Enable browser access and publish MCP endpoints

[jasonmadigan]

Summary

• Enable browser access at the gateway without a CORS API or route config.
• Publish the client URL in status.mcpEndpoint.

Test evidence

make lint-go, make check, make test-unit, and make test-controller-integration

Relates to #604 and Kuadrant/kuadrant-console-plugin#752.

Summary by CodeRabbit

• New Features

  • Added browser access for MCP gateways with cross-origin requests and CORS preflight support.
  • Browser requests require authentication for MCP operations; cookies are not forwarded.
  • Added the public MCP endpoint URL to gateway status, including configured non-default ports.

• Documentation

  • Updated setup, migration, security, reference, and release documentation for browser access, routing, and endpoint status.

[coderabbitai]

Warning

Review limit reached

Next included review available in 34 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6fe96141-6d52-452e-8e5b-5f9a51322cad

📥 Commits

Reviewing files that changed from the base of the PR and between ceca711 and a708afe.

📒 Files selected for processing (1)

• tests/e2e/raw_mcp_http.go

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e646ff6-4957-4290-a31b-40c0cd04cb56

📥 Commits

Reviewing files that changed from the base of the PR and between 8fb9b27 and ceca711.

⛔ Files ignored due to path filters (2)

• charts/mcp-gateway/crds/mcp.kuadrant.io_mcpgatewayextensions.yaml is excluded by !charts/mcp-gateway/crds/**
• config/crd/mcp.kuadrant.io_mcpgatewayextensions.yaml is excluded by !config/crd/mcp.kuadrant.io_*.yaml

📒 Files selected for processing (28)

• api/v1/mcpgatewayextension_types.go
• bundle/manifests/mcp.kuadrant.io_mcpgatewayextensions.yaml
• cmd/mcp-broker-router/broker.go
• docs/design/security-architecture.md
• docs/guides/configure-mcp-gateway-listener-and-router.md
• docs/guides/how-to-install-and-configure.md
• docs/guides/migrating-mcpgatewayextension.md
• docs/reference/mcpgatewayextension.md
• docs/release-notes/browser-access.md
• internal/broker/oauth_protected_resource_handler.go
• internal/broker/oauth_protected_resource_handler_test.go
• internal/broker/status.go
• internal/broker/user_specific_tools.go
• internal/broker/user_specific_tools_test.go
• internal/controller/broker_router.go
• internal/controller/deployment_test.go
• internal/controller/mcpgatewayextension_controller.go
• internal/headers/headers.go
• internal/mcp-router/ext_proc_adapter.go
• internal/mcp-router/ext_proc_adapter_test.go
• internal/mcp-router/response_builder.go
• internal/routing/mcp_request.go
• internal/routing/router_202511.go
• internal/routing/router_202607.go
• internal/routing/router_202607_test.go
• internal/routing/router_test.go
• tests/e2e/auth_policy_test.go
• tests/e2e/test_cases.md

💤 Files with no reviewable changes (2)

• internal/broker/status.go
• cmd/mcp-broker-router/broker.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The gateway now supports browser CORS preflight and response headers, removes browser-scoped headers before upstream forwarding, and publishes the resolved MCP URL through status.mcpEndpoint. Related handlers, routing logic, reconciliation, tests, manifests, and documentation were updated.

Changes

Browser access and endpoint publication

Layer / File(s)	Summary
Publish resolved MCP endpoint api/v1/..., bundle/manifests/..., internal/controller/..., docs/reference/...	The API and CRD expose mcpEndpoint. Reconciliation computes HTTP and HTTPS URLs, including non-default ports, and persists endpoint changes in status.
Process browser CORS responses cmd/mcp-broker-router/..., internal/broker/..., internal/mcp-router/..., tests/e2e/..., docs/guides/..., docs/release-notes/...	The external processor handles browser preflight with 204, adds CORS headers to MCP responses, and leaves subsequent authentication enforcement unchanged. Broker handlers no longer handle CORS preflight directly.
Filter browser headers before forwarding internal/headers/..., internal/routing/..., internal/broker/..., docs/design/...	Browser-origin requests remove browser hop headers and gateway-internal headers before upstream forwarding. Authorization remains available unless token exchange replaces it.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to ceca7

The browser-access and MCP endpoint changes introduce no actionable merge-blocking risk at the current head; the PR is merge-ready after normal checks and review.

Suggested labels: review-effort/large, high-risk

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the two main changes: browser access and published MCP endpoints.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jasonmadigan]

@david-martin added some additional docs re: security + CORS per our discussion earlier

[jasonmadigan]

TODO: is this necesary? surely it's derivable.. need to look.