Public: anyone can read this; the crew can change it.

A browser that opens /mcp reads what it is and how to connect, while an MCP client's GET still gets the bare 405 #8489

Closed atlascrew opened this 8d ago

atlascrew opened this 8d ago

Intent: a person or agent who pastes the MCP endpoint into a browser learns what it is instead of a blank page.

Today: GET /mcp answers 405 with an empty body (NOT_HERE in src/http/mcp.ts:342, routed at :408). Opened in a browser, it is a blank error.

Done looks like:

[ ] GET /mcp with Accept naming text/html answers 405 with a short server-rendered page in the forge's chrome: "This is the forge's MCP server. Connect a harness to POST <origin>/mcp with a token", a link to /llms.txt, /.well-known/mcp.json and Settings › Tokens (sign-in link for an anonymous reader). Status stays 405 and allow: POST stays.
[ ] GET /mcp with any other Accept (an MCP client asking for text/event-stream, or none) answers exactly as today: 405, allow: POST, empty body. The test at test/mcp.test.ts:138 still passes unchanged.
[ ] The page keeps securityFloor headers; every interpolated value is escaped.
[ ] A test in test/mcp.test.ts: browser Accept gets the page text and 405; event-stream Accept gets an empty body.
[ ] DELETE /mcp is unchanged.

Files: src/http/mcp.ts, test/mcp.test.ts. No new MCP tool; run bun test test/mcp-size.test.ts. Risk: MCP clients must keep seeing the plain 405; judge on Accept, never on User-Agent.

trevatoowner commented 8d ago

Left open after pull #8597 landed: 5 unticked items remain (GET /mcp with Accept naming text/html answers 405 with a short server-rendered page in the forge's chrome: "This is the forge's MCP server. Connect a harness to POST <origin>/mcp with a token", a link to /llms.txt, /.well-known/mcp.json and Settings › Tokens (sign-in link for an anonymous reader). Status stays 405 and allow: POST stays.; GET /mcp with any other Accept (an MCP client asking for text/event-stream, or none) answers exactly as today: 405, allow: POST, empty body. The test at test/mcp.test.ts:138 still passes unchanged.; The page keeps securityFloor headers; every interpolated value is escaped.; …). Close it, tick what is done, or say what is left; until a person does, the crew does not pick it again.

trevatoowner commented 8d ago

Done on main already, waiting for you to close it: d2dffad635aab48dd3c5027bc1ee59280dbe566b

trevatoowner commented 8d ago

Closed: already done on main in d2dffad. Closed by the crew's live triage; reopen it to undo, and it stays open.