docs(integrations): name the MCP access surface and the two Setup entries

[claude]

Fixes #909

The integrations guide's What ships today list named the data API, export, import, outbound email, in-app notification and your own code — and never mentioned /api/v1/mcp, an access surface that is on by default. It also left two entries an administrator can see under Setup → Integrations completely unexplained. Both gaps are closed here, in all three locales.

The browser gate came first

Everything on the card was read statically out of dist/, and registration is not rendering. Before a word of prose was written, the app was booted and driven as a real administrator:

• Booted objectstack dev --ui --seed-admin on a private port with its own SQLite file, waited for /api/v1/health to return 200. Boot banner listed 38 plugins including MCPServerPlugin, DatasourceAdminServicePlugin and DatasourceAdminRoutes, and advertised MCP: http://localhost:PORT/api/v1/mcp.
• Signed in through the real login form as admin@objectos.ai, opened the Setup app.
• Both entries render. Integrations is a sidebar group, expanded by default — no click needed — with Datasources and Connect an Agent under it, each with a non-zero bounding box. Screenshots taken.
• Both open working pages. Connect an Agent renders the endpoint URL, per-client setup for Claude / Claude Code / Cursor / VS Code / Copilot / Codex CLI, a headless API-keys route and a SKILL.md download. Datasources renders a real roster — the deployment's own store as Default with Test and Sync objects actions.

Gating, from the server's own metadata rather than from the DOM: the group_integrations group declares requiredPermissions: ["manage_platform_settings"]. nav_datasources declares the same permission and nothing further; nav_connect_agent declares none of its own and inherits the group's. Neither entry is gated behind anything beyond manage_platform_settings.

The gate also corrected a static reading, which is the point of having it

Reading dist/ said both labels were hardcoded English literals with no i18n key — grep for translationKey/labelKey returns 0 in both plugins. That conclusion was wrong. The server translates these labels at metadata-serve time. Measured live against the running app:

locale requested	group	datasources entry	agent entry
en	Integrations	Datasources	Connect an Agent
zh-Hans	集成	数据源	连接智能体
zh-Hant	集成	数据源	连接智能体

So the zh-Hans page names these entries by the labels a zh-CN reader actually sees. The zh-Hant page keeps this repo's existing ruling that Traditional pages spell platform navigation in English.

What changed

Three .mdx files, nothing else:

• An MCP endpoint bullet in What ships today, stating it is on by default and that every call runs under the caller's own permissions and row-level security rather than a shared service account.
• A short subsection saying what the two Setup entries actually are, that neither is a vendor connector, that HotCRM declares neither, and what permission they sit behind.

webhooks is deliberately still absent — unlike the other two it genuinely is not loaded, so the page is right to omit it.

Verification

pnpm verify green on 9e95480, the final commit — run through this container's shared verify lock, whose own verdict line reads command-exit 0 · held the lock 189s. Each step's own verdict:

✓ Validation passed (1485ms)
✓ i18n lint gate: 0 `i18n/missing-*` issues (55 total lint issue(s) reported, unaffected by this gate)
✓ source hygiene clean          (includes: no raw control bytes in first-party files)
✓ source token ratchet clean
✓ Build complete (1958ms)
  Test Files  145 passed (145)
       Tests  3030 passed | 1 skipped (3031)

The navigation guard was proven to read these new lines, not merely to pass. Its green is otherwise unfalsifiable, so the new zh-Hans citation was mutated on disk to a first segment the platform ships nowhere (集成 to 集成中心); the mutation was confirmed landed by counting both the injected and the removed text, and docs-setup-navigation-names went red naming this PR's own file and citation:

content/docs/guides/integrations.zh-Hans.mdx: 'Setup → 集成中心'
Tests  1 failed | 11 passed (12)

Restored with git checkout HEAD -- ABSOLUTE_PATH; restoration proven by state, not by exit code — git diff HEAD empty, worktree blob 3d8ae76 identical to the HEAD blob, mutant marker count back to 0 — and the guard returned to 30 passed (30). No anchored links were added; every link on the touched lines is a plain page link, so #867's anchor guard has nothing new to resolve.

Changeset carries empty frontmatter — verified against the diff rather than assumed: the change is three .mdx files and publishes nothing.

Generated by Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hotcrm	Ignored		Aug 27, 2026 1:05pm