[FEATURE]: Allow per-MCP-server trust configuration #40111

Problem

Many MCP servers run inside private networks without publicly trusted TLS certificates.

Examples include:

• OPNsense / pfSense firewalls
• TrueNAS / Synology appliances
• Proxmox servers
• Kubernetes clusters
• Home Assistant
• Enterprise internal services

These services commonly use:

• Self-signed certificates
• Private certificate authorities
• Internal DNS names
• Private IP addresses

MCP clients reject these connections because the certificates are not signed by a public CA.

Current workarounds are not ideal:

• Disable TLS verification globally (NODE_TLS_REJECT_UNAUTHORIZED=0)
• Modify the operating system certificate store
• Use NODE_EXTRA_CA_CERTS
• Run a local proxy/bridge to terminate TLS
• Require users to replace appliance certificates

These approaches reduce security, add complexity, or defeat simple MCP setup.

Proposed Solution

Add per-MCP-server TLS trust configuration, scoped to one server only.

Option 1: Custom CA file

{
  "type": "http",
  "url": "https://192.168.1.1/mcp",
  "tls": {
    "caFile": "~/.config/mcp/opnsense-ca.pem"
  }
}

Option 2: Embedded CA certificate

{
  "type": "http",
  "url": "https://192.168.1.1/mcp",
  "tls": {
    "caPem": "-----BEGIN CERTIFICATE-----..."
  }
}

Option 3: Certificate fingerprint pinning

Similar to SSH host key verification.

{
  "type": "http",
  "url": "https://192.168.1.1/mcp",
  "tls": {
    "fingerprint": "SHA256:ABC123..."
  }
}

Useful for home labs, network appliances, private IP services, and devices without public DNS.

Why NODE_EXTRA_CA_CERTS is not sufficient

1. Process-wide, not MCP-server scoped

 OpenCode process
|
+-- Homelab appliance MCP server (installed on the homelab appliance e.g opnsense, pfsense, docker host)
+-- GitHub API
+-- Other MCP servers
+-- Other HTTPS requests

Adding a private CA via NODE_EXTRA_CA_CERTS trusts that CA for all TLS connections in the process.

2. Requires runtime/environment configuration

Users must understand where to place cert files, how to set env vars, how the client launches Node, and whether it respects Node env vars. This breaks the expected workflow:

1. Install MCP server
2. Import MCP configuration
3. Use MCP

3. Inconsistent across MCP clients

Different clients bundle their own Node runtime, use Electron, or different HTTP libraries.

4. No certificate pinning

Cannot express "trust this one specific certificate":

SHA256:AA:BB:CC:DD:...

Security Requirements

The implementation should:

• Keep TLS verification enabled by default
• Avoid global TLS bypasses
• Scope trust to one MCP server
• Show when custom trust is configured

The implementation should not require NODE_TLS_REJECT_UNAUTHORIZED=0 or --ignore-certificate-errors.

Expected User Experience

1. Install MCP plugin on homelab appliance with self signed cert
2. Download/generate MCP configuration
3. Add MCP server to opencode project
4. Start using the MCP

The user should not need to manually configure certificates, modify system trust stores, or install additional bridges.