From 3512c615c92e471ac27bedeee228418d7773526c Mon Sep 17 00:00:00 2001
From: Rosie Val <everestmcarthur@gmail.com>
Date: Sat, 22 Aug 2026 15:31:10 -0400
Subject: [PATCH] Fix frontend API base URL for remote access, pin mcp<2.0.0

api.ts and auth.tsx hardcoded API_BASE to http://localhost:8051 with
no override, unlike every other component which already checked
VITE_API_URL first. That's fine when the browser and server are on
the same machine, but breaks auth/chat/stats/documents entirely when
accessing the UI from a different machine than the one running
claude-os - "localhost" resolves to the browser's own machine, not
the server.

Also pins mcp<2.0.0 in requirements.txt: mcp 2.0.0 removed the
low-level Server.list_tools() API that mcp_server/claude_code_mcp.py
(the code-forge stdio MCP server) depends on, so an unbounded
mcp>=1.0.0 install silently breaks that integration.
---
 frontend/src/lib/api.ts   | 2 +-
 frontend/src/lib/auth.tsx | 2 +-
 requirements.txt          | 4 +++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 0449114..95a22c1 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -1,4 +1,4 @@
-const API_BASE = 'http://localhost:8051';
+const API_BASE = import.meta.env.VITE_API_URL || 'http://localhost:8051';
 
 export interface ChatResponse {
   response: string;
diff --git a/frontend/src/lib/auth.tsx b/frontend/src/lib/auth.tsx
index 876a93a..7693120 100644
--- a/frontend/src/lib/auth.tsx
+++ b/frontend/src/lib/auth.tsx
@@ -1,6 +1,6 @@
 import { createContext, useContext, useState, useEffect, ReactNode } from 'react';
 
-const API_BASE = 'http://localhost:8051';
+const API_BASE = import.meta.env.VITE_API_URL || 'http://localhost:8051';
 
 interface AuthContextType {
   isAuthenticated: boolean;
diff --git a/requirements.txt b/requirements.txt
index 0e9412d..6d4489e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,7 +26,9 @@ sentence-transformers>=2.2.0
 rank-bm25>=0.2.2
 
 # MCP Server
-mcp>=1.0.0
+# Pinned <2.0.0: claude_code_mcp.py uses the low-level Server API
+# (@server.list_tools() etc.) which mcp 2.0.0 removed/renamed.
+mcp>=1.0.0,<2.0.0
 fastapi>=0.104.0
 uvicorn>=0.24.0
 pydantic>=2.0.0