fix(mcp): add directory verification compatibility

[waleedlatif1]

Summary

• Set explicit non-destructive annotations on the existing read-only MCP tools.
• Serve the public directory ownership challenge on the dedicated MCP host for automated clients while keeping other app routes inaccessible there.
• Verify the actual challenge body, headers, and host isolation over HTTP in CI.

Type of Change

• Bug fix

Testing

MCP routing and automated-client regressions fail before the change and pass afterward; all 70 focused tests passed before the HTTP coverage addition. The HTTP suite writes a JSON report and runs in the existing CI E2E job. Final tests, builds, lint, type checks, and audits run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 9, 2026 1:53am UTC

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issues were found.

Summary

This PR marks existing read-only MCP tools as non-destructive and serves the public ownership challenge on the dedicated MCP host.

• Automated clients can fetch the exact challenge path without being blocked by the user-agent filter.
• Other app routes remain blocked on the dedicated host.
• The new HTTP suite checks the challenge body, headers, and host separation in CI.
• No new actionable issues were found. Tests were not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[HTTP request] --> B{Dedicated MCP host?}
  B -->|No| C[Normal app routing]
  B -->|Yes| D{Allowed path?}
  D -->|MCP or resource metadata| E[Rewrite to internal route]
  D -->|Ownership challenge| F[Serve fixed plain-text challenge]
  D -->|Authorization metadata| G[Serve discovery metadata]
  D -->|Other path| H[Return 404]

Loading

_{Reviews (2) · Last reviewed commit: "test(mcp): verify ownership challenge ov..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>