fix(mcp): honour --url in stdio, make --mcp-authorizer-url inert

[lakhansamani]

What

Three things, in the order that makes each one true:

1. fix(mcp) — authorizer mcp now honours --url.
2. deprecate(mcp) — --mcp-authorizer-url is now inert: still accepted, warns, read by nothing.
3. Drops its usage from internal/e2e/smoke_test.go, which passes --url instead.

The bug that made this possible

authorizer mcp inherits the root flag set, so --url was always accepted there. But parsers.SetTrustedURL was only ever called from runRoot:

$ grep -rn "SetTrustedURL" --include=*.go . | grep -v _test
cmd/root.go:545:  parsers.SetTrustedURL(rootArgs.config.AuthorizerURL)

So inside the stdio subcommand trustedURL stayed empty, GetHostFromRequest fell through to header derivation, and --url did nothing. authorizer mcp --url=https://auth.example.com looked configured and wasn't — while --mcp-authorizer-url was the only mechanism that actually worked.

runMCP now pins the trusted URL exactly as the server does. That is what lets the old flag become inert without breaking the stdio path.

How the bug was found

I first assumed --mcp-authorizer-url was already redundant, reasoning from GetHostFromRequest's precedence, and deleted it from examples/with-agent-permissions/mcp-agent.mjs. The stdio probe failed immediately:

== Driving the real MCP server over stdio (delegated token) ==
rpc error: code = Unauthenticated desc = unauthorized

Correct about the function, wrong about the process: SetTrustedURL was never called there.

Verified inert, not just deprecated

With --url correct and a deliberately wrong --mcp-authorizer-url, all six assertions still pass against a live server:

$ node mcp-agent.mjs --verify      # args include --mcp-authorizer-url=https://WRONG.example
== Driving the real MCP server over stdio (delegated token) ==
  ✓ check_permissions q4-plan -> allowed
  ✓ check_permissions payroll -> DENIED
  ✓ list_permissions includes q4-plan
  ✓ list_permissions EXCLUDES payroll

== Control: the same tools with the USER's own token ==
  ✓ check_permissions q4-plan -> allowed
  ✓ check_permissions payroll -> allowed (the user CAN see it)

Before the runMCP fix, that wrong value would have broken issuer validation. It is now read by nothing.

$ authorizer mcp … --mcp-authorizer-url=…
Flag --mcp-authorizer-url has been deprecated, it has NO EFFECT as of 2.4.0 —
pass --url with the same value instead. …

Still parsed, not deleted, so an existing 2.3.x invocation keeps starting instead of dying on unknown flag. It shipped in 2.3.0, so deleting it would be a breaking change; it goes with the subcommand in 2.5.0.

Also

--mcp-bearer without --url is now refused at startup with an explanatory message. That combination previously failed later as a bare Unauthenticated on every tool call, which reads as a bad token rather than missing config — exactly the confusion that hid the bug above.

Verification

go build ./..., go vet ./cmd/, go vet -tags smoke ./internal/e2e/, gofmt -l, go test ./cmd/ all clean. End-to-end verified against a live server.

Related

• authorizerdev/docs — flag table and runnable blocks now use --url
• authorizerdev/examples — mcp-agent.mjs no longer passes it

Refs #764