feat(fe): gate MCP card and /mcp route behind a feature flag#4031
Open
aterga wants to merge 6 commits into
Open
feat(fe): gate MCP card and /mcp route behind a feature flag#4031aterga wants to merge 6 commits into
aterga wants to merge 6 commits into
Conversation
Adds an `MCP` feature flag (defaulting off everywhere except id.ai and beta.id.ai) to control visibility of the McpAccessSection settings card and the /mcp delegation flow. On unsupported deployments the card is hidden and the /mcp route falls through to the invalid screen, the same way missing mcp_server_origin already does. Co-Authored-By: Claude <noreply@anthropic.com>
|
✅ No security or compliance issues detected. Reviewed everything up to 007c922. Security Overview
Detected Code Changes
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a new frontend feature flag (MCP) to ensure MCP UI and the /mcp delegation flow are only available on id.ai / beta.id.ai by default, while remaining disabled on self-hosted/other deployments unless explicitly enabled via deploy args or runtime overrides.
Changes:
- Added an
MCPfeature flag store defaulting off, auto-enabled onid.ai/beta.id.ai. - Hid the MCP access card on the Settings page behind the
$MCPflag. - Gated
/mcprequest validation behind$MCPso disabled deployments fall back to the existing “Invalid request” screen.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/frontend/src/routes/(new-styling)/mcp/+page.svelte | Adds $MCP to the /mcp request-validity gate so the flow is disabled when the flag is off. |
| src/frontend/src/routes/(new-styling)/manage/(authenticated)/settings/+page.svelte | Conditionally renders the MCP settings card only when $MCP is enabled. |
| src/frontend/src/lib/state/featureFlags.ts | Defines the new MCP feature flag (auto-enabled on id.ai/beta.id.ai) and exports it. |
| package-lock.json | Lockfile updates related to dependency graph changes during install. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+155
to
+161
| /// Show the MCP access card in settings and allow the /mcp delegation flow. | ||
| /// Defaults on for id.ai and beta.id.ai; off everywhere else. | ||
| export const MCP = createFeatureFlagStore( | ||
| "MCP", | ||
| false, | ||
| enableOnIdAiDomains("MCP"), | ||
| ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MCPfeature flag infeatureFlags.tsthat defaults off everywhere exceptid.aiandbeta.id.ai(matching theEMAIL_RECOVERY_SETUPpattern)McpAccessSectionin the Settings page behind{#if $MCP}so the card is hidden on self-hosted / other deployments/mcpdelegation route by including$MCPin therequestValidderived — when the flag is off, the route falls through to the existing "Invalid request" screenThe flag can be overridden per-deployment via the canister
feature_flagsdeploy arg, or at runtime viawindow.__featureFlags.MCP/?feature_flag_MCP=true/ localStorage, consistent with all other flags. E2e tests are unaffected because they run againstid.aiwhere the flag auto-enables.Test plan
id.ai/beta.id.ai: MCP card still visible in Settings;/mcpflow works normally/mcpshows "Invalid request"feature_flags = opt vec { ("MCP", true) }in deploy argswindow.__featureFlags.MCP.set(true/false)id.aitest origin)🤖 Generated with Claude Code
Generated by Claude Code