- Read only API keys: an Access choice when creating a key, stored in
the key metadata; the middleware refuses writes and most auth calls
for them with 403 API_KEY_READ_ONLY.
- POST /api/mcp: stateless MCP endpoint with 8 tools that call the REST
API over loopback with the caller's key. Needs x-api-key, a cookie
alone gets 401. MCP_INTERNAL_URL overrides the loopback address.
- mcp/: gitea-mirror-mcp, a zero dependency stdio bridge to /api/mcp for
Claude Desktop and Cursor, with a CI workflow that publishes it on an
mcp-v* tag.
- e2e spec for keys, the endpoint and the bridge; docs for the endpoint,
the bridge and read only keys.
