) => {
-    const token = getToken(refreshToken);
+    const token = await getToken(refreshToken);
     if (!token || token.refreshToken !== refreshToken) {
       return false;
     }
 
-    const client = findOAuthClientById(token.clientId);
+    const client = await findOAuthClientById(token.clientId);
     if (!client) {
       return false;
     }
@@ -240,7 +240,7 @@ const oauthModel: OAuth2Server.AuthorizationCodeModel & OAuth2Server.RefreshToke
   revokeToken: async (token: OAuth2Server.Token | OAuth2Server.RefreshToken) => {
     const refreshToken = 'refreshToken' in token ? token.refreshToken : undefined;
     if (refreshToken) {
-      revokeToken(refreshToken);
+      await revokeToken(refreshToken);
     }
     return true;
   },

src/services/oauthSettingsStore.ts

@@ -100,12 +100,17 @@ export const persistTokens = async (
   tokens: {
     accessToken: string;
     refreshToken?: string | null;
+    expiresIn?: number;
     clearPendingAuthorization?: boolean;
   },
 ): Promise<ServerConfigWithOAuth | undefined> => {
   return mutateOAuthSettings(serverName, ({ oauth }) => {
     oauth.accessToken = tokens.accessToken;
 
+    if (tokens.expiresIn !== undefined) {
+      oauth.accessTokenExpiresAt = Date.now() + tokens.expiresIn * 1000;
+    }
+
     if (tokens.refreshToken !== undefined) {
       if (tokens.refreshToken) {
         oauth.refreshToken = tokens.refreshToken;
@@ -147,6 +152,7 @@ export const clearOAuthData = async (
     if (scope === 'tokens' || scope === 'all') {
       delete oauth.accessToken;
       delete oauth.refreshToken;
+      delete oauth.accessTokenExpiresAt;
     }
 
     if (scope === 'client' || scope === 'all') {

src/services/openApiGeneratorService.ts

@@ -42,7 +42,7 @@ function convertToolSchemaToOpenAPI(tool: Tool): {
       (prop: any) =>
         prop.type === 'object' ||
         prop.type === 'array' ||
-        (prop.type === 'string' && prop.enum && prop.enum.length > 10),
+        prop.type === 'string',
     );
 
     if (!hasComplexTypes && Object.keys(properties).length <= 10) {
@@ -93,7 +93,7 @@ function generateOperationFromTool(tool: Tool, serverName: string): OpenAPIV3.Op
   const operation: OpenAPIV3.OperationObject = {
     summary: tool.description || `Execute ${tool.name} tool`,
     description: tool.description || `Execute the ${tool.name} tool from ${serverName} server`,
-    operationId: `${serverName}_${tool.name}`,
+    operationId: `${tool.name}`,
     tags: [serverName],
     ...(parameters && parameters.length > 0 && { parameters }),
     ...(requestBody && { requestBody }),

src/services/sseService.test.ts

@@ -47,6 +47,30 @@ jest.mock('../dao/index.js', () => ({
   getSystemConfigDao: jest.fn(() => ({
     get: jest.fn().mockImplementation(() => Promise.resolve(currentSystemConfig)),
   })),
+  getBearerKeyDao: jest.fn(() => ({
+    // Keep these unit tests aligned with legacy routing semantics:
+    // enableBearerAuth + bearerAuthKey -> one enabled key (token=bearerAuthKey)
+    // otherwise -> no enabled keys (bearer auth effectively disabled)
+    findEnabled: jest.fn().mockImplementation(async () => {
+      const routing = (currentSystemConfig as any)?.routing || {};
+      const enabled = !!routing.enableBearerAuth;
+      const token = String(routing.bearerAuthKey || '').trim();
+      if (!enabled || !token) {
+        return [];
+      }
+      return [
+        {
+          id: 'test-key-id',
+          name: 'default',
+          token,
+          enabled: true,
+          accessType: 'all',
+          allowedGroups: [],
+          allowedServers: [],
+        },
+      ];
+    }),
+  })),
 }));
 
 // Mock oauthBearer

src/services/sseService.ts

@@ -6,10 +6,10 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { deleteMcpServer, getMcpServer } from './mcpService.js';
 import config from '../config/index.js';
-import { getSystemConfigDao } from '../dao/index.js';
+import { getBearerKeyDao, getGroupDao, getServerDao, getSystemConfigDao } from '../dao/index.js';
 import { UserContextService } from './userContextService.js';
 import { RequestContextService } from './requestContextService.js';
-import { IUser } from '../types/index.js';
+import { IUser, BearerKey } from '../types/index.js';
 import { resolveOAuthUserFromToken } from '../utils/oauthBearer.js';
 
 export const transports: {
@@ -30,40 +30,164 @@ type BearerAuthResult =
       reason: 'missing' | 'invalid';
     };
 
+/**
+ * Check if a string is a valid UUID v4 format
+ */
+const isValidUUID = (str: string): boolean => {
+  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return uuidRegex.test(str);
+};
+
+const isBearerKeyAllowedForRequest = async (req: Request, key: BearerKey): Promise<boolean> => {
+  const paramValue = (req.params as any)?.group as string | undefined;
+
+  // accessType 'all' allows all requests
+  if (key.accessType === 'all') {
+    return true;
+  }
+
+  // No parameter value means global route
+  if (!paramValue) {
+    // Only accessType 'all' allows global routes
+    return false;
+  }
+
+  try {
+    const groupDao = getGroupDao();
+    const serverDao = getServerDao();
+
+    // Step 1: Try to match as a group (by name or id), since group has higher priority
+    let matchedGroup = await groupDao.findByName(paramValue);
+    if (!matchedGroup && isValidUUID(paramValue)) {
+      // Only try findById if the parameter is a valid UUID
+      matchedGroup = await groupDao.findById(paramValue);
+    }
+
+    if (matchedGroup) {
+      // Matched as a group
+      if (key.accessType === 'groups') {
+        // For group-scoped keys, check if the matched group is in allowedGroups
+        const allowedGroups = key.allowedGroups || [];
+        return allowedGroups.includes(matchedGroup.name) || allowedGroups.includes(matchedGroup.id);
+      }
+
+      if (key.accessType === 'servers') {
+        // For server-scoped keys, check if any server in the group is allowed
+        const allowedServers = key.allowedServers || [];
+        if (allowedServers.length === 0) {
+          return false;
+        }
+
+        if (!Array.isArray(matchedGroup.servers)) {
+          return false;
+        }
+
+        const groupServerNames = matchedGroup.servers.map((server) =>
+          typeof server === 'string' ? server : server.name,
+        );
+        return groupServerNames.some((name) => allowedServers.includes(name));
+      }
+
+      // Unknown accessType with matched group
+      return false;
+    }
+
+    // Step 2: Not a group, try to match as a server name
+    const matchedServer = await serverDao.findById(paramValue);
+
+    if (matchedServer) {
+      // Matched as a server
+      if (key.accessType === 'groups') {
+        // For group-scoped keys, server access is not allowed
+        return false;
+      }
+
+      if (key.accessType === 'servers') {
+        // For server-scoped keys, check if the server is in allowedServers
+        const allowedServers = key.allowedServers || [];
+        return allowedServers.includes(matchedServer.name);
+      }
+
+      // Unknown accessType with matched server
+      return false;
+    }
+
+    // Step 3: Not a valid group or server, deny access
+    console.warn(
+      `Bearer key access denied: parameter '${paramValue}' does not match any group or server`,
+    );
+    return false;
+  } catch (error) {
+    console.error('Error checking bearer key request access:', error);
+    return false;
+  }
+};
+
 const validateBearerAuth = async (req: Request): Promise<BearerAuthResult> => {
-  const systemConfigDao = getSystemConfigDao();
-  const systemConfig = await systemConfigDao.get();
-  const routingConfig = systemConfig?.routing || {
-    enableGlobalRoute: true,
-    enableGroupNameRoute: true,
-    enableBearerAuth: false,
-    bearerAuthKey: '',
-  };
+  const bearerKeyDao = getBearerKeyDao();
+  const enabledKeys = await bearerKeyDao.findEnabled();
 
-  if (routingConfig.enableBearerAuth) {
-    const authHeader = req.headers.authorization;
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      return { valid: false, reason: 'missing' };
+  const authHeader = req.headers.authorization;
+  const hasBearerHeader = !!authHeader && authHeader.startsWith('Bearer ');
+
+  // If no enabled keys are configured, bearer auth is effectively disabled.
+  // We still allow OAuth bearer tokens to attach user context in this case.
+  if (enabledKeys.length === 0) {
+    if (!hasBearerHeader) {
+      return { valid: true };
     }
 
-    const token = authHeader.substring(7); // Remove "Bearer " prefix
-    if (token.trim().length === 0) {
-      return { valid: false, reason: 'missing' };
-    }
-
-    if (token === routingConfig.bearerAuthKey) {
+    const token = authHeader!.substring(7).trim();
+    if (!token) {
       return { valid: true };
     }
 
     const oauthUser = await resolveOAuthUserFromToken(token);
     if (oauthUser) {
+      console.log('Authenticated request using OAuth bearer token without configured keys');
       return { valid: true, user: oauthUser };
     }
 
-    return { valid: false, reason: 'invalid' };
+    // When there are no keys, a non-OAuth bearer token should not block access
+    return { valid: true };
   }
 
-  return { valid: true };
+  // When keys exist, bearer header is required
+  if (!hasBearerHeader) {
+    return { valid: false, reason: 'missing' };
+  }
+
+  const token = authHeader!.substring(7).trim();
+  if (!token) {
+    return { valid: false, reason: 'missing' };
+  }
+
+  // First, try to match a configured bearer key
+  const matchingKey = enabledKeys.find((key) => key.token === token);
+  if (matchingKey) {
+    const allowed = await isBearerKeyAllowedForRequest(req, matchingKey);
+    if (!allowed) {
+      console.warn(
+        `Bearer key rejected due to scope restrictions: id=${matchingKey.id}, name=${matchingKey.name}, accessType=${matchingKey.accessType}`,
+      );
+      return { valid: false, reason: 'invalid' };
+    }
+
+    console.log(
+      `Bearer key authenticated: id=${matchingKey.id}, name=${matchingKey.name}, accessType=${matchingKey.accessType}`,
+    );
+    return { valid: true };
+  }
+
+  // Fallback: treat token as potential OAuth access token
+  const oauthUser = await resolveOAuthUserFromToken(token);
+  if (oauthUser) {
+    console.log('Authenticated request using OAuth bearer token (no matching static key)');
+    return { valid: true, user: oauthUser };
+  }
+
+  console.warn('Bearer authentication failed: token did not match any key or OAuth user');
+  return { valid: false, reason: 'invalid' };
 };
 
 const attachUserContextFromBearer = (result: BearerAuthResult, res: Response): void => {
@@ -398,9 +522,9 @@ export const handleMcpPostRequest = async (req: Request, res: Response): Promise
   // Get filtered settings based on user context (after setting user context)
   const systemConfigDao = getSystemConfigDao();
   const systemConfig = await systemConfigDao.get();
-  const routingConfig = systemConfig?.routing || {
-    enableGlobalRoute: true,
-    enableGroupNameRoute: true,
+  const routingConfig = {
+    enableGlobalRoute: systemConfig?.routing?.enableGlobalRoute ?? true,
+    enableGroupNameRoute: systemConfig?.routing?.enableGroupNameRoute ?? true,
   };
   if (!group && !routingConfig.enableGlobalRoute) {
     res.status(403).send('Global routes are disabled. Please specify a group ID.');

src/types/index.ts

@@ -243,6 +243,19 @@ export interface OAuthServerConfig {
   };
 }
 
+// Bearer authentication key configuration
+export type BearerKeyAccessType = 'all' | 'groups' | 'servers';
+
+export interface BearerKey {
+  id: string; // Unique identifier for the key
+  name: string; // Human readable key name
+  token: string; // Bearer token value
+  enabled: boolean; // Whether this key is enabled
+  accessType: BearerKeyAccessType; // Access scope type
+  allowedGroups?: string[]; // Allowed group names when accessType === 'groups'
+  allowedServers?: string[]; // Allowed server names when accessType === 'servers'
+}
+
 // Represents the settings for MCP servers
 export interface McpSettings {
   users?: IUser[]; // Array of user credentials and permissions
@@ -254,6 +267,7 @@ export interface McpSettings {
   userConfigs?: Record<string, UserConfig>; // User-specific configurations
   oauthClients?: IOAuthClient[]; // OAuth clients for MCPHub's authorization server
   oauthTokens?: IOAuthToken[]; // Persisted OAuth tokens (access + refresh) for authorization server
+  bearerKeys?: BearerKey[]; // Bearer authentication keys (multi-key configuration)
 }
 
 // Configuration details for an individual server
@@ -279,6 +293,7 @@ export interface ServerConfig {
     scopes?: string[]; // Required OAuth scopes
     accessToken?: string; // Pre-obtained access token (if available)
     refreshToken?: string; // Refresh token for renewing access
+    accessTokenExpiresAt?: number; // Access token expiration timestamp (ms since epoch)
 
     // Dynamic client registration (RFC7591)
     // If not explicitly configured, will auto-detect via WWW-Authenticate header on 401 responses
@@ -420,3 +435,50 @@ export interface AddServerRequest {
   name: string; // Name of the server to add
   config: ServerConfig; // Configuration details for the server
 }
+
+// Request payload for batch creating servers
+export interface BatchCreateServersRequest {
+  servers: AddServerRequest[]; // Array of servers to create
+}
+
+// Result for a single server in batch operation
+export interface BatchServerResult {
+  name: string; // Server name
+  success: boolean; // Whether the operation succeeded
+  message?: string; // Error message if failed
+}
+
+// Response for batch create servers operation
+export interface BatchCreateServersResponse {
+  success: boolean; // Overall operation success (true if at least one server succeeded)
+  successCount: number; // Number of servers successfully created
+  failureCount: number; // Number of servers that failed
+  results: BatchServerResult[]; // Detailed results for each server
+}
+
+// Request payload for adding a new group
+export interface AddGroupRequest {
+  name: string; // Name of the group to add
+  description?: string; // Optional description of the group
+  servers?: string[] | IGroupServerConfig[]; // Array of server names or server configurations
+}
+
+// Request payload for batch creating groups
+export interface BatchCreateGroupsRequest {
+  groups: AddGroupRequest[]; // Array of groups to create
+}
+
+// Result for a single group in batch operation
+export interface BatchGroupResult {
+  name: string; // Group name
+  success: boolean; // Whether the operation succeeded
+  message?: string; // Error message if failed
+}
+
+// Response for batch create groups operation
+export interface BatchCreateGroupsResponse {
+  success: boolean; // Overall operation success (true if at least one group succeeded)
+  successCount: number; // Number of groups successfully created
+  failureCount: number; // Number of groups that failed
+  results: BatchGroupResult[]; // Detailed results for each group
+}

src/utils/migration.test.ts

@@ -0,0 +1,122 @@
+import { jest } from '@jest/globals';
+
+// Mocks must be defined before importing the module under test.
+
+const initializeDatabaseMock = jest.fn(async () => undefined);
+jest.mock('../db/connection.js', () => ({
+  initializeDatabase: initializeDatabaseMock,
+}));
+
+const setDaoFactoryMock = jest.fn();
+jest.mock('../dao/DaoFactory.js', () => ({
+  setDaoFactory: setDaoFactoryMock,
+}));
+
+jest.mock('../dao/DatabaseDaoFactory.js', () => ({
+  DatabaseDaoFactory: {
+    getInstance: jest.fn(() => ({
+      /* noop */
+    })),
+  },
+}));
+
+const loadOriginalSettingsMock = jest.fn(() => ({ users: [] }));
+jest.mock('../config/index.js', () => ({
+  loadOriginalSettings: loadOriginalSettingsMock,
+}));
+
+const userRepoCountMock = jest.fn<() => Promise<number>>();
+jest.mock('../db/repositories/UserRepository.js', () => ({
+  UserRepository: jest.fn().mockImplementation(() => ({
+    count: userRepoCountMock,
+  })),
+}));
+
+const bearerKeyCountMock = jest.fn<() => Promise<number>>();
+const bearerKeyCreateMock =
+  jest.fn<
+    (data: {
+      name: string;
+      token: string;
+      enabled: boolean;
+      accessType: string;
+      allowedGroups: string[];
+      allowedServers: string[];
+    }) => Promise<unknown>
+  >();
+jest.mock('../db/repositories/BearerKeyRepository.js', () => ({
+  BearerKeyRepository: jest.fn().mockImplementation(() => ({
+    count: bearerKeyCountMock,
+    create: bearerKeyCreateMock,
+  })),
+}));
+
+const systemConfigGetMock = jest.fn<() => Promise<any>>();
+jest.mock('../db/repositories/SystemConfigRepository.js', () => ({
+  SystemConfigRepository: jest.fn().mockImplementation(() => ({
+    get: systemConfigGetMock,
+  })),
+}));
+
+describe('initializeDatabaseMode legacy bearer auth migration', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('skips legacy migration when bearerKeys table already has data', async () => {
+    userRepoCountMock.mockResolvedValue(1);
+    bearerKeyCountMock.mockResolvedValue(2);
+    systemConfigGetMock.mockResolvedValue({
+      routing: { enableBearerAuth: true, bearerAuthKey: 'db-key' },
+    });
+
+    const { initializeDatabaseMode } = await import('./migration.js');
+    const ok = await initializeDatabaseMode();
+
+    expect(ok).toBe(true);
+    expect(initializeDatabaseMock).toHaveBeenCalled();
+    expect(loadOriginalSettingsMock).not.toHaveBeenCalled();
+    expect(systemConfigGetMock).not.toHaveBeenCalled();
+    expect(bearerKeyCreateMock).not.toHaveBeenCalled();
+  });
+
+  it('migrates legacy routing bearerAuthKey into bearerKeys when users exist and keys table is empty', async () => {
+    userRepoCountMock.mockResolvedValue(3);
+    bearerKeyCountMock.mockResolvedValue(0);
+    systemConfigGetMock.mockResolvedValue({
+      routing: { enableBearerAuth: true, bearerAuthKey: 'db-key' },
+    });
+
+    const { initializeDatabaseMode } = await import('./migration.js');
+    const ok = await initializeDatabaseMode();
+
+    expect(ok).toBe(true);
+    expect(loadOriginalSettingsMock).not.toHaveBeenCalled();
+    expect(systemConfigGetMock).toHaveBeenCalledTimes(1);
+    expect(bearerKeyCreateMock).toHaveBeenCalledTimes(1);
+    expect(bearerKeyCreateMock).toHaveBeenCalledWith({
+      name: 'default',
+      token: 'db-key',
+      enabled: true,
+      accessType: 'all',
+      allowedGroups: [],
+      allowedServers: [],
+    });
+  });
+
+  it('does not migrate when routing has no bearerAuthKey', async () => {
+    userRepoCountMock.mockResolvedValue(1);
+    bearerKeyCountMock.mockResolvedValue(0);
+    systemConfigGetMock.mockResolvedValue({
+      routing: { enableBearerAuth: true, bearerAuthKey: '   ' },
+    });
+
+    const { initializeDatabaseMode } = await import('./migration.js');
+    const ok = await initializeDatabaseMode();
+
+    expect(ok).toBe(true);
+    expect(loadOriginalSettingsMock).not.toHaveBeenCalled();
+    expect(systemConfigGetMock).toHaveBeenCalledTimes(1);
+    expect(bearerKeyCreateMock).not.toHaveBeenCalled();
+  });
+});

src/utils/migration.ts

@@ -7,6 +7,9 @@ import { ServerRepository } from '../db/repositories/ServerRepository.js';
 import { GroupRepository } from '../db/repositories/GroupRepository.js';
 import { SystemConfigRepository } from '../db/repositories/SystemConfigRepository.js';
 import { UserConfigRepository } from '../db/repositories/UserConfigRepository.js';
+import { OAuthClientRepository } from '../db/repositories/OAuthClientRepository.js';
+import { OAuthTokenRepository } from '../db/repositories/OAuthTokenRepository.js';
+import { BearerKeyRepository } from '../db/repositories/BearerKeyRepository.js';
 
 /**
  * Migrate from file-based configuration to database
@@ -29,6 +32,9 @@ export async function migrateToDatabase(): Promise<boolean> {
     const groupRepo = new GroupRepository();
     const systemConfigRepo = new SystemConfigRepository();
     const userConfigRepo = new UserConfigRepository();
+    const oauthClientRepo = new OAuthClientRepository();
+    const oauthTokenRepo = new OAuthTokenRepository();
+    const bearerKeyRepo = new BearerKeyRepository();
 
     // Migrate users
     if (settings.users && settings.users.length > 0) {
@@ -71,6 +77,7 @@ export async function migrateToDatabase(): Promise<boolean> {
             prompts: config.prompts,
             options: config.options,
             oauth: config.oauth,
+            openapi: config.openapi,
           });
           console.log(`  - Created server: ${name}`);
         } else {
@@ -115,6 +122,52 @@ export async function migrateToDatabase(): Promise<boolean> {
       console.log('  - System configuration updated');
     }
 
+    // Migrate bearer auth keys
+    console.log('Migrating bearer authentication keys...');
+
+    // Prefer explicit bearerKeys if present in settings
+    if (Array.isArray(settings.bearerKeys) && settings.bearerKeys.length > 0) {
+      for (const key of settings.bearerKeys) {
+        await bearerKeyRepo.create({
+          name: key.name,
+          token: key.token,
+          enabled: key.enabled,
+          accessType: key.accessType,
+          allowedGroups: key.allowedGroups ?? [],
+          allowedServers: key.allowedServers ?? [],
+        } as any);
+        console.log(`  - Migrated bearer key: ${key.name} (${key.id ?? 'no-id'})`);
+      }
+    } else if (settings.systemConfig?.routing) {
+      // Fallback to legacy routing.enableBearerAuth / bearerAuthKey
+      const routing = settings.systemConfig.routing as any;
+      const enableBearerAuth: boolean = !!routing.enableBearerAuth;
+      const rawKey: string = (routing.bearerAuthKey || '').trim();
+
+      // Migration rules:
+      // 1) enable=false, key empty   -> no keys
+      // 2) enable=false, key present -> one disabled key (name=default)
+      // 3) enable=true, key present  -> one enabled key (name=default)
+      // 4) enable=true, key empty    -> no keys
+      if (rawKey) {
+        await bearerKeyRepo.create({
+          name: 'default',
+          token: rawKey,
+          enabled: enableBearerAuth,
+          accessType: 'all',
+          allowedGroups: [],
+          allowedServers: [],
+        } as any);
+        console.log(
+          `  - Migrated legacy bearer auth config to key: default (enabled=${enableBearerAuth})`,
+        );
+      } else {
+        console.log('  - No legacy bearer auth key found, skipping bearer key migration');
+      }
+    } else {
+      console.log('  - No bearer auth configuration found, skipping bearer key migration');
+    }
+
     // Migrate user configs
     if (settings.userConfigs) {
       const usernames = Object.keys(settings.userConfigs);
@@ -129,6 +182,53 @@ export async function migrateToDatabase(): Promise<boolean> {
       }
     }
 
+    // Migrate OAuth clients
+    if (settings.oauthClients && settings.oauthClients.length > 0) {
+      console.log(`Migrating ${settings.oauthClients.length} OAuth clients...`);
+      for (const client of settings.oauthClients) {
+        const exists = await oauthClientRepo.exists(client.clientId);
+        if (!exists) {
+          await oauthClientRepo.create({
+            clientId: client.clientId,
+            clientSecret: client.clientSecret,
+            name: client.name,
+            redirectUris: client.redirectUris,
+            grants: client.grants,
+            scopes: client.scopes,
+            owner: client.owner,
+            metadata: client.metadata,
+          });
+          console.log(`  - Created OAuth client: ${client.clientId}`);
+        } else {
+          console.log(`  - OAuth client already exists: ${client.clientId}`);
+        }
+      }
+    }
+
+    // Migrate OAuth tokens
+    if (settings.oauthTokens && settings.oauthTokens.length > 0) {
+      console.log(`Migrating ${settings.oauthTokens.length} OAuth tokens...`);
+      for (const token of settings.oauthTokens) {
+        const exists = await oauthTokenRepo.exists(token.accessToken);
+        if (!exists) {
+          await oauthTokenRepo.create({
+            accessToken: token.accessToken,
+            refreshToken: token.refreshToken,
+            accessTokenExpiresAt: new Date(token.accessTokenExpiresAt),
+            refreshTokenExpiresAt: token.refreshTokenExpiresAt
+              ? new Date(token.refreshTokenExpiresAt)
+              : undefined,
+            scope: token.scope,
+            clientId: token.clientId,
+            username: token.username,
+          });
+          console.log(`  - Created OAuth token for client: ${token.clientId}`);
+        } else {
+          console.log(`  - OAuth token already exists: ${token.accessToken.substring(0, 8)}...`);
+        }
+      }
+    }
+
     console.log('✅ Migration completed successfully');
     return true;
   } catch (error) {
@@ -155,6 +255,9 @@ export async function initializeDatabaseMode(): Promise<boolean> {
 
     // Check if migration is needed
     const userRepo = new UserRepository();
+    const bearerKeyRepo = new BearerKeyRepository();
+    const systemConfigRepo = new SystemConfigRepository();
+
     const userCount = await userRepo.count();
 
     if (userCount === 0) {
@@ -165,6 +268,36 @@ export async function initializeDatabaseMode(): Promise<boolean> {
       }
     } else {
       console.log(`Database already contains ${userCount} users, skipping migration`);
+
+      // One-time migration for legacy bearer auth config stored inside DB routing settings.
+      // If bearerKeys table already has data, do nothing.
+      const bearerKeyCount = await bearerKeyRepo.count();
+      if (bearerKeyCount > 0) {
+        console.log(
+          `Bearer keys table already contains ${bearerKeyCount} keys, skipping legacy bearer auth migration`,
+        );
+      } else {
+        const systemConfig = await systemConfigRepo.get();
+        const routing = (systemConfig as any)?.routing || {};
+        const enableBearerAuth: boolean = !!routing.enableBearerAuth;
+        const rawKey: string = (routing.bearerAuthKey || '').trim();
+
+        if (rawKey) {
+          await bearerKeyRepo.create({
+            name: 'default',
+            token: rawKey,
+            enabled: enableBearerAuth,
+            accessType: 'all',
+            allowedGroups: [],
+            allowedServers: [],
+          } as any);
+          console.log(
+            `  - Migrated legacy DB routing bearer auth config to key: default (enabled=${enableBearerAuth})`,
+          );
+        } else {
+          console.log('No legacy DB routing bearer auth key found, skipping bearer key migration');
+        }
+      }
     }
 
     console.log('✅ Database mode initialized successfully');

src/utils/oauthBearer.ts

@@ -11,7 +11,7 @@ export const resolveOAuthUserFromToken = async (token?: string): Promise<IUser |
     return null;
   }
 
-  const oauthToken = getOAuthStoredToken(token);
+  const oauthToken = await getOAuthStoredToken(token);
   if (!oauthToken || oauthToken.accessToken !== token) {
     return null;
   }

tests/controllers/configController.test.ts

@@ -1,86 +1,76 @@
-import { getMcpSettingsJson } from '../../src/controllers/configController.js'
-import * as config from '../../src/config/index.js'
-import { Request, Response } from 'express'
+import { getMcpSettingsJson } from '../../src/controllers/configController.js';
+import * as DaoFactory from '../../src/dao/DaoFactory.js';
+import { Request, Response } from 'express';
 
-// Mock the config module
-jest.mock('../../src/config/index.js')
+jest.mock('../../src/dao/DaoFactory.js');
 
 describe('ConfigController - getMcpSettingsJson', () => {
-  let mockRequest: Partial<Request>
-  let mockResponse: Partial<Response>
-  let mockJson: jest.Mock
-  let mockStatus: jest.Mock
+  let mockRequest: Partial<Request>;
+  let mockResponse: Partial<Response>;
+  let mockJson: jest.Mock;
+  let mockStatus: jest.Mock;
+  let mockServerDao: { findById: jest.Mock; findAll: jest.Mock };
+  let mockUserDao: { findAll: jest.Mock };
+  let mockGroupDao: { findAll: jest.Mock };
+  let mockSystemConfigDao: { get: jest.Mock };
+  let mockUserConfigDao: { getAll: jest.Mock };
+  let mockOAuthClientDao: { findAll: jest.Mock };
+  let mockOAuthTokenDao: { findAll: jest.Mock };
+  let mockBearerKeyDao: { findAll: jest.Mock };
 
   beforeEach(() => {
-    mockJson = jest.fn()
-    mockStatus = jest.fn().mockReturnThis()
+    jest.clearAllMocks();
+
+    mockJson = jest.fn();
+    mockStatus = jest.fn().mockReturnThis();
     mockRequest = {
       query: {},
-    }
+    };
     mockResponse = {
       json: mockJson,
       status: mockStatus,
-    }
+    };
 
-    // Reset mocks
-    jest.clearAllMocks()
-  })
+    mockServerDao = {
+      findById: jest.fn(),
+      findAll: jest.fn(),
+    };
+    mockUserDao = { findAll: jest.fn() };
+    mockGroupDao = { findAll: jest.fn() };
+    mockSystemConfigDao = { get: jest.fn() };
+    mockUserConfigDao = { getAll: jest.fn() };
+    mockOAuthClientDao = { findAll: jest.fn() };
+    mockOAuthTokenDao = { findAll: jest.fn() };
+    mockBearerKeyDao = { findAll: jest.fn() };
 
-  describe('Full Settings Export', () => {
-    it('should handle settings without users array', () => {
-      const mockSettings = {
-        mcpServers: {
-          'test-server': {
-            command: 'test',
-            args: ['--test'],
-          },
-        },
-      }
-
-      ;(config.loadOriginalSettings as jest.Mock).mockReturnValue(mockSettings)
-
-      getMcpSettingsJson(mockRequest as Request, mockResponse as Response)
-
-      expect(mockJson).toHaveBeenCalledWith({
-        success: true,
-        data: {
-          mcpServers: mockSettings.mcpServers,
-          users: undefined,
-        },
-      })
-    })
-  })
+    // Wire DaoFactory convenience functions to our mocks
+    (DaoFactory.getServerDao as unknown as jest.Mock).mockReturnValue(mockServerDao);
+    (DaoFactory.getUserDao as unknown as jest.Mock).mockReturnValue(mockUserDao);
+    (DaoFactory.getGroupDao as unknown as jest.Mock).mockReturnValue(mockGroupDao);
+    (DaoFactory.getSystemConfigDao as unknown as jest.Mock).mockReturnValue(mockSystemConfigDao);
+    (DaoFactory.getUserConfigDao as unknown as jest.Mock).mockReturnValue(mockUserConfigDao);
+    (DaoFactory.getOAuthClientDao as unknown as jest.Mock).mockReturnValue(mockOAuthClientDao);
+    (DaoFactory.getOAuthTokenDao as unknown as jest.Mock).mockReturnValue(mockOAuthTokenDao);
+    (DaoFactory.getBearerKeyDao as unknown as jest.Mock).mockReturnValue(mockBearerKeyDao);
+  });
 
   describe('Individual Server Export', () => {
-    it('should return individual server configuration when serverName is specified', () => {
-      const mockSettings = {
-        mcpServers: {
-          'test-server': {
-            command: 'test',
-            args: ['--test'],
-            env: {
-              TEST_VAR: 'test-value',
-            },
-          },
-          'another-server': {
-            command: 'another',
-            args: ['--another'],
-          },
+    it('should return individual server configuration when serverName is specified', async () => {
+      const serverConfig = {
+        name: 'test-server',
+        command: 'test',
+        args: ['--test'],
+        env: {
+          TEST_VAR: 'test-value',
         },
-        users: [
-          {
-            username: 'admin',
-            password: '$2b$10$hashedpassword',
-            isAdmin: true,
-          },
-        ],
-      }
+      };
 
-      mockRequest.query = { serverName: 'test-server' }
-      ;(config.loadOriginalSettings as jest.Mock).mockReturnValue(mockSettings)
+      mockRequest.query = { serverName: 'test-server' };
+      mockServerDao.findById.mockResolvedValue(serverConfig);
 
-      getMcpSettingsJson(mockRequest as Request, mockResponse as Response)
+      await getMcpSettingsJson(mockRequest as Request, mockResponse as Response);
 
+      expect(mockServerDao.findById).toHaveBeenCalledWith('test-server');
       expect(mockJson).toHaveBeenCalledWith({
         success: true,
         data: {
@@ -94,46 +84,77 @@ describe('ConfigController - getMcpSettingsJson', () => {
             },
           },
         },
-      })
-    })
+      });
+    });
 
-    it('should return 404 when server does not exist', () => {
-      const mockSettings = {
-        mcpServers: {
-          'test-server': {
-            command: 'test',
-            args: ['--test'],
-          },
-        },
-      }
+    it('should return 404 when server does not exist', async () => {
+      mockRequest.query = { serverName: 'non-existent-server' };
+      mockServerDao.findById.mockResolvedValue(null);
 
-      mockRequest.query = { serverName: 'non-existent-server' }
-      ;(config.loadOriginalSettings as jest.Mock).mockReturnValue(mockSettings)
+      await getMcpSettingsJson(mockRequest as Request, mockResponse as Response);
 
-      getMcpSettingsJson(mockRequest as Request, mockResponse as Response)
-
-      expect(mockStatus).toHaveBeenCalledWith(404)
+      expect(mockServerDao.findById).toHaveBeenCalledWith('non-existent-server');
+      expect(mockStatus).toHaveBeenCalledWith(404);
       expect(mockJson).toHaveBeenCalledWith({
         success: false,
         message: "Server 'non-existent-server' not found",
-      })
-    })
-  })
+      });
+    });
+
+    it('should remove null values from server configuration', async () => {
+      const serverConfig = {
+        name: 'test-server',
+        command: 'test',
+        args: ['--test'],
+        url: null,
+        env: null,
+        headers: null,
+        options: {
+          timeout: 30,
+          retries: null,
+        },
+      };
+
+      mockRequest.query = { serverName: 'test-server' };
+      mockServerDao.findById.mockResolvedValue(serverConfig);
+
+      await getMcpSettingsJson(mockRequest as Request, mockResponse as Response);
+
+      expect(mockJson).toHaveBeenCalledWith({
+        success: true,
+        data: {
+          mcpServers: {
+            'test-server': {
+              command: 'test',
+              args: ['--test'],
+              options: {
+                timeout: 30,
+              },
+            },
+          },
+        },
+      });
+    });
+  });
 
   describe('Error Handling', () => {
-    it('should handle errors gracefully and return 500', () => {
-      const errorMessage = 'Failed to load settings'
-      ;(config.loadOriginalSettings as jest.Mock).mockImplementation(() => {
-        throw new Error(errorMessage)
-      })
+    it('should handle errors gracefully and return 500', async () => {
+      mockServerDao.findAll.mockRejectedValue(new Error('boom'));
+      mockUserDao.findAll.mockResolvedValue([]);
+      mockGroupDao.findAll.mockResolvedValue([]);
+      mockSystemConfigDao.get.mockResolvedValue({});
+      mockUserConfigDao.getAll.mockResolvedValue({});
+      mockOAuthClientDao.findAll.mockResolvedValue([]);
+      mockOAuthTokenDao.findAll.mockResolvedValue([]);
+      mockBearerKeyDao.findAll.mockResolvedValue([]);
 
-      getMcpSettingsJson(mockRequest as Request, mockResponse as Response)
+      await getMcpSettingsJson(mockRequest as Request, mockResponse as Response);
 
-      expect(mockStatus).toHaveBeenCalledWith(500)
+      expect(mockStatus).toHaveBeenCalledWith(500);
       expect(mockJson).toHaveBeenCalledWith({
         success: false,
         message: 'Failed to get MCP settings',
-      })
-    })
-  })
-})
+      });
+    });
+  });
+});

tests/models/oauth.test.ts

@@ -10,29 +10,86 @@ import {
   getToken,
   revokeToken,
 } from '../../src/models/OAuth.js';
+import { IOAuthClient, IOAuthToken } from '../../src/types/index.js';
 
-// Mock the config module to use in-memory storage for tests
-let mockSettings = { mcpServers: {}, users: [], oauthClients: [] };
+// Mock in-memory storage for OAuth clients and tokens
+let mockOAuthClients: IOAuthClient[] = [];
+let mockOAuthTokens: IOAuthToken[] = [];
 
-jest.mock('../../src/config/index.js', () => ({
-  loadSettings: jest.fn(() => ({ ...mockSettings })),
-  saveSettings: jest.fn((settings: any) => {
-    mockSettings = { ...settings };
-    return true;
-  }),
-  loadOriginalSettings: jest.fn(() => ({ ...mockSettings })),
-}));
+// Mock the DAO factory to use in-memory storage for tests
+jest.mock('../../src/dao/index.js', () => {
+  const originalModule = jest.requireActual('../../src/dao/index.js');
+
+  return {
+    ...originalModule,
+    getOAuthClientDao: jest.fn(() => ({
+      findAll: jest.fn(async () => [...mockOAuthClients]),
+      findByClientId: jest.fn(
+        async (clientId: string) => mockOAuthClients.find((c) => c.clientId === clientId) || null,
+      ),
+      create: jest.fn(async (client: IOAuthClient) => {
+        mockOAuthClients.push(client);
+        return client;
+      }),
+      update: jest.fn(async (clientId: string, updates: Partial<IOAuthClient>) => {
+        const index = mockOAuthClients.findIndex((c) => c.clientId === clientId);
+        if (index === -1) return null;
+        mockOAuthClients[index] = { ...mockOAuthClients[index], ...updates };
+        return mockOAuthClients[index];
+      }),
+      delete: jest.fn(async (clientId: string) => {
+        const index = mockOAuthClients.findIndex((c) => c.clientId === clientId);
+        if (index === -1) return false;
+        mockOAuthClients.splice(index, 1);
+        return true;
+      }),
+    })),
+    getOAuthTokenDao: jest.fn(() => ({
+      findAll: jest.fn(async () => [...mockOAuthTokens]),
+      findByAccessToken: jest.fn(
+        async (accessToken: string) =>
+          mockOAuthTokens.find((t) => t.accessToken === accessToken) || null,
+      ),
+      findByRefreshToken: jest.fn(
+        async (refreshToken: string) =>
+          mockOAuthTokens.find((t) => t.refreshToken === refreshToken) || null,
+      ),
+      create: jest.fn(async (token: IOAuthToken) => {
+        mockOAuthTokens.push(token);
+        return token;
+      }),
+      revokeToken: jest.fn(async (token: string) => {
+        const index = mockOAuthTokens.findIndex(
+          (t) => t.accessToken === token || t.refreshToken === token,
+        );
+        if (index === -1) return false;
+        mockOAuthTokens.splice(index, 1);
+        return true;
+      }),
+      cleanupExpired: jest.fn(async () => {
+        const now = new Date();
+        mockOAuthTokens = mockOAuthTokens.filter((t) => {
+          const accessExpired = t.accessTokenExpiresAt < now;
+          const refreshExpired =
+            !t.refreshToken || (t.refreshTokenExpiresAt && t.refreshTokenExpiresAt < now);
+          return !accessExpired || !refreshExpired;
+        });
+      }),
+    })),
+  };
+});
 
 describe('OAuth Model', () => {
   beforeEach(() => {
     jest.clearAllMocks();
-    // Reset mock settings before each test
-    mockSettings = { mcpServers: {}, users: [], oauthClients: [] };
+    // Reset mock storage before each test
+    mockOAuthClients = [];
+    mockOAuthTokens = [];
   });
 
   describe('OAuth Client Management', () => {
-    test('should create a new OAuth client', () => {
-      const client = {
+    test('should create a new OAuth client', async () => {
+      const client: IOAuthClient = {
         clientId: 'test-client',
         clientSecret: 'test-secret',
         name: 'Test Client',
@@ -41,15 +98,15 @@ describe('OAuth Model', () => {
         scopes: ['read', 'write'],
       };
 
-      const created = createOAuthClient(client);
+      const created = await createOAuthClient(client);
       expect(created).toEqual(client);
 
-      const found = findOAuthClientById('test-client');
+      const found = await findOAuthClientById('test-client');
       expect(found).toEqual(client);
     });
 
-    test('should not create duplicate OAuth client', () => {
-      const client = {
+    test('should not create duplicate OAuth client', async () => {
+      const client: IOAuthClient = {
         clientId: 'test-client',
         clientSecret: 'test-secret',
         name: 'Test Client',
@@ -58,12 +115,12 @@ describe('OAuth Model', () => {
         scopes: ['read'],
       };
 
-      createOAuthClient(client);
-      expect(() => createOAuthClient(client)).toThrow();
+      await createOAuthClient(client);
+      await expect(createOAuthClient(client)).rejects.toThrow();
     });
 
-    test('should update an OAuth client', () => {
-      const client = {
+    test('should update an OAuth client', async () => {
+      const client: IOAuthClient = {
         clientId: 'test-client',
         clientSecret: 'test-secret',
         name: 'Test Client',
@@ -72,9 +129,9 @@ describe('OAuth Model', () => {
         scopes: ['read'],
       };
 
-      createOAuthClient(client);
+      await createOAuthClient(client);
 
-      const updated = updateOAuthClient('test-client', {
+      const updated = await updateOAuthClient('test-client', {
         name: 'Updated Client',
         scopes: ['read', 'write'],
       });
@@ -83,8 +140,8 @@ describe('OAuth Model', () => {
       expect(updated?.scopes).toEqual(['read', 'write']);
     });
 
-    test('should delete an OAuth client', () => {
-      const client = {
+    test('should delete an OAuth client', async () => {
+      const client: IOAuthClient = {
         clientId: 'test-client',
         clientSecret: 'test-secret',
         name: 'Test Client',
@@ -93,12 +150,12 @@ describe('OAuth Model', () => {
         scopes: ['read'],
       };
 
-      createOAuthClient(client);
-      expect(findOAuthClientById('test-client')).toBeDefined();
+      await createOAuthClient(client);
+      expect(await findOAuthClientById('test-client')).toBeDefined();
 
-      const deleted = deleteOAuthClient('test-client');
+      const deleted = await deleteOAuthClient('test-client');
       expect(deleted).toBe(true);
-      expect(findOAuthClientById('test-client')).toBeUndefined();
+      expect(await findOAuthClientById('test-client')).toBeUndefined();
     });
   });
 
@@ -157,8 +214,8 @@ describe('OAuth Model', () => {
   });
 
   describe('Token Management', () => {
-    test('should save and retrieve token', () => {
-      const token = saveToken(
+    test('should save and retrieve token', async () => {
+      const token = await saveToken(
         {
           scope: 'read write',
           clientId: 'test-client',
@@ -172,14 +229,14 @@ describe('OAuth Model', () => {
       expect(token.refreshToken).toBeDefined();
       expect(token.accessTokenExpiresAt).toBeInstanceOf(Date);
 
-      const retrieved = getToken(token.accessToken);
+      const retrieved = await getToken(token.accessToken);
       expect(retrieved).toBeDefined();
       expect(retrieved?.clientId).toBe('test-client');
       expect(retrieved?.username).toBe('testuser');
     });
 
-    test('should retrieve token by refresh token', () => {
-      const token = saveToken(
+    test('should retrieve token by refresh token', async () => {
+      const token = await saveToken(
         {
           scope: 'read',
           clientId: 'test-client',
@@ -191,13 +248,13 @@ describe('OAuth Model', () => {
 
       expect(token.refreshToken).toBeDefined();
 
-      const retrieved = getToken(token.refreshToken!);
+      const retrieved = await getToken(token.refreshToken!);
       expect(retrieved).toBeDefined();
       expect(retrieved?.accessToken).toBe(token.accessToken);
     });
 
     test('should not retrieve expired access token', async () => {
-      const token = saveToken(
+      const token = await saveToken(
         {
           scope: 'read',
           clientId: 'test-client',
@@ -208,12 +265,12 @@ describe('OAuth Model', () => {
 
       await new Promise((resolve) => setTimeout(resolve, 100));
 
-      const retrieved = getToken(token.accessToken);
+      const retrieved = await getToken(token.accessToken);
       expect(retrieved).toBeUndefined();
     });
 
-    test('should revoke token', () => {
-      const token = saveToken(
+    test('should revoke token', async () => {
+      const token = await saveToken(
         {
           scope: 'read',
           clientId: 'test-client',
@@ -223,13 +280,13 @@ describe('OAuth Model', () => {
         86400,
       );
 
-      expect(getToken(token.accessToken)).toBeDefined();
+      expect(await getToken(token.accessToken)).toBeDefined();
 
-      revokeToken(token.accessToken);
-      expect(getToken(token.accessToken)).toBeUndefined();
+      await revokeToken(token.accessToken);
+      expect(await getToken(token.accessToken)).toBeUndefined();
 
       if (token.refreshToken) {
-        expect(getToken(token.refreshToken)).toBeUndefined();
+        expect(await getToken(token.refreshToken)).toBeUndefined();
       }
     });
   });

tests/services/keepalive.test.ts

@@ -31,14 +31,28 @@ jest.mock('../../src/utils/oauthBearer.js', () => ({
   resolveOAuthUserFromToken: jest.fn(),
 }));
 
+// Mock DAO accessors used by sseService (avoid file-based DAOs and migrations)
+jest.mock('../../src/dao/index.js', () => ({
+  getBearerKeyDao: jest.fn(),
+  getGroupDao: jest.fn(),
+  getSystemConfigDao: jest.fn(),
+}));
+
+// Mock config module default export used by sseService
+jest.mock('../../src/config/index.js', () => ({
+  __esModule: true,
+  default: { basePath: '' },
+  loadSettings: jest.fn(),
+}));
+
 import { Request, Response } from 'express';
 import { handleSseConnection, transports } from '../../src/services/sseService.js';
 import * as mcpService from '../../src/services/mcpService.js';
 import * as configModule from '../../src/config/index.js';
+import * as daoIndex from '../../src/dao/index.js';
 
 // Mock remaining dependencies
 jest.mock('../../src/services/mcpService.js');
-jest.mock('../../src/config/index.js');
 
 // Mock UserContextService with getInstance pattern
 const mockUserContextService = {
@@ -141,6 +155,24 @@ describe('Keepalive Functionality', () => {
     };
     (mcpService.getMcpServer as jest.Mock).mockReturnValue(mockMcpServer);
 
+    // Mock bearer key + system config DAOs used by sseService
+    const mockBearerKeyDao = {
+      findEnabled: jest.fn().mockResolvedValue([]),
+    };
+    (daoIndex.getBearerKeyDao as unknown as jest.Mock).mockReturnValue(mockBearerKeyDao);
+
+    const mockSystemConfigDao = {
+      get: jest.fn().mockResolvedValue({
+        routing: {
+          enableGlobalRoute: true,
+          enableGroupNameRoute: true,
+          enableBearerAuth: false,
+          bearerAuthKey: '',
+        },
+      }),
+    };
+    (daoIndex.getSystemConfigDao as unknown as jest.Mock).mockReturnValue(mockSystemConfigDao);
+
     // Mock loadSettings
     (configModule.loadSettings as jest.Mock).mockReturnValue({
       systemConfig: {

tests/services/mcpOAuthProvider.test.ts

@@ -0,0 +1,106 @@
+jest.mock('../../src/services/oauthClientRegistration.js', () => ({
+  initializeOAuthForServer: jest.fn(),
+  getRegisteredClient: jest.fn(),
+  removeRegisteredClient: jest.fn(),
+  fetchScopesFromServer: jest.fn(),
+  refreshAccessToken: jest.fn(),
+}));
+
+jest.mock('../../src/services/oauthSettingsStore.js', () => ({
+  loadServerConfig: jest.fn(),
+  mutateOAuthSettings: jest.fn(),
+  persistTokens: jest.fn(),
+  updatePendingAuthorization: jest.fn(),
+}));
+
+jest.mock('../../src/services/mcpService.js', () => ({
+  getServerByName: jest.fn(),
+}));
+
+jest.mock('../../src/dao/index.js', () => ({
+  getSystemConfigDao: jest.fn(() => ({ get: jest.fn() })),
+}));
+
+import { MCPHubOAuthProvider } from '../../src/services/mcpOAuthProvider.js';
+import * as oauthRegistration from '../../src/services/oauthClientRegistration.js';
+import * as oauthSettingsStore from '../../src/services/oauthSettingsStore.js';
+import type { ServerConfig } from '../../src/types/index.js';
+
+describe('MCPHubOAuthProvider token refresh', () => {
+  const NOW = 1_700_000_000_000;
+  const TEN_MINUTES_MS = 10 * 60 * 1_000;
+  let nowSpy: jest.SpyInstance<number, []>;
+
+  beforeEach(() => {
+    nowSpy = jest.spyOn(Date, 'now').mockReturnValue(NOW);
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    nowSpy.mockRestore();
+  });
+
+  const baseConfig: ServerConfig = {
+    url: 'https://example.com/v1/sse',
+    oauth: {
+      clientId: 'client-id',
+      accessToken: 'old-access',
+      refreshToken: 'refresh-token',
+    },
+  };
+
+  it('refreshes access token when expired', async () => {
+    const expiredConfig: ServerConfig = {
+      ...baseConfig,
+      oauth: {
+        ...baseConfig.oauth,
+        accessTokenExpiresAt: NOW - 1_000,
+      },
+    };
+
+    const refreshedConfig: ServerConfig = {
+      ...expiredConfig,
+      oauth: {
+        ...expiredConfig.oauth,
+        accessToken: 'new-access',
+        refreshToken: 'new-refresh',
+        accessTokenExpiresAt: NOW + 3_600_000,
+      },
+    };
+
+    (oauthRegistration.initializeOAuthForServer as jest.Mock).mockResolvedValue({
+      config: {},
+    });
+    (oauthRegistration.refreshAccessToken as jest.Mock).mockResolvedValue({
+      accessToken: 'new-access',
+      refreshToken: 'new-refresh',
+      expiresIn: 3600,
+    });
+    (oauthSettingsStore.loadServerConfig as jest.Mock).mockResolvedValue(refreshedConfig);
+
+    const provider = new MCPHubOAuthProvider('atlassian-work', expiredConfig);
+
+    const tokens = await provider.tokens();
+
+    expect(oauthRegistration.refreshAccessToken).toHaveBeenCalledTimes(1);
+    expect(oauthSettingsStore.loadServerConfig).toHaveBeenCalledTimes(1);
+    expect(tokens?.access_token).toBe('new-access');
+    expect(tokens?.refresh_token).toBe('new-refresh');
+  });
+
+  it('returns cached token when not expired', async () => {
+    const freshConfig: ServerConfig = {
+      ...baseConfig,
+      oauth: {
+        ...baseConfig.oauth,
+        accessTokenExpiresAt: NOW + TEN_MINUTES_MS,
+      },
+    };
+
+    const provider = new MCPHubOAuthProvider('atlassian-work', freshConfig);
+    const tokens = await provider.tokens();
+
+    expect(tokens?.access_token).toBe('old-access');
+    expect(oauthRegistration.refreshAccessToken).not.toHaveBeenCalled();
+  });
+});