specrails-desktop 2.18.0 → 2.18.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.18.0",
+  "version": "2.18.2",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/mcp/mcp-server.js

@@ -7,6 +7,7 @@ const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamable
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const mobile_event_bus_1 = require("../mobile/mobile-event-bus");
 const mcp_tiers_1 = require("./mcp-tiers");
+const agent_tier_1 = require("../agent-tier");
 const desktop_db_1 = require("../desktop-db");
 const catalog_1 = require("./tools/catalog");
 const types_1 = require("./tools/types");
@@ -88,7 +89,17 @@ class McpServerManager {
      * carry the `mcp-session-id` header.
      */
     async handleHttp(req, res) {
-        if (!this.isEnabledSetting()) {
+        // The external Settings ▸ MCP toggle gates THIRD-PARTY clients only. The
+        // in-app agent chat is first-party: it reaches this loopback endpoint through
+        // the bundled bridge, which always forwards the `x-specrails-agent-tier`
+        // header. Serving that request regardless of the toggle means the in-app
+        // agent gets its MCP by default with zero config on a fresh install (the
+        // toggle defaults OFF). Third-party clients (no agent-tier header) still get
+        // 404 until the user explicitly opts in. Both paths already sit behind
+        // requireLoopback + requireMcpAuth (scoped token), so this is not an auth
+        // relaxation — only the enable-toggle is bypassed for the first-party agent.
+        const isFirstPartyAgent = Boolean(req.headers[agent_tier_1.AGENT_TIER_HEADER]);
+        if (!this.isEnabledSetting() && !isFirstPartyAgent) {
             res.status(404).json(jsonRpcError('MCP is disabled. Enable it in the Specrails app under Settings ▸ MCP.', -32004));
             return;
         }