# Roadmap

Where the project stands and what is deliberately not planned. Design decisions are in
[docs/adr](adr/0001-full-access-by-default.md).

## 1.0.0

1.0.0 is a breaking rebuild of 0.x:

- one tool per operation of the pinned Gitea 28.1.0 swagger (537) plus `gitea_api_request`;
- stdio and streamable HTTP on the official `mcp` SDK;
- admin-token mode and per-user OAuth with dynamic client registration;
- a `setup` command, a generated tool inventory and a docs drift check in CI;
- live-Gitea integration tests and MCP smoke tests in CI.

The gates that 0.x used to restrict a shared service token (write opt-in, a policy file, per-resource
checks) are gone, together with the old web adapter and its extras (ADR 0001, 0006). All tool names
changed to `gitea_<domain>_<action>`.

## Known limits

- Tool list size. 538 tools is a lot for clients without tool search. Use `TOOLSETS`,
  `READ_ONLY` and `DISABLED_TOOLS` for a slim profile. How claude.ai and Mistral Le Chat cope
  with the full list is to be confirmed against the real clients.
- Gitea has no queue management, no instance configuration writes and no instance-wide OAuth
  application endpoints, so there are no tools for them.
- The catalog follows one pinned swagger. A newer Gitea needs a re-pin and regeneration, and
  `gitea_api_request` covers the gap in the meantime.
- Some operations need state that is hard to reproduce in CI (a registered runner executing a
  job, a reachable remote for mirrors and migrations, uploaded packages). The integration sweep
  calls every tool, and asserts Gitea's documented response where a full happy path is not
  reproducible.
- In OAuth mode the server holds per-user Gitea tokens, encrypted at rest. That store is the most
  sensitive asset after the admin token.

## Not planned

- A policy engine or per-repository allow lists inside the server. Restrict with the token's
  scopes, per-user OAuth and the tool filters.
- Metrics endpoints, webhook ingest and scheduled jobs. This is an API bridge.
- Scraping the Gitea web UI for features the API lacks.

## Possible later work

- Re-pinning to newer Gitea releases as they ship.