Summary

• Adds CEDAR_MCP_PUBLIC_URL, threaded into better-auth's mcp() plugin as the resource override (apps/server/src/lib/auth.ts) and into the trusted-origins allowlist (apps/server/src/lib/trusted-origins.ts).
• Lets Cedar's MCP server (/mcp, served by externalMcpRouter) publish /.well-known/oauth-protected-resource under a Manufact-proxied domain (mcp.cedarcopilot.com) for app store submission, while authorization_servers stays on the existing backend origin , auth can't move there without breaking session cookies.
• This is the RFC 9728 resource/authorization-server split Pietro (Manufact) confirmed in Slack both their readiness checklist and the OpenAI/Anthropic store reviews accept.
• Unset, behavior is unchanged: resource falls back to the app origin exactly as it did before this var existed (verified against better-auth's source: resource: options?.resource ?? origin).

Traced end-to-end: externalMcpRouter's .well-known/oauth-protected-resource route (apps/server/src/routes/external-mcp.ts) calls better-auth's oAuthProtectedResourceMetadata(auth), which derives authorization_servers from ctx.context.baseURL , statically configured as env.VITE_PUBLIC_BACKEND_URL (apps/server/src/lib/auth.ts:1008), not from the request's Host header. So the split holds regardless of which domain a request arrives on.

This is groundwork only , no DNS/proxy changes yet. The domain cutover (Manufact proxy config, DNS for mcp.cedarcopilot.com, setting this env var in an actual environment) is staged separately per Pietro's explicit ask not to touch production MCP traffic during the transition.

Test plan

• pnpm --filter @zero/server run types , clean on the three touched files (pre-existing unrelated errors in conversationTool.ts on a different in-progress branch, not touched here)
• Thermo review run on this diff , no blocking or should-fix findings
• Manual: once CEDAR_MCP_PUBLIC_URL is set in an environment, fetch https://mcp.cedarcopilot.com/.well-known/oauth-protected-resource and confirm resource reads the new domain while authorization_servers still reads api.mail.cedarcopilot.com

🤖 Generated with Claude Code

Confidence Score: 4/5

The PR is not safe to merge until the AWS task environment propagates the new MCP public URL to the API process.

Findings

1.  Deployment Drops MCP URL ▶

### Issue 1
apps/server/src/env.ts:472
The new variable is read from `process.env`, but the AWS ECS task environment is built by `buildServiceEnvironment()`, which does not include `CEDAR_MCP_PUBLIC_URL`. As a result, the value will be undefined in the API process, so better-auth will keep advertising the backend origin and this configuration will have no effect in deployed AWS environments.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR introduces an optional public MCP resource identifier and threads it into better-auth metadata and the trusted-origin allowlist. The server-side wiring is internally consistent, but the repository’s AWS task environment contract does