{...}: {
  # opencode MCP servers, installed declaratively instead of via the dotfiles
  # `install` script (which downloads prebuilt binaries into ~/.local/bin).
  #   - gitea-mcp : packaged in nixpkgs as gitea-mcp-server (binary: gitea-mcp)
  #   - engram    : not in nixpkgs, built here from source with buildGoModule
  # Both are referenced by bare command name in opencode.jsonc, so they resolve
  # from PATH.
  flake.nixosModules.opencode-mcp = {pkgs, ...}: let
    engram = pkgs.buildGoModule rec {
      pname = "engram";
      version = "1.20.0";

      src = pkgs.fetchFromGitHub {
        owner = "Gentleman-Programming";
        repo = "engram";
        rev = "v${version}";
        hash = "sha256-qdKAll7N0HtJRbZYilzatVCUz1Tr+pqM217Y8O+Csjs=";
      };

      vendorHash = "sha256-O+pC4x4DKNUWr7Sx9iZOjK6a64wrQA4/lnjvkNLBX64=";

      subPackages = ["cmd/engram"];

      # Inject the version (upstream sets main.version via goreleaser ldflags).
      ldflags = ["-s" "-w" "-X" "main.version=${version}"];

      # Upstream tests bind network ports (autosync), which fails in the Nix
      # build sandbox. The binary itself builds fine.
      doCheck = false;

      meta = with pkgs.lib; {
        description = "Persistent memory MCP server for coding agents";
        homepage = "https://github.com/Gentleman-Programming/engram";
        license = licenses.mit;
        mainProgram = "engram";
      };
    };
  in {
    environment.systemPackages = [
      pkgs.gitea-mcp-server # provides the `gitea-mcp` binary
      engram
    ];
  };
}