fix(mcp-server): let a deployed standalone server know its public url

[Scra3]

Follow-up to #1815, which shipped in @forestadmin/mcp-server@1.22.0.

run() hardcodes baseUrl = http://localhost:<port>, and that explicit value wins over the environment's api_endpoint. A process cannot derive its own public URL — DNS, proxy and TLS termination live outside it — so a deployed standalone server today:

• advertises localhost as its OAuth issuer and endpoints (pre-existing, not introduced by feat: upload files through the MCP server for action File fields #1815),
• and, on the in-memory upload store feat: upload files through the MCP server for action File fields #1815 added, mints localhost upload URLs no remote client can reach.

Nobody had seen it because every standalone test so far ran locally. A standalone deployment with a configured storage backend is unaffected — the upload URL comes from the backend.

FOREST_MCP_SERVER_URL is the public URL the server is reachable at. Set, it becomes the base URL, fixing the issuer and the upload URLs in one move; unset, behavior is unchanged. A value that does not parse as a URL fails at startup, like every other option.

Verified by test through the real HTTP server run() starts: the advertised issuer is the configured URL. The suite's global fetch is the Forest mock, so the test reaches it with the kept originalFetch.

🤖 Generated with Claude Code

Note

Let a deployed MCP server advertise its public URL via FOREST_MCP_SERVER_URL

• Adds a new FOREST_MCP_SERVER_URL env var to server.ts that sets the public http(s) origin used for OAuth metadata and file upload URLs; defaults to http://localhost:<port> when unset.
• Validates that FOREST_MCP_SERVER_URL is a bare origin (no path, query, fragment, or credentials), failing startup with a clear error on invalid input.
• Tightens MCP_SERVER_PORT parsing to require an integer in [0, 65535]; rejects MCP_SERVER_PORT=0 unless FOREST_MCP_SERVER_URL is set, since the ephemeral port can't be advertised without a known public URL.
• Logs the advertised URL at startup and warns when advertising a localhost URL because FOREST_MCP_SERVER_URL is unset.
• Behavioral Change: servers deployed behind a public URL must now set FOREST_MCP_SERVER_URL; omitting it causes advertised endpoints to resolve to localhost.

^{Macroscope summarized 059365a.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	packages/mcp-server/src/server.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[qltysh]

1 new issue

Tool	Category	Rule	Count
qlty	Structure	Function with high complexity (count = 13): run	1