xarmian 5d641b70d0 docs: MCP over HTTP on a self-hosted install (TASK-3304, PLAN-2310 U7) (#1669) ...

* docs: MCP over HTTP on a self-hosted install (TASK-3304, PLAN-2310 U7)

docs/deployment.md gains "MCP for agents (self-hosted)": off by default;
the origin (PAD_URL / toml url / --url, else PUBLIC_URL, with no
host:port fallback), PAD_MCP_PUBLIC_URL, PAD_AUTH_SERVER_URL and
PAD_MCP_ENABLED with their precedence and startup-time nature; the admin
toggle (GET/PUT /api/v1/admin/mcp, the env lock, the readiness readout);
https means OAuth plus tokens and http tokens only; the reverse-proxy Host
requirement and PAD_TRUSTED_PROXIES; and the known gaps. .env.example,
CLAUDE.md's API and MCP sections, and README follow.

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

* docs: .env.example says MCP's toggle and origin are self-host rules (TASK-3304, codex r1)

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

* docs: the MCP host check and rate limits as merged (TASK-3304, PLAN-2310 U7)

Checked against U3 (#1665) and U4 (#1667) on main:
- The 421: honours X-Forwarded-Host only from a PAD_TRUSTED_PROXIES
  peer; the body names the received host, its header and the configured
  origin; the first refusal per host is a rate-limited WARN; it runs
  before auth and after the availability gate.
- The DR-9 limits as a table. Claim redemption is keyed per signed-in
  user, not per address, as the earlier draft said.
- Pre-auth /mcp refusals are counted in pad_mcp_preauth_denied_total
  with a WARN per address, not audit rows. The once-per-process WARN
  when a proxied request resolves inside PAD_TRUSTED_PROXIES.

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

* docs: the console toggle and the pre-auth counter's scope (TASK-3304, codex r2)

- The console now has the MCP section (#1666): Admin → Settings → MCP for
  agents. The "console does not show it yet" sentence is gone, and
  .env.example names both ways to toggle.
- codex r2: pad_mcp_preauth_denied_total counts missing/invalid-token
  refusals and the pre-auth 429s, not the 421 host refusals, which
  happen before it.

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

* docs: OAuth follows the issuer URL; tokens keep their scopes (TASK-3304, codex r3)

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

2026-09-29 17:29:55 -04:00

..

screenshots

test(screenshots): capture in dark mode (Pad's default theme) (#319)

2026-04-30 13:10:51 -04:00

architecture.md

ci(web): decide the npm audit gate from the report, not the exit code, and run it last (BUG-2881) (#1247)

2026-09-04 10:45:21 -04:00

backup.md

refactor(store): delete the NUL SUSPECT path, now that the predicate sees a NUL behind a repeated key (BUG-3220) (#1561)

2026-09-26 01:09:03 -04:00

brand.md

feat(web): Community link (GitHub Discussions) in the user menu and auth footer (TASK-2888) (#1251)

2026-09-04 23:42:15 -04:00

deployment.md

docs: MCP over HTTP on a self-hosted install (TASK-3304, PLAN-2310 U7) (#1669)

2026-09-29 17:29:55 -04:00