Allow public exposure for internal-sourced MCP servers, add custom endpoint path

[anilguleroglu]

Summary

An MCP server sourced from an internal Console capability (sourceType: 'internal', or a composite with such a member) could not be exposed on a public, unauthenticated URL — assertPublicExposureAllowed rejected the save. That restriction is removed: publishing that data publicly is now an intentional, supported choice, surfaced with a warning instead of a hard block. Separately, a server's public endpoint path (endpointSlug) can now be a caller-chosen value instead of only a random 16-char slug.

Changes

• Remove assertPublicExposureAllowed (composite.ts) and its three call sites in mcpService.ts (create/composite-create/update). isInternalSourced is kept — it now only drives the UI warning, no longer gates a write.
• Remove the matching defense-in-depth 404 in public-mcp.ts (resolvePublicServer) that blocked serving an internal-sourced server even if one were saved as public.
• Add endpointSlug?: string to CreateMcpServerInput/UpdateMcpServerInput. A new resolveEndpointSlug in mcpService.ts normalizes the caller's value (slugify, 8–80 chars — the 8-char floor matches what public-mcp.ts already requires and what a2aExposure.ts uses for agent slugs), checks tenant-wide uniqueness via findMcpServerByEndpointSlug, and errors (never silently de-duplicates, unlike key) if it's taken. Omitting it keeps today's random-slug behavior.
• plugins/mcp.ts: parse body.endpointSlug on create/update; map the new service errors to 400 (bad format) / 409 (path taken) instead of falling through to 500.
• CreateMcpModal.tsx: removed the JS-side auto-reset that flipped a composite back to "API token required" when it picked up an internal member while public was selected; added an orange warning Alert (now covers both plain internal sourceType and composite-with-internal-member, previously only the latter) and a "Custom path" TextInput shown when access mode is public.
• [id]/page.tsx (server detail page): the previously read-only "Endpoint Slug" panel is now inline-editable (mirrors the existing "Server Key" edit pattern), and the same orange warning is shown on the Overview tab when an internal-sourced server is currently public.
• Updated/added unit + integration tests for the removed gate (now asserts success instead of a throw) and the new custom-slug behavior (format validation, uniqueness conflict, rename, re-saving one's own current path).

Validation

• npm run lint (0 errors; 1 pre-existing unrelated warning in CreateMcpModal.tsx)
• npm run test (full suite; all non-MongoDB-backed tests pass — the MongoDB-parity suites fail in this sandbox because mongodb-memory-server can't download its binary without network access, unrelated to this change)
• npm run build
• npm run docs:build (no docs changed)

Release Notes

• Docs updated when behavior changed — no user-facing docs currently describe MCP exposure rules; happy to add a note if there's a place for it.
• Security-sensitive changes reviewed — this intentionally removes a guardrail that blocked exposing tenant-internal data publicly; the new behavior is opt-in per server and surfaced with an explicit warning in both the create form and the server detail page.
• License or policy files updated — n/a

---

Requested via chat: "Bu kuralı kaldıralım ek olarak public olanda da özel path verebilmemiz lazım. Amaç zaten içerideki datayı dışarı açmak. Ama uyarı çıksın ekranda."

---

Generated by Claude Code