[codex] use authkit mcp bridge

[chelojimenez]

What changed

• route hosted MCP whoami and doctor through the Convex HTTP bridge instead of direct Convex bearer-token auth
• add the shared bridge client used by the worker tools
• repoint staging and preview worker envs to the Convex deployment that is actually serving the AuthKit bridge routes

Why

Staging MCP was validating AuthKit in the worker, but downstream Convex auth was rejecting AuthKit tokens. The worker now calls the backend HTTP bridge, which performs manual AuthKit verification and user resolution.

Impact

• whoami should work again for AuthKit-backed staging sessions
• hosted doctor uses the same authenticated bridge path for workspace and server lookup
• staging worker now targets the live backend deployment that contains the fallback routes

Validation

• npm run typecheck -w @mcpjam/mcp
• npm run deploy:staging -w @mcpjam/mcp

Depends on

• backend PR in MCPJam/mcpjam-backend on branch codex/fix-authkit-mcp-bridge

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

MCP worker preview

Preview URL: https://mcpjam-mcp-pr-1862.marcelo-1cb.workers.dev
MCP endpoint: https://mcpjam-mcp-pr-1862.marcelo-1cb.workers.dev/mcp
Built from 4144fb0. Each push overwrites the mcpjam-mcp-pr-1862 worker, so the URL is stable for the life of the PR.
The live mcpjam-mcp-staging worker only changes on merge to main. This preview worker is deleted when the PR is closed.