Serve the II app-metadata document at the origin root

[sea-snake]

Summary

Internet Identity's connect screen names the server a user is about to hand a standing delegation to. It can also link that server's own privacy policy and terms of service beside the "Allow access" button — for any origin that publishes them at /.well-known/ii-app-metadata, permissionlessly, with no involvement from the II team.

This origin now serves that document, so the connect screen reads "Connect mcp.internetcomputer.org … Review ICP MCP's Privacy Policy and Terms of Service." instead of naming the host and nothing else.

Related issues

The policy links half of the document is dfinity/internet-identity#4302 (the name half already ships). Serving the document early is harmless: II ignores fields it doesn't know, so the name applies today and the links light up when that PR lands.

Changes

• ii_app_metadata_router() in src/lib.rs, next to auth_callbacks_router and built the same way: origin-global (well-known URIs are origin-scoped, so one document covers every instance), merged at the application root, CORS-open because II's frontend fetches it cross-origin.
• The document is three hardcoded constants — name: "ICP MCP", and the product's own pages at https://internetcomputer.org/icp-mcp/privacy-policy and .../terms. Written absolute rather than derived from public_url: II requires https and a local build's public_url is http://localhost:8000. It never fetches these documents (it renders links the user opens), so they may live on any origin.
• The router is deliberately left out of the crate's usage example: the document names this deployment, and an embedder serving imcp2 on its own origin should publish its own metadata rather than DFINITY's. Noted on the function.
• tests/routers.rs merges it into the composed app and asserts the document meets II's requirements — name non-blank and within the 40-code-point cap, both URLs https and free of userinfo. Validation on II's side is all-or-nothing, so one bad field discards the document whole, silently, on a screen this server never sees; that is what the test guards.
• README: one line in the endpoint list.

Testing

• cargo build --locked --all-targets
• cargo test --locked --all-targets — 245 pass, including the new router test (which caught its own wiring: the harness app() had to merge the router, exactly as main.rs does)
• cargo clippy --all-targets — no new warnings; the 6 pre-existing ones in imcp2-core are untouched
• cargo fmt --all — not run: my local rustfmt reformats ~15 files across the tree that this PR doesn't touch, so running it would bury the change. Added lines are hand-kept within the surrounding width.
• npm test --prefix monitoring/mcp-status — dashboard unchanged

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change.
• No secrets, credentials, or internal-only information are included.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds origin-level Internet Identity metadata so ICP MCP displays its name and legal links during connection authorization.

Changes:

• Adds and mounts the CORS-enabled metadata router.
• Tests metadata constraints.
• Documents the new endpoint.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/lib.rs	Defines the metadata document and router.
src/main.rs	Mounts the router at the application root.
tests/routers.rs	Tests the metadata response and fields.
README.md	Lists the new well-known endpoint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.