feat: expose DevGlobe as a hosted MCP service for AI agents

[sajeetharan]

Problem

DevGlobe already supports consent-aware developer discovery and introductions through a local stdio MCP server, but agent owners must clone the repository and run Node locally. This prevents agents from using DevGlobe as an internet-native service.

Proposal

Expose a hosted, stateless MCP Streamable HTTP endpoint at /mcp so MCP-compatible agents can discover developers and request consent-gated introductions directly through https://www.devglobe.dev.

Agent tools

• search_developers: search public profiles by expertise, location, language, and agent availability
• get_developer_profile: retrieve one public profile
• request_introduction: create a pending request for an opted-in developer
• get_introduction_status: poll a request; accepted requests reveal only the public GitHub URL

Privacy and trust

• Public search and profile lookup require no credential
• Introduction tools require a provisioned agent bearer token
• Preserve developer opt-in, rate limits, expiration, immutable decisions, and public-contact-only disclosure
• Do not expose private AI profile settings, tokens, contact details, embeddings, or hidden profile fields
• Use stateless MCP sessions so the endpoint works on serverless infrastructure

Discovery and documentation

• Advertise the remote MCP endpoint in llms.txt and MCP documentation
• Keep the existing stdio connector for clients that require a local process
• Document remote client configuration and authentication

Acceptance criteria

• POST /mcp handles MCP initialize, tools/list, and tools/call over Streamable HTTP
• Anonymous clients can call public discovery tools
• Introduction tools enforce existing bearer-token authentication
• Unsupported GET and DELETE session operations return valid MCP transport responses
• Origin validation and response security headers are present
• Protocol tests cover discovery and authenticated introduction behavior
• Production build succeeds on the Next.js/Vercel runtime

[sajeetharan]

Implemented on feature/agent-network-visualization.

Completed:

• Hosted stateless Streamable HTTP MCP endpoint at /mcp
• Shared tool factory used by remote HTTP and local stdio transports
• Anonymous search_developers and get_developer_profile
• Bearer-token forwarding for consent-gated introduction tools
• Browser origin validation, CORS preflight, no-store/nosniff headers
• Explicit rejection of stateful GET/DELETE operations for serverless compatibility
• Remote setup documentation in README, docs/mcp-server.md, and llms.txt
• Five protocol-level tests

Validation:

• npm test: 23/23 passing
• npm run build: passing; /mcp emitted as a dynamic route
• Official MCP StreamableHTTPClientTransport: connected, listed all four tools, and returned a real public developer search result

Deployment follow-up: configure distributed request throttling at the Vercel/firewall layer. Introduction writes already retain the application-level per-agent hourly quota.