Why

Connecting Mintlify fails with an opaque "Redirect URI not allowed" unless an admin first allowlists Cedar's callback URL under MCP settings for each docs deployment in the Mintlify dashboard. Mintlify enforces this per-deployment allowlist even though it uses DCR (unlike Notion). Nothing in the connect UI told users this, so it looked broken.

What

• Add an optional redirectAllowlist to the OAuthMcpProvider config.
• When set, the card shows a pre-connect note (above the Connect button) with:
  • the exact redirect URL for the current environment (${getRuntimeBackendUrl()}/oauth/<provider>/callback) + a copy button,
  • where to add it, and a link to the provider dashboard.
• Enabled for Mintlify only; Notion/Pylon unaffected.

Because the URL is derived from the runtime backend URL, it renders correctly on staging (api.mail-staging…) and prod without hardcoding.

Note preview (Mintlify, not-yet-connected)

ⓘ Before connecting, an admin must add this redirect URL in your Mintlify dashboard → MCP settings, for each docs deployment you want to connect. Otherwise Mintlify rejects the connection with "Redirect URI not allowed." https://api.mail-staging.cedarcopilot.com/oauth/mintlify/callback [copy] Open Mintlify settings ↗

Typecheck clean (@zero/mail, 0 errors).

🤖 Generated with Claude Code

Greptile Summary

Adds optional provider redirect-allowlist guidance to OAuth MCP integration cards and enables it for Mintlify.

• Derives and displays the environment-specific OAuth callback URL before connection.
• Adds clipboard-copy feedback and a link to the Mintlify dashboard.
• Leaves providers without redirect-allowlist configuration unchanged.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking usability issue in the manual-copy fallback.

The generated Mintlify callback URL matches the configured production and staging backend routes, but users whose clipboard request fails may be told to copy a URL whose full value is hidden by truncation.

Files Needing Attention: apps/mail/modules/integrations/oauth-mcp-integration-card.tsx

Important Files Changed

### Issue 1
apps/mail/modules/integrations/oauth-mcp-integration-card.tsx:203
**Truncated manual-copy fallback**

When the Clipboard API rejects the copy request, the toast directs the user to copy the redirect URI manually, but `truncate` hides part of the only rendered value on narrow cards. This makes the exact Mintlify allowlist URL difficult to recover precisely when the fallback is needed.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(integrations): show redirect-URL se..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.