MCP-04: Phase 4 — MCP production hardening (deferred to v0.4.0+)

[Chris0Jeky]

Overview

Phase 4 of MCP server implementation. Production-grade hardening deferred until v0.4.0+ demand justifies the investment.

Tracker: #648 | Spike: docs/spikes/SPIKE_619_COMPLETED.md §13 Phase 4

Scope

1. Structured logging and observability for MCP requests (OpenTelemetry integration)
2. Resource subscriptions (bridge SignalR for live board updates)
3. Prompt templates (if user demand — spike §8 recommends deferral)
4. OAuth 2.1 support (when cloud auth infrastructure exists from CLD wave)
5. API key management web UI (settings surface)
6. MCP spec version negotiation
7. Performance optimization (response caching for resources)
8. Scope-based API key permissions (per-board access restriction)

Key Design Constraints

• Only invest in this when real external agent usage justifies the cost
• OAuth 2.1 depends on cloud auth infrastructure (GitHub OAuth from CLD-03: Add GitHub OAuth login for cloud instance #539)
• Resource subscriptions require SignalR scale-out readiness (PLAT-03: SignalR scale-out readiness (backplane/service strategy) #105)

Estimated Scope

2–4 weeks (deferred)

Blocked By

• MCP-03 (#TBD — HTTP transport + auth)