docs: freeze hosted MCP security boundary

[reprewindai-dev]

Documents the source contract introduced by the cAPI MCP/direct-proxy security remediation so future work cannot rely on chat history or comments as the security control.

Covers hosted-production local-process prohibition, registry auth, direct-proxy internal auth, fail-closed configuration, child environment isolation, remote-MCP expectations and required deployed negative verification.

Docs only; does not claim live capi.veklom.com has deployed the source fix.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
c-api	Building	Preview	Aug 23, 2026 2:27pm
veklom-id-59uw	Building	Preview	Aug 23, 2026 2:27pm

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b5544ceb-6425-4ef6-9018-7eb8f3a4d0e7

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}