Files tagging, MCP fixes

[xprilion]

This pull request introduces several major features and improvements, including a robust @ mention system for referencing resources in chat, backend support and UI for per-server MCP mode configuration, parallel file inspection tooling, conversation title generation improvements, and various security and UI enhancements. Additionally, Paperclip is integrated as a new provider for biomedical paper search, with full configuration support. Below are the most important changes:

---

@ Mention System and Resource References

• Added a new Mention model and mentions field to MessageSend for structured resource references (servers and files) in chat (backend/openmlr/models.py).
• Implemented backend enrichment: referenced resources are prepended as hints to the agent message, with strong input sanitization to prevent prompt injection (backend/openmlr/routes/agent.py) [1] [2] [3].
• Mention values are sanitized (strip backticks, newlines, control chars, length capped) before prompt interpolation (backend/openmlr/routes/agent.py).

MCP Server Improvements

• MCP servers now support per-server mode configuration (Plan, Execute, or both), enforced in backend and surfaced in the API and UI (backend/openmlr/routes/settings.py, backend/openmlr/routes/mcp.py, README.md) [1] [2] [3] [4] [5] [6].
• MCP server live connection status is now broadcast to the frontend in real time from both the session manager and Celery worker, enabling accurate sidebar indicators (backend/openmlr/services/session_manager.py, backend/openmlr/tasks/agent_tasks.py) [1] [2].
• Proper MCP server cleanup/disconnection is performed in the Celery worker's finally block (backend/openmlr/tasks/agent_tasks.py).

Parallel File Inspection Tool

• New inspect_files tool allows concurrent reading and keyword scoring of multiple files/directories, with directory expansion, safety limits, and symlink/file-size validation for security (see changelog for details).

Conversation Title Generation Improvements

• Title generation is now deferred until after the third user message or page refresh, and will not overwrite an existing title. A race-condition guard ensures only untitled conversations are updated (backend/openmlr/routes/agent.py).

Provider Integration: Paperclip

• Added Paperclip as a biomedical paper search provider, with environment variable and UI configuration support (.env.example, backend/openmlr/routes/settings.py) [1] [2] [3] [4] [5] [6].

---

For a full breakdown of all changes, see the updated CHANGELOG.md.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.9% Duplication on New Code

See analysis details on SonarQube Cloud