Align MCP server with the 2026-07-28 specification

[ejsmith]

Summary

• validate MCP Streamable HTTP Origin headers against the configured public and deployed origins
• tighten Client ID Metadata Document validation and HTTP cache handling
• align OAuth metadata, challenges, scopes, and authorization responses with the 2026-07-28 MCP specification
• preserve Exie's structured MCP tool errors and add wire-level coverage
• update the OpenAPI snapshot and generated Svelte API types

Why

This aligns the MCP and OAuth implementation with the 2026-07-28 specification while preserving down-level protocol support and the MCP server delivered in #2430.

Impact

Invalid browser origins are rejected with HTTP 403 on /mcp, while requests without an Origin header and requests from configured application/API origins continue normally. OAuth clients receive the required resource scope and issuer metadata. No public API or configuration keys are removed.

Verification

• Release backend build: 0 warnings, 0 errors
• MCP Origin middleware tests: 9 passed
• OAuth client metadata/cache tests: 12 passed
• OAuth/MCP integration tests: 71 passed
• OpenAPI snapshot tests: 4 passed
• Helm lint: production and development values passed
• Helm render: all configured production and development MCP origins verified
• Svelte npm run check: 0 errors, 0 warnings
• git diff --check: passed

Breaking changes

None.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:6be7f66af1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[niemyjski]

Looks good, just missing act assert arrange on tests for consistency.

[niemyjski]

Addressed the remaining review feedback in 6a530e6e3: the newly introduced tests now use explicit Arrange/Act/Assert sections, offline_access remains discoverable for MCP clients, and shared metadata caching honors s-maxage. Post-push build succeeds with 0 warnings/errors; focused metadata tests pass 9/9 and the protected-resource metadata endpoint test passes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:6a530e6e30

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:839d416bb1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f4dfa9deac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:cc1231e2f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:53b5e38d6f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.Insulation	37%	35%	286	❌
Exceptionless.Core	75%	67%	10164	✔
Exceptionless.Web	85%	69%	8089	✔
Exceptionless.AppHost	38%	41%	147	❌
Summary	78% (25184 / 32186)	67% (11900 / 17726)	18686	✔