开源MCP工具

简介

Overview

Global enterprises run a sprawl of systems that don't talk to each other — ERP, CRM, OA, HR, finance, databases, IM platforms across regions. FIM One is the all-in-one agent platform that wires every system you already run into one agent core — global SaaS on one side, the full China stack (Feishu, WeCom, DingTalk, DM, Kingbase, etc.) on the other. One brain. Every system. Global SaaS × China Stack.

Key Features

#### Cross-Border Connectivity - Three delivery modes — Standalone assistant, embedded Copilot, or central Hub; same agent core. - Any system, one pattern — Connect APIs, databases, MCP servers. Actions auto-register as agent tools with auth injection. Progressive disclosure meta-tools reduce token usage by 80%+ across all tool types. - Database connectors — PostgreSQL, MySQL, Oracle, SQL Server, and enterprise databases common in China (DM, KingbaseES, GBase, Highgo) that most global platforms can't reach. Schema introspection and AI-powered annotation. - Three ways to build — Import OpenAPI spec, AI chat builder, or connect MCP servers directly.

#### Planning & Execution - Dynamic DAG planning — LLM decomposes goals into dependency graphs at runtime. No hard-coded workflows. - Concurrent execution — Independent steps run in parallel via asyncio; auto re-plan up to 3 rounds. - ReAct agent — Structured reasoning-and-acting loop with automatic error recovery. - Agent harness — Production-grade execution environment: ContextGuard for 5-layer token-budget management, progressive-disclosure meta-tools to keep the tool surface tractable, and self-reflection loops to counter goal drift. - Hook System — Deterministic enforcement that runs outside the LLM loop. First shipped: FeishuGateHook gates sensitive tool calls behind a human approval card posted to a Feishu group. Extensible to audit logging, read-only-mode guards, and rate limits (v0.9). - Content guardrails — Three-layer safety: tool-permission hooks (actions), credential / SSRF / MCP-auth checks (protocols), and content guardrails (input/output text). Default jailbreak-phrase detector aborts the turn before the LLM is invoked, saving tokens and surfacing a clear blocked notice in chat. Output guardrails optional via FIM_GUARDRAILS_OUTPUT. - Auto-routing — Classifies queries and routes to optimal mode (ReAct or DAG). Configurable via AUTO_ROUTING. - Extended thinking — Chain-of-thought for OpenAI o-series, Gemini 2.5+, Claude. - Prompt-cache observability — Anthropic prompt-cache read/create token counts captured per turn, surfaced in the chat done payload and logged so operators can verify cache hits and detect relay stations that don't honor the discount.

#### Workflow & Tools - Visual workflow editor — 12 node types, drag-and-drop canvas (React Flow v12), import/export as JSON. - Smart file handling — Uploaded files auto-inlined into context (small) or readable on-demand via read_uploaded_file tool. Intelligent document processing: PDFs, DOCX, and PPTX files get vision-aware processing with embedded image extraction when the model supports vision. Smart PDF mode extracts text from text-rich pages and renders scanned pages as images. - Universal document conversion — Built-in convert_to_markdown tool turns PDF / Word / Excel / PowerPoint / HTML / images / audio / Outlook .msg / EPUB / YouTube transcripts into clean Markdown via Microsoft MarkItDown. Vision-capable LLMs OCR embedded images and scanned pages — works with Claude, Gemini, Bedrock, and any LiteLLM-supported provider, no per-provider adapter code. - Pluggable tools — Python, Node.js, shell exec with optional Docker sandbox (CODE_EXEC_BACKEND=docker). - V4A patch editing — Beyond find_replace, agents can apply line-hunk patches with fuzzy whitespace matching via file_ops.apply_patch — robust to multi-line edits where exact-substring match would be brittle. - Full RAG pipeline — Jina embedding + LanceDB + hybrid retrieval + reranker + inline [N] citations. Vision-aware ingestion routes scanned PDFs and Office embedded images through the workspace's default vision LLM for OCR. - Tool artifacts — Rich outputs (HTML previews, files) rendered in-chat.

#### Messaging Channels (v0.8) - Org-scoped IM bridge — BaseChannel abstraction for outbound messaging across Slack, Microsoft Teams, Discord, Feishu (Lark), WeCom, and DingTalk. First shipping implementation is Feishu; Slack / Teams / WeCom / Email are next on the v0.9 roadmap. - Fernet-encrypted credentials — App secrets and encrypt keys encrypted at rest; every inbound callback signature-verified. - Interactive approval cards — Channel-native GateHook (Feishu today, Slack/Teams next) posts an Approve / Reject card to your group when a sensitive tool call fires; the tool blocks until a group member taps a verdict. Human-in-the-loop approval without a custom workflow engine. - Configurable approval routing per agent — Three modes (Auto / Inline only / Channel only) with an approver-scope selector (initiator / agent owner / any org member). One audit path stamps approver_user_id and decided_at whether the verdict came from chat or from the channel. Auto mode falls back to inline if no channel is linked, so agents always get a real approval UX. - Task-completion notifications — Long-running ReAct or DAG agents can push a summary card to the org's channel when work finishes. Configurable per-agent in Settings → Agent → Notifications. - Browse-and-pick UI — No copying raw channel IDs from the vendor console; the portal calls the IM platform's API and shows a group picker.

#### Platform - Multi-tenant — JWT auth, org isolation, admin panel with usage analytics and connector metrics. Multi-worker support via WORKERS=N with a Redis interrupt broker for cross-worker relay. - Marketplace — Publish and subscribe to agents, connectors, KBs, skills, workflows. - Global skills (SOPs) — Reusable operating procedures loaded for every user; progressive mode cuts tokens ~80%. - Stripe billing & per-user quotas — Optional Pro-plan upgrade via Stripe Checkout + Customer Portal. Quota chain (per-user override → plan tier → system default) with 0 for unlimited. Admin feature flag gates the entire pipeline; private deployments without Stripe stay clean. - Evaluation Center — Test-dataset management, parallel eval runs with LLM-graded judgments, per-case pass/fail/latency/token results viewer with auto-polling. - Conversation recovery — Synthetic tool_result rows persist after interrupted turns; clients auto-reconnect dropped SSE streams via /chat/resume with exponential backoff and a "Reconnecting…" indicator. - 6 languages — EN, ZH, JA, KO, DE, FR. Translations are fully automated — single glossary drives every LLM translation call (JSON, MDX, README), pre-commit hook refuses manual edits to generated locale files. - First-run setup wizard, dark/light theme, command palette, streaming SSE, DAG visualization.

Deep dive: Architecture · Hook System · Channels · Execution Modes · Why FIM One · Competitive Landscape