Connect a customer-supplied MCP server (static creds or OAuth)
Static-cred connections are born active; OAuth returns an
authorize_url + state and the row starts pending_oauth until the
/integrations/oauth/callback redirect lands. server_url (and any
OAuth endpoint URLs) are SSRF-validated in the service layer.
Authorizations
Body
Body for POST /v1/integrations/connections/custom-mcp.
One shape for all four auth types. none/bearer/api_key are the
static-credential paths (Step 6 — the row is born active); oauth is
the authorization-code path (Step 7 — the row starts pending_oauth and
the response carries authorize_url + state). The OAuth endpoint URLs
are optional because :func:discover_mcp_oauth fills them in when the server
advertises RFC 9728 metadata; customer-supplied values override discovery.
Response
Successful Response
Returned by POST /v1/integrations/connections/custom-mcp.
authorize_url + state are populated only for the oauth path so
the frontend can redirect the user to the provider; the static paths return
status="active" with both None.