PR #8009 - speakeasy-api/gram

Part of AIM-668 (2 of 3). Stacked on #8008.

Summary

Hosted server settings, Custom Slug and Custom Domain: Save and Link Domain now call mcpEndpoints.update on the canonical server's endpoint instead of toolsets.update. The endpoint is chosen as follows:
- the one matching the toolset's slug and domain;
- otherwise the server's single non-root endpoint;
- if neither exists, a short hint replaces the buttons.
Slug validation: it calls mcpEndpoints.checkSlugAvailability on the domain the write targets, replacing toolsets.checkMCPSlugAvailability. Link Domain is checked against the new domain. Note the result now means available, the opposite of the old call.
Network access saves through mcpServers.update. Linking a sign-in issuer (auth section and OAuth wizard) also calls mcpServers.update with userSessionIssuerId. Both re-read the server first and send the full form. The issuer link leaves networkAccessMode out, so private network admission does not run again.
- Only toolsets with no canonical MCP server still call toolsets.setUserSessionIssuer. The next PR removes that method.
Server: mcpEndpoints.update now sends a canonical hosted endpoint to the hosted writer before the project-wide mcp:write check. The hosted writer checks mcp:write on the server itself, as toolsets.update did, so a grant scoped to that one server still works. Other endpoints still need project-wide mcp:write.
Authorization note (broader than mcpEndpoints.update on main): on main a hosted endpoint write through mcpEndpoints.update needed project-wide mcp:write plus mcp:write on the toolset. It now needs only mcp:write on the server (the server id is the toolset id). That is the same check toolsets.update made, which is the path the dashboard used before.
Renamed route: after a settings save that changes the server's slug (an address change on a hosted server, or any save that renames a non-hosted server), the page moves to the new slug with replace, keeping the tab, query and hash, through the route helpers.

Motivation

The toolset MCP hosting inputs are deprecated in favour of mcpServers / mcpEndpoints, which already accept these writes for hosted servers. Once this deploys, the toolsets:deprecated-mcp-hosting-api warning should show no dashboard traffic. After 7 days without other callers, the next PR rejects the deprecated inputs.

Gutternote review steps

Sidebar → MCP servers → open a hosted server → Settings (/<org>/projects/<project>/mcp/<server>).
Custom Slug: change the slug and click Save. The network tab shows mcpEndpoints.update, and a taken slug shows "This slug is already taken".
Network access: change the mode and save. The request is mcpServers.update, and visibility and tool filtering are unchanged.
Authentication: link a sign-in issuer. The request is mcpServers.update.

Also check: a remote server's Settings page still edits its endpoints and network access.

🤖 Generated with Claude Code

Summary by cubic

Hosted MCP server settings now save through the mcpServers/mcpEndpoints APIs instead of the deprecated toolset hosting endpoints, continuing the retirement of the hosted-MCP inputs on toolsets.

Custom Slug, Custom Domain, and Link Domain save through mcpEndpoints.update on the canonical matching endpoint, falling back to the server's single non-root endpoint.
Slug validation now calls mcpEndpoints.checkSlugAvailability on the domain the write targets; the result means available, the opposite of the old toolsets.checkMCPSlugAvailability.
Network access and sign-in issuer linking save through mcpServers.update after re-reading the server, so concurrent changes aren't clobbered and private network admission doesn't re-run.
Linking a toolset's issuer also refreshes the MCP server query cache; toolsets with no canonical MCP server still link their issuer through toolsets.setUserSessionIssuer.
The server now accepts an mcp:write grant scoped to a hosted server for endpoint updates, matching what toolsets.update allowed; other endpoints still require project-wide mcp:write.
After any save that renames a server's slug, the page navigates to the new route with replace, keeping tab, query, and hash, instead of showing "not found"; when the renamed server can't be re-fetched it falls back to the server id.

🚀 Preview Environment (PR #8009)

Preview URL: https://pr-8009.dev.getgram.ai

Component	Status	Details	Updated (UTC)
✅ Database	Ready	Existing database reused	2026-10-24 18:41:47.
✅ Images	Available	Container images ready	2026-10-24 18:43:07.

_{Gram Preview Bot}