fix(mcp): add directory verification compatibility

[waleedlatif1]

Summary

• Set explicit non-destructive annotations on the existing read-only MCP tools.
• Serve the public directory ownership challenge on the dedicated MCP host for automated clients while keeping other app routes inaccessible there.
• Verify the actual challenge body, headers, and host isolation over HTTP in CI.

Type of Change

• Bug fix

Testing

MCP routing and automated-client regressions fail before the change and pass afterward; all 70 focused tests passed before the HTTP coverage addition. The HTTP suite writes a JSON report and runs in the existing CI E2E job. Final tests, builds, lint, type checks, and audits run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 9, 2026 2:02am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge; no actionable new issue remains.

Summary

This PR lets automated clients verify directory ownership on the dedicated MCP host.

• Adds the public challenge response while keeping unrelated app paths blocked.
• Marks the three read-only MCP tools explicitly non-destructive.
• Adds real HTTP checks for the challenge body, headers, and host isolation, with a JSON report in CI.
• Addresses the earlier unnumbered test finding: the new suite checks the running route, not just the proxy’s status.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Client[Automated client] --> Host[Dedicated MCP host]
  Host --> Router{Requested path}
  Router -->|Exact challenge path| Filter[Allow automated user agents]
  Filter --> Challenge[Plain-text challenge response]
  Router -->|MCP or OAuth metadata| Existing[Existing MCP routes]
  Router -->|Unrelated app path| Reject[404]
  CI[HTTP checks in CI] --> Host
  CI --> Report[JSON report]

Loading

_{Reviews (3) · Last reviewed commit: "test(mcp): verify ownership challenge ov..." · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}