Summary

Fix MCP endpoint not working on Ycode Cloud. The cloud proxy intercepts
all /ycode/* routes and requires session auth, which redirects MCP
clients to the login page instead of reaching the route handler. MCP
authenticates via its own URL token, not session cookies.

Changes

• Add explicit /ycode/mcp/ bypass in proxy.ts before the session auth check
• Add maxDuration: 60 for MCP route in vercel.json (was missing because the
  existing glob app/ycode/api/**/*.ts doesn't match app/(builder)/ycode/mcp/)
• Install missing @modelcontextprotocol/sdk dependency (was listed in
  package.json but absent from node_modules, causing TypeScript build failures
  for all lib/mcp/tools/*.ts files)

Still required (cloud overlay)

This fix alone does not resolve the issue on Ycode Cloud. The cloud
deployment uses a path-alias overlay that replaces proxy.ts with its
own version. The cloud overlay proxy must also skip session auth for
/ycode/mcp/ routes — add the same early-return pattern:

if (pathname.startsWith('/ycode/mcp/')) {
  // MCP uses its own token auth — skip session auth
  const response = NextResponse.next();
  response.headers.set('x-pathname', pathname);
  // set x-tenant-id if needed for tenant-scoped DB queries
  return response;
}

Without this cloud-side change, MCP requests will continue to be
redirected to the login page on *.ycode.website domains.

Test plan

• Self-hosted: verify MCP still connects successfully via Cursor/Claude
• Cloud: after updating the cloud overlay, verify MCP connects on *.ycode.website
• Verify npm run type-check passes (no more MCP SDK resolution errors)
• Verify MCP tool calls don't time out on Vercel (60s limit now applied)

Made with Cursor