diff --git a/internal/app/app.go b/internal/app/app.go
index 944ca2e..1e35312 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -32,6 +32,7 @@ import (
 	"github.com/yan1h/agent-coding-workflow/internal/acp"
 	"github.com/yan1h/agent-coding-workflow/internal/audit"
 	"github.com/yan1h/agent-coding-workflow/internal/chat"
+	mcp "github.com/yan1h/agent-coding-workflow/internal/mcp"
 	"github.com/yan1h/agent-coding-workflow/internal/config"
 	"github.com/yan1h/agent-coding-workflow/internal/infra/clock"
 	"github.com/yan1h/agent-coding-workflow/internal/infra/crypto"
@@ -80,14 +81,15 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 	}
 
 	auditRec := audit.NewPostgresRecorder(pool)
+	wrappedAudit := mcp.AuditWrap(auditRec) // 给业务 service 用，自动注入 via_mcp metadata
 
 	userRepo := user.NewPostgresRepository(pool)
 	userSvc := user.NewService(userRepo, auditRec)
 
 	projectRepo := project.NewPostgresRepository(pool)
-	projectSvc := project.NewProjectService(projectRepo, auditRec)
-	requirementSvc := project.NewRequirementService(projectRepo, auditRec)
-	issueSvc := project.NewIssueService(projectRepo, auditRec)
+	projectSvc := project.NewProjectService(projectRepo, wrappedAudit)
+	requirementSvc := project.NewRequirementService(projectRepo, wrappedAudit)
+	issueSvc := project.NewIssueService(projectRepo, wrappedAudit)
 
 	notifyRepo := notify.NewPostgresRepository(pool)
 	notifyDispatcher := notify.NewDispatcher(notifyRepo, log)
@@ -251,6 +253,26 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 	chat.NewHandler(chatConvSvc, chatMsgSvc, chatTplSvc, chatEpSvc, chatUsageSvc,
 		chatUploader, userSvc, userAdminAdapter{svc: userSvc}).Mount(r)
 
+	// ===== MCP 模块装配 =====
+	mcpRepo := mcp.NewPostgresRepository(pool)
+	mcpTokenSvc := mcp.NewTokenService(mcpRepo, auditRec, nil) // mcp 自身 audit 不需要 via_mcp 标记
+	mcpRateLimiter := mcp.NewRateLimiter(mcp.RateLimitConfig{
+		PerTokenPerMinute: cfg.MCP.RateLimit.PerTokenPerMinute,
+		GlobalPerMinute:   cfg.MCP.RateLimit.GlobalPerMinute,
+	}, nil)
+	mcpDeps := mcp.ServerDeps{
+		Caller:        mcp.NewCallerResolver(userSvc),
+		Projects:      projectSvc,
+		Reqs:          requirementSvc,
+		Issues:        issueSvc,
+		Workspaces:    wsSvc,
+		Templates:     chatTplSvc,
+		Messages:      chatMsgSvc,
+		Conversations: chatConvSvc,
+	}
+	mcpServer := mcp.NewMCPServer(mcpDeps)
+	mcp.MountTransports(r, mcpServer, mcpTokenSvc, mcpRateLimiter)
+
 	// ===== ACP module wiring (Part 2: full SessionService + Supervisor) =====
 	acpRepo := acp.NewPostgresRepository(pool)
 	akSvc := acp.NewAgentKindService(acpRepo, enc, auditRec)