feat(mcp): add server visibility sharing

[sriaradhyula]

Description

Adds first-class access controls to the MCP server editor:

• Private: only the owner and organization admins can discover or invoke the server.
• Teams: selected team members can discover and invoke; team admins can manage.
• Global: every authenticated organization member can discover and invoke.

The BFF persists visibility and shared_with_teams, validates team slugs, and reconciles OpenFGA grants and revocations on create/update. Existing unclassified servers retain their legacy policy until an owner explicitly selects a scope. AgentGateway sync preserves an explicit policy so a later repair does not remove global or team access. RBAC self-check projections are updated for the new tuples.

Validation:

• npx tsc --noEmit
• npm run lint
• npm run build
• 102 focused Jest tests across MCP API, editor, AgentGateway sync, OpenFGA reconciliation, and RBAC self-checks

Type of Change

• Bugfix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe)

Pre-release Helm Charts (Optional)

Not applicable; no chart changes.

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable)
• I have verified this change is not present in other open pull requests
• Functionality is documented
• All code style checks pass
• New code contribution is covered by automated tests
• All new and existing tests pass

[github-actions]

✅ No proprietary content detected. This PR is clear for review!

[github-actions]

🧪 CAIPE UI Test Results

✅ All tests passed

🟡 Overall Coverage: 61%

📊 Detailed Coverage

Metric	Covered	Total	Percentage
Lines	35881	54086	66.34%
Statements	38327	59699	64.20%
Functions	6647	11082	59.98%
Branches	23701	44050	53.80%

✅ Test Suites

• ✅ auth-guard.test.tsx - Route protection & authorization
• ✅ token-expiry-guard.test.tsx - Token expiry handling
• ✅ dynamic-agent-client.test.ts - Dynamic Agents streaming client
• ✅ auth-utils.test.ts - Authentication utilities (100% coverage)
• ✅ auth-config.test.ts - OIDC configuration

📈 Coverage Thresholds

Threshold	Target	Current	Status
Minimum	40%	61%	✅ Pass
Good	60%	61%	✅ Pass
Excellent	80%	61%	⚠️ Below target

⚠️ Areas Needing Tests

High Priority:

• lib/streaming/* - Core stream event handling
• store/chat-store.ts - Chat state management
• store/agent-skills-store.ts - Agent skills
• lib/api-client.ts - API communication
• lib/storage-mode.ts - MongoDB/localStorage switching

Medium Priority:

• components/chat/ChatPanel.tsx - Main chat interface
• components/agent-builder/* - Agent builder UI
• lib/mongodb.ts - MongoDB integration

---

💡 Run locally: make caipe-ui-tests
📦 Full report: Check workflow artifacts

[caipe-ci-release]

Prebuild Artifacts for 26e7c70

Branch: prebuild/feat/mcp-server-sharing
Commit: 26e7c70

Docker Images

Artifact	Image	Tag	Status	CI
caipe-ui	ghcr.io/cnoe-io/prebuild/caipe-ui	feat-mcp-server-sharing-3	Published	CI

Docker pull commands

docker pull ghcr.io/cnoe-io/prebuild/caipe-ui:feat-mcp-server-sharing-3

These prebuild artifacts will be automatically cleaned up when the PR is closed or merged.