fix(mcp): publish connector metadata and directory verification

[waleedlatif1]

Summary

• Publish MCP request-body object schemas and complete tool annotations so connector clients receive usable metadata.
• Serve the public directory ownership challenge on the dedicated MCP host for automated clients while keeping unrelated app routes blocked.
• Include HTTP coverage for the challenge response, headers, and host isolation, with a JSON report in CI.

Type of Change

• Bug fix

Testing

• Both component changes (fix(mcp): declare request bodies and annotation titles #8827 and fix(mcp): add directory verification compatibility #8825) passed CI and automated review before merging into staging.
• The MCP server and ownership-verification files match the reviewed staging versions.
• CI reruns the full test, integration, HTTP E2E, build, lint, type-check, and audit gates against the combined production change.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (combined production CI pending)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 9, 2026 2:22am UTC

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge based on the reviewed changes.

Summary

This PR publishes MCP body schemas and tool annotations, adds the public ownership challenge, and lets automated clients reach it on the dedicated MCP host.

• Other app routes remain blocked on the dedicated host.
• The new HTTP suite checks the challenge body, headers, and host isolation, then writes a JSON report for CI.
• No actionable new issues were found. No previous review threads were supplied.
• Review checks were based on source inspection; tests were not run.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Client[Client on dedicated MCP host] --> Proxy[Check request path]
  Proxy -->|Exact ownership challenge path| Challenge[Return public token]
  Proxy -->|Canonical MCP path| MCP[MCP server]
  Proxy -->|OAuth metadata path| Metadata[Return discovery metadata]
  Proxy -->|Other paths| Reject[Return 404]

Loading

_{Reviews (2) · Last reviewed commit: "fix(mcp): add directory verification com..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}