docs(wiki): record host-agnostic MCP McpRouter boundary

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: gxkl

wiki/log.md

@@ -2,6 +2,12 @@
 
 Dates use the workspace-local Asia/Shanghai calendar date.
 
+## [2026-07-10] package | host-agnostic MCP register via McpRouter boundary
+
+- sources touched: `tegg/plugin/controller/src/lib/impl/mcp/{McpRouter,EggMcpRouter,MCPControllerRegister}.ts`, `tegg/plugin/controller/src/{app.ts,lib/ControllerModule.ts}`, `tegg/plugin/tegg/src/lib/ModuleHandler.ts`, `tegg/standalone/service-worker/src/mcp/{ServiceWorkerMcpRouter,MCPRegisterProvider}.ts`, `tegg/plugin/mcp-proxy/src/{app,index}.ts`
+- pages updated: `wiki/packages/service-worker.md`, `wiki/log.md`
+- note: Fixed the C4 host-boundary leak — the MCP controller register mixed record collection with egg-specific transport and the egg host threaded its `Application` into the module inner-object DI graph as a PRIVATE `eggApp` provided object. Extracted a `McpRouter` transport boundary: the shared `MCPControllerRegister` now only collects tool/resource/prompt records and calls `mcpRouter.registerServer(reg)`; egg node-HTTP transport moved to `EggMcpRouter` (built in `app.ts` with `app`), SW fetch transport to `ServiceWorkerMcpRouter`. Both provide the `mcpRouter` DI name (host plugins never coexist). `eggApp` provided object removed from `ModuleHandler`; `EggControllerRegisterFactory` dropped its host generic/injection. `MCPServerHelper` was already host-agnostic and is unchanged. Regression green (controller/service-worker/mcp-proxy/example/MultiApp) modulo a pre-existing controller boot-error test that only times out under the 5000ms suite-default and dal tests that need MySQL.
+
 ## [2026-06-28] workflow | record egg-bin Windows shell probe hotspot
 
 - sources touched: `tools/egg-bin/bin/run.js`, `tools/egg-bin/test/fixtures/my-egg-bin/bin/run.js`, PR #6014 CI logs

wiki/packages/service-worker.md

@@ -26,15 +26,24 @@ module-plugin mechanism (declarative `@InnerObjectProto` /
 Key mechanics and constraints:
 
 - **Controller reuse**: metadata from `@eggjs/controller-decorator`,
-  registration runtime from `@eggjs/controller-plugin` (shared with
-  `@eggjs/controller-plugin`); only param binding and transports are
-  fetch-specific.
+  registration runtime from `@eggjs/controller-plugin` (shared); only param
+  binding and transports are fetch-specific.
+- **Host-agnostic MCP register + `McpRouter` boundary**: the shared
+  `MCPControllerRegister` (controller-plugin) only COLLECTS tool/resource/prompt
+  records and delegates transport to an injected `McpRouter`
+  (`registerServer(reg)`); it no longer touches `app`. The egg host's node-HTTP
+  transport is `EggMcpRouter` (built imperatively in the controller plugin's
+  `app.ts`, which holds `app`), the service worker's fetch transport is
+  `ServiceWorkerMcpRouter`. Both provide the `mcpRouter` DI object; the two host
+  plugins are never used together, so the shared name does not collide. Because
+  the register needs no `app`, the egg host no longer provides `eggApp` as a
+  module inner object — the Egg `Application` is out of the module DI graph.
 - **MCP SDK >= 1.29 stateless transports are single-shot** (reuse throws), so
   each MCP request builds a fresh `MCPServerHelper` + web-standard transport
-  from register records collected at boot. The service worker uses
-  `WebStandardStreamableHTTPServerTransport` (Request in, Response out) — no
-  node req/res bridging. Auth is an `mcpAuthHandler` extension point
-  (default: allow).
+  from register records collected at boot. The service worker's
+  `ServiceWorkerMcpRouter` uses `WebStandardStreamableHTTPServerTransport`
+  (Request in, Response out) — no node req/res bridging. Auth is an
+  `mcpAuthHandler` extension point (default: allow).
 - **Streaming lifecycle**: `FetchEventHandler` routes every response body
   through a passthrough and registers the drain as a background task, so ctx
   destroy waits (bounded by `config.backgroundTask.timeout`) until the client