feat(mcp): public read-only demo endpoint at /mcp/demo (unblocks directory crawlers, no tenant exposure)

[keysersoft]

Why

Our MCP endpoints (/mcp, /mcp/:serverId) return 401 to anonymous callers — correct for a multi-tenant product, but it means directory crawlers (Glama, Smithery, mcp.so) and curious agents can't introspect a working MCP server. That blocks listings and the Glama quality score (which gates the awesome-mcp-servers PR, 89k★).

What

A public, anonymous, static demo MCP server at the exact path /mcp/demo:

• Exposes only self-describing info tools — anythingmcp_overview, anythingmcp_get_started, anythingmcp_connect_client, anythingmcp_list_connectors — that return text about the product. It never resolves a serverId, queries the DB, or touches connectors/tenant data, so it has nothing to leak.
• Declared before the :serverId routes so the static segment wins route matching.
• The combined auth guard exempts only the exact path /mcp/demo; every /mcp/:serverId stays fail-closed. Tenant isolation is unchanged.
• Rate-limited (60/min); makes zero outbound calls.

Multi-tenant safety

• No change to the tenant membership/isolation logic. The only auth change is an exact-path early-return for /mcp/demo.
• The handler is static: it cannot reach any tenant's data by construction.
• Regression tests pin this:
  • guard exempts exact /mcp/demo (and trailing slash) but denies real server ids and look-alikes like /mcp/demo-evil;
  • controller demo handler never calls findById / getConnectorIds / isUserInOrganization.

Tests

tsc clean; guard + controller specs 16/16 pass.

Follow-up

Point directory listings (Smithery, mcp.so) and a Glama "connectors" entry at https://cloud.anythingmcp.com/mcp/demo so the hosted endpoint introspects cleanly.