feat(mgmt): add MCP server management API

[omercnet]

Fixes descope/etc#16608

View workflow run

Done. Committed feat(mgmt): add MCP server management API (7bb86bb) on this fresh branch.

Larger slice — new MCPServer manager (14 endpoints)

Re-diffed the live spec against the current SDK (prior PRs #789/#790/#791 merged → 78 still missing) and implemented the single largest coherent feature area: the MCP server management API.

Group	Methods
Servers	Create, Update, Delete, DeleteBatch, Load, LoadAll
Clients	CreateClient, UpdateClient, DeleteClient, DeleteClients, LoadClient, GetClientSecret, RotateClientSecret, SearchClients

This is the biggest slice so far — a brand-new manager with deeply-nested config types, touching the full stack:

• types.go — MCPServer, MCPServerClient, MCPServerClientRequest, MCPServerClientCreateResponse, MCPServerClientSearchOptions, plus nested config types (MCPServerDynamicClientRegistration, MCPApprovedScopes/MCPApplicationScope, MCPSessionSettings, MCPCIMDSettings/MCPCIMDDomainPolicies/MCPCIMDDomainPolicy, MCPSortField)
• api/client.go — 14 endpoint fields + init + route methods
• sdk/mgmt.go — new MCPServer interface + Management.MCPServer() accessor
• internal/mgmt/mcpserver.go — manager implementation
• internal/mgmt/mgmt.go — registration + accessor
• tests/mocks/mgmt/managementmock.go — MockMCPServer + embedding
• mcpserver_test.go — 28 new tests
• README.md — new "Manage MCP Servers" section + TOC entry

All quality checks pass; go.mod/go.sum unchanged.

Scope note

I implemented the 14 server/client management CRUD endpoints and deliberately excluded the 15th MCP path, mcp/client/{projectId}/{mcpServerId}/register — that's an OIDC dynamic-client-registration protocol endpoint (path params, dozens of OIDC request/response schemas), not a management operation, consistent with how the SDK omits other protocol endpoints.

Remaining ~64 gaps are other net-new areas, each best as its own PR: resource + resourcepolicy (19), FGA backups/AuthZEN (9), policies/rule (5), localization (4), project export/import + async clone (4), SSO custom-attributes/provider-ids (4), tenant admin-links (4), plus singletons (accesskey/import, user/passkeys/import, user/update/impersonationConsent, widget/list, authz/re/deleteresourcesrelations, flow/*). A couple remain false positives (mgmt/list/{id}, mgmt/outbound/app/{id} — path-param GET variants already covered via query params).

---

Created by Shuni 🐕

[shuni-bot-dev]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot-dev]

🐕 Suggested Reviewers

The reviewers have been selected based on recent modifications to the relevant files, ensuring they possess current knowledge of the code areas involved. The focus was on balancing breadth across different parts of the feature (API, internal management, SDK, tests) with depth from those actively maintaining related files.

Reviewer	Reason
dorsha	Recently modified multiple files related to the MCP server management API (README.md, descope/api/client.go, descope/internal/mgmt/mgmt.go), indicating deep familiarity with the feature and implementation details.
aviadl	Contributed to key management files such as descope/api/client.go, descope/internal/mgmt/mgmt.go, and descope/sdk/mgmt.go, making them well-positioned to review the overall SDK integration and API logic.
shilgapira	Has made recent commits across multiple relevant files including descope/api/client.go, descope/sdk/mgmt.go, and mock tests, bringing fresh context on both implementation and testing of the MCP server management.
orius123	Contributed to descope/api/client.go and descope/internal/mgmt/mgmt.go, covering client-side and internal management code, which is essential for thorough review of the new API endpoints.
slavikm	Recent commits to descope/internal/mgmt/mgmt.go suggest familiarity with internal management logic, beneficial for assessing the integration and internal consistency of the feature.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot-dev]

🐕 Shuni's Review

Adds a new MCPServer management API — 14 server/client CRUD endpoints across types, client, interface, manager, mock, and tests.

No issues found — good bones! 🦴

Clean, additive, and consistent: the mock fully matches the interface, validation guards every required arg, and all 28 tests cover both success and error paths. Woof!