feat: expose MCP over HTTP

[pilipilisbot]

Summary

• expose the read-only MCP server over dashboard HTTP at POST /api/mcp
• authenticate MCP HTTP requests with existing hashed MCP bearer tokens
• show whether the MCP dashboard URL is configured, forwarded by the proxy, or still missing a public URL
• update the MCP dashboard setup guide and docs so remote agents use the public /api/mcp endpoint without installing gab
• remove local stdio fallback guidance from the dashboard and MCP docs so HTTP MCP is the only documented agent connection path

Tests

• npm test -- src/main.test.tsx (42 passed)
• npm run build
• PYTHONPATH=src ../github-agent-bridge/.venv/bin/pytest -q tests/test_mcp.py tests/test_backend.py::test_dashboard_status_reports_configured_public_url tests/test_backend.py::test_dashboard_status_reports_forwarded_public_url (5 passed)

Follow-up to #141 / #140.

Screenshot

[ecarreras]

@pilipilisbot la url entenc que serà la pública, la captura semblança privada i això ja t'ho havia comentat

[pilipilisbot]

Fixed in 17a51eb.

• /api/status now reports whether the dashboard URL came from GITHUB_AGENT_BRIDGE_DASHBOARD_PUBLIC_URL, forwarded proxy headers, or the raw request.
• The MCP setup page shows that source next to the public dashboard URL and warns admins before sharing a request-derived/local URL with remote agents.
• I updated the PR body screenshot to show the configured public URL (https://bridge.example.com/...) instead of a private-looking address.

Checks are green: pytest (3.11), pytest (3.12), and dashboard all passed on the pushed commit. Local verification also passed with PYTHONPATH=src ../github-agent-bridge/.venv/bin/pytest -q, npm test, and npm run build.

[ecarreras]

@pilipilisbot per mi pots eliminar el local fallback

[pilipilisbot]

Implemented in 590a448.

• Removed the local stdio fallback card from the MCP dashboard setup flow.
• Updated docs/mcp.md so the documented agent connection path is the public HTTP /api/mcp endpoint, without installing or launching gab on the agent host.
• When the dashboard URL is still request-derived, the UI now treats it as missing public URL configuration and does not show the localhost/request-derived MCP endpoint as usable agent config.
• Updated the checked-in dashboard static bundle and PR body summary/tests.

Verification is green: npm test -- src/main.test.tsx, npm run build, the targeted Python MCP/status tests, and GitHub checks dashboard, pytest (3.11), and pytest (3.12) all passed.

I also captured a refreshed local screenshot of /mcp, but could not replace the PR body image because gh-image has no GitHub web session token available in this runner (GH_SESSION_TOKEN is absent). I left the existing PR body image in place rather than linking a local/private path.

[pilipilisbot]

Post-merge cleanup complete for PR #142.

• Merged as fc5eac9ef41ddba266b2bf4101ff2819b07ab535.
• Removed the clean dedicated worktree at /home/openclaw/.openclaw/workspace/github/github-agent-bridge-issue140-http.
• Left the canonical checkout untouched; it has unrelated local modifications outside this merged PR cleanup.