Add allow_discovery field for MCP server visibility control

[Copilot]

Enables MCP servers to be visible in the marketplace to unauthorized users while restricting actual access. Users can see server metadata and contact information to request access, but tools/prompts remain hidden.

Backend Changes

• Config: Added allow_discovery boolean field to MCPServerConfig (default: false)
• Authorization: New get_discoverable_servers() method returns metadata-only view for unauthorized users
• API: /api/config endpoint includes discoverable_servers array with limited server information

Frontend Changes

• State: ChatContext and useChatConfig propagate discoverable servers from API
• UI: MarketplacePanel renders discoverable servers with:
  • Lock icon + "No Access" badge
  • Grayed-out, non-selectable appearance
  • Server metadata (description, author, required groups)
  • "Request Access" email link (if help_email configured)
  • Hidden tools/prompts

Configuration Example

{
  "admin_tools": {
    "groups": ["admin"],
    "allow_discovery": true,
    "description": "Advanced analytics tools",
    "author": "Analytics Team", 
    "help_email": "analytics-access@example.com"
  }
}

Users lacking admin group membership see the server in the marketplace but cannot enable it. Only metadata is exposed; functionality remains protected by group authorization.

Security Model

• Opt-in: Servers hidden by default unless allow_discovery: true
• Exposed: Server name, description, author, help_email, required groups, compliance_level
• Protected: Tools, prompts, functionality, tool counts
• Authorization unchanged: Group membership still required for actual access

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Allow mcp servers config to allow discoverability</issue_title>
<issue_description>In the mcp.json
allow an option that will let mcp servers to be discovered by users (they can see they exists) even if they don't have access.
this is off by default or if not specified.

The idea is that for some mcp servers that are access controlled, users could use the contact information to go request access to the needed group. Just knowing a capability exists and the right contact is helpful.

Only show the server overview and contact (not all the functions or prompts). </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Allow mcp servers config to allow discoverability #103

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.