Problem DefaultMCPResource refuses every unauthenticated caller as soon as an OIDC Provider component is registered, with no way to opt out:
if (xcontext.getUserReference() == null && hasOIDCProvider()) {
throw unauthorizedException();
}
Installing the OIDC Authenticator therefore silently closes the MCP endpoint to guests, even on a wiki that deliberately serves anonymous readers. The endpoint answers 401 before initialize, so a guest client does not even receive the tool list, while the very same
pages stay readable through bin/view and the regular REST API. Proposed change Add an admin-configurable allowGuest flag on MCPServerConfigClass, read through MCPServerConfiguration.isGuestAccessAllowed(wikiId):
- Per wiki, like enabled, enabledTools, the space filter and allowRenderedContent. Not farm-level: the policy legitimately differs between a public documentation wiki and an internal one.
- Off by default and fail-closed: an unset field, a missing config object and a failed read all resolve to false, so the authentication challenge stays in place and upgrades change no behaviour.
- Ordering preserved: the wiki-disabled 404 is still evaluated first, so guest access cannot reopen an endpoint an admin switched off.
Enabling the flag does not widen what the endpoint returns. Every tool still resolves content through the space filter and XWiki's view rights, so a guest sees exactly what a guest sees in the browser. |
