feat: gate MCP API behind auth when Ask GitHub is enabled (#994)

* require auth for MCP in ask gh

* add CHANGELOG entry for #994

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: msukkari

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Gate MCP API behind authentication when Ask GitHub is enabled. [#994](https://github.com/sourcebot-dev/sourcebot/pull/994)
+
 ## [4.15.4] - 2026-03-11
 
 ### Added

packages/web/src/app/api/(server)/mcp/route.ts

@@ -3,7 +3,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { createMcpServer } from '@/features/mcp/server';
 import { withOptionalAuthV2 } from '@/withAuthV2';
 import { isServiceError } from '@/lib/utils';
-import { serviceErrorResponse, ServiceError } from '@/lib/serviceError';
+import { notAuthenticated, serviceErrorResponse, ServiceError } from '@/lib/serviceError';
 import { ErrorCode } from '@/lib/errorCodes';
 import { StatusCodes } from 'http-status-codes';
 import { NextRequest } from 'next/server';
@@ -44,6 +44,9 @@ const sessions = new Map<string, McpSession>();
 export const POST = apiHandler(async (request: NextRequest) => {
     const response = await sew(() =>
         withOptionalAuthV2(async ({ user }) => {
+            if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
+                return notAuthenticated();
+            }
             const ownerId = user?.id ?? null;
             const sessionId = request.headers.get(MCP_SESSION_ID_HEADER);
 
@@ -93,6 +96,9 @@ export const POST = apiHandler(async (request: NextRequest) => {
 export const DELETE = apiHandler(async (request: NextRequest) => {
     const result = await sew(() =>
         withOptionalAuthV2(async ({ user }) => {
+            if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
+                return notAuthenticated();
+            }
             const ownerId = user?.id ?? null;
             const sessionId = request.headers.get(MCP_SESSION_ID_HEADER);
             if (!sessionId || !sessions.has(sessionId)) {
@@ -126,6 +132,9 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
 export const GET = apiHandler(async (request: NextRequest) => {
     const result = await sew(() =>
         withOptionalAuthV2(async ({ user }) => {
+            if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
+                return notAuthenticated();
+            }
             const ownerId = user?.id ?? null;
             const sessionId = request.headers.get(MCP_SESSION_ID_HEADER);
             if (!sessionId || !sessions.has(sessionId)) {