fix(dashboard): hide MCP when disabled

internal/admin/dashboard/static/js/dashboard.js

@@ -384,6 +384,12 @@ function dashboard() {
         : true;
     },
 
+    mcpServersPageVisible() {
+      return typeof this.workflowRuntimeBooleanFlag === "function"
+        ? this.workflowRuntimeBooleanFlag("MCP_ENABLED", true)
+        : true;
+    },
+
     setTheme(t) {
       this.theme = t;
       localStorage.setItem("gomodel_theme", t);
@@ -713,8 +719,9 @@ function dashboard() {
       ) {
         requests.push(this.fetchRateLimitsPage());
       }
-      // Fetched on every page, not just mcp-servers: the overview MCP card
-      // needs the server list to render its connected/total summary.
+      // Considered on every page, not just mcp-servers: the overview MCP card
+      // needs the server list to render its connected/total summary. The MCP
+      // module waits for runtime config and skips the request when disabled.
       if (typeof this.fetchMcpServersPage === "function") {
         requests.push(this.fetchMcpServersPage());
       }

internal/admin/dashboard/static/js/modules/dashboard-display.test.cjs

@@ -81,6 +81,17 @@ test('Models route starts bounded rendering before Alpine mounts the page', () =
     assert.equal(app.page, 'models');
 });
 
+test('MCP navigation follows the exposed MCP_ENABLED runtime flag', () => {
+    const app = loadDashboardApp();
+    app.workflowRuntimeBooleanFlag = (name, defaultValue) => {
+        assert.equal(name, 'MCP_ENABLED');
+        assert.equal(defaultValue, true);
+        return false;
+    };
+
+    assert.equal(app.mcpServersPageVisible(), false);
+});
+
 test('qualifiedModelDisplay keeps provider identity for nested provider model IDs', () => {
     const app = loadDashboardApp();
 

internal/admin/dashboard/static/js/modules/dashboard-layout.test.cjs

@@ -63,7 +63,7 @@ test("sidebar and main content share the flex layout without manual content offs
   assert.doesNotMatch(template, /content-collapsed/);
   assert.match(
     template,
-    /href="{{appURL "\/admin\/dashboard\/overview"}}"[\s\S]*<span>Overview<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/models"}}"[\s\S]*<span>Models<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/audit-logs"}}"[\s\S]*<span>Audit Logs<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/usage"}}"[\s\S]*<span>Usage<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/budgets"}}"[\s\S]*x-show="budgetManagementEnabled\(\)"[\s\S]*<span>Budgets<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/auth-keys"}}"[\s\S]*<span>API Keys<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/workflows"}}"[\s\S]*<span>Workflows<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/guardrails"}}"[\s\S]*x-show="guardrailsPageVisible\(\)"[\s\S]*<span>Guardrails \(experimental\)<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/settings"}}"[\s\S]*<span>Settings<\/span>/,
+    /href="{{appURL "\/admin\/dashboard\/overview"}}"[\s\S]*<span>Overview<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/models"}}"[\s\S]*<span>Models<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/audit-logs"}}"[\s\S]*<span>Audit Logs<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/usage"}}"[\s\S]*<span>Usage<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/budgets"}}"[\s\S]*x-show="budgetManagementEnabled\(\)"[\s\S]*<span>Budgets<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/auth-keys"}}"[\s\S]*<span>API Keys<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/workflows"}}"[\s\S]*<span>Workflows<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/guardrails"}}"[\s\S]*x-show="guardrailsPageVisible\(\)"[\s\S]*<span>Guardrails \(experimental\)<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/mcp-servers"}}"[\s\S]*x-show="mcpServersPageVisible\(\)"[\s\S]*<span>MCP Servers<\/span>[\s\S]*href="{{appURL "\/admin\/dashboard\/settings"}}"[\s\S]*<span>Settings<\/span>/,
   );
 
   const sidebarRule = readCSSRule(css, ".sidebar");

internal/admin/dashboard/static/js/modules/mcp-servers.js

@@ -292,6 +292,20 @@
             },
 
             async fetchMcpServersPage() {
+                // dashboardDataFetches starts feature-backed requests in
+                // parallel, so wait for the shared runtime-config request
+                // before deciding whether the MCP admin API is available.
+                if (typeof this.ensureWorkflowRuntimeConfig === 'function') {
+                    await this.ensureWorkflowRuntimeConfig();
+                }
+                if (typeof this.mcpServersPageVisible === 'function' && !this.mcpServersPageVisible()) {
+                    this.mcpServersAvailable = false;
+                    this.mcpServers = [];
+                    this.mcpServerError = '';
+                    this.mcpServersLoading = false;
+                    return;
+                }
+
                 this.mcpServersLoading = true;
                 this.mcpServerError = '';
                 try {

internal/admin/dashboard/static/js/modules/mcp-servers.test.cjs

@@ -139,6 +139,34 @@ test('list normalization splits comma tools and newline user paths', () => {
     assert.equal(JSON.stringify(module.normalizeMcpUserPaths('/\n /team/alpha \n\n')), JSON.stringify(['/', '/team/alpha']));
 });
 
+test('fetchMcpServersPage waits for runtime config and skips the disabled endpoint', async () => {
+    let configLoaded = false;
+    let fetchCalls = 0;
+    const module = createMcpServersModule({
+        fetch: async () => {
+            fetchCalls++;
+            return { status: 200, json: async () => [] };
+        }
+    });
+    Object.assign(module, {
+        ensureWorkflowRuntimeConfig: async () => {
+            configLoaded = true;
+        },
+        mcpServersPageVisible: () => {
+            assert.equal(configLoaded, true);
+            return false;
+        }
+    });
+
+    await module.fetchMcpServersPage();
+
+    assert.equal(fetchCalls, 0);
+    assert.equal(module.mcpServersAvailable, false);
+    assert.equal(module.mcpServers.length, 0);
+    assert.equal(module.mcpServersLoading, false);
+    assert.equal(module.mcpServerError, '');
+});
+
 test('fetchMcpServersPage marks the feature unavailable on 404 and 503', async () => {
     for (const status of [404, 503]) {
         const module = createMcpServersModule({

internal/admin/dashboard/static/js/modules/workflows.js

@@ -95,7 +95,8 @@
 	                    'REDIS_URL',
 	                    'SEMANTIC_CACHE_ENABLED',
 	                    'USAGE_PRICING_RECALCULATION_ENABLED',
-	                    'DASHBOARD_LIVE_LOGS_ENABLED'
+	                    'DASHBOARD_LIVE_LOGS_ENABLED',
+	                    'MCP_ENABLED'
 	                ];
 	            },
 

internal/admin/dashboard/templates/sidebar.html

@@ -52,7 +52,7 @@ <h1>GoModel</h1>
             <i data-lucide="shield-check" class="nav-icon" aria-hidden="true"></i>
             <span>Guardrails (experimental)</span>
         </a>
-        <a href="{{appURL "/admin/dashboard/mcp-servers"}}" class="nav-item" :class="{ active: page === 'mcp-servers' }" title="MCP Servers" @click.prevent="navigate('mcp-servers')">
+        <a href="{{appURL "/admin/dashboard/mcp-servers"}}" class="nav-item" :class="{ active: page === 'mcp-servers' }" title="MCP Servers" x-show="mcpServersPageVisible()" @click.prevent="navigate('mcp-servers')">
             <i data-lucide="plug" class="nav-icon" aria-hidden="true"></i>
             <span>MCP Servers</span>
         </a>

internal/admin/handler.go

@@ -76,6 +76,7 @@ const (
 	DashboardConfigSemanticCacheEnabled = "SEMANTIC_CACHE_ENABLED"
 	DashboardConfigPricingRecalculation = "USAGE_PRICING_RECALCULATION_ENABLED"
 	DashboardConfigLiveLogsEnabled      = "DASHBOARD_LIVE_LOGS_ENABLED"
+	DashboardConfigMCPEnabled           = "MCP_ENABLED"
 )
 
 // statusClientClosedRequest is the de facto status used by proxies for client-aborted requests.
@@ -96,6 +97,7 @@ type DashboardConfigResponse struct {
 	SemanticCacheEnabled string `json:"SEMANTIC_CACHE_ENABLED,omitempty"`
 	PricingRecalculation string `json:"USAGE_PRICING_RECALCULATION_ENABLED,omitempty"`
 	LiveLogsEnabled      string `json:"DASHBOARD_LIVE_LOGS_ENABLED,omitempty"`
+	MCPEnabled           string `json:"MCP_ENABLED,omitempty"`
 }
 
 type providerStatusSummaryResponse struct {
@@ -352,6 +354,7 @@ func normalizeDashboardRuntimeConfig(values DashboardConfigResponse) DashboardCo
 		SemanticCacheEnabled: strings.TrimSpace(values.SemanticCacheEnabled),
 		PricingRecalculation: strings.TrimSpace(values.PricingRecalculation),
 		LiveLogsEnabled:      strings.TrimSpace(values.LiveLogsEnabled),
+		MCPEnabled:           strings.TrimSpace(values.MCPEnabled),
 	}
 }
 

internal/admin/handler_test.go

@@ -2263,6 +2263,7 @@ func TestDashboardConfig_ReturnsAllowlistedRuntimeFlags(t *testing.T) {
 		SemanticCacheEnabled: "off",
 		PricingRecalculation: "on",
 		LiveLogsEnabled:      "on",
+		MCPEnabled:           "off",
 	}))
 	c, rec := newHandlerContext("/admin/runtime/config")
 
@@ -2316,6 +2317,9 @@ func TestDashboardConfig_ReturnsAllowlistedRuntimeFlags(t *testing.T) {
 	if got := body.LiveLogsEnabled; got != "on" {
 		t.Fatalf("DASHBOARD_LIVE_LOGS_ENABLED = %q, want on", got)
 	}
+	if got := body.MCPEnabled; got != "off" {
+		t.Fatalf("MCP_ENABLED = %q, want off", got)
+	}
 	if rec.Body.String() == "" || strings.Contains(rec.Body.String(), "UNRELATED_FLAG") {
 		t.Fatal("UNRELATED_FLAG should not be exposed")
 	}

internal/app/app.go

@@ -1344,6 +1344,7 @@ func dashboardRuntimeConfig(cfg *config.Config, usageEnabled, demoMode bool) adm
 		RedisURL:             dashboardEnabledValue(simpleResponseCacheConfigured(cfg)),
 		SemanticCacheEnabled: dashboardEnabledValue(semanticResponseCacheConfigured(cfg)),
 		LiveLogsEnabled:      dashboardEnabledValue(cfg != nil && cfg.Admin.LiveLogsEnabled),
+		MCPEnabled:           dashboardEnabledValue(cfg != nil && cfg.MCP.Enabled),
 	}
 }
 

internal/app/app_test.go

@@ -501,6 +501,9 @@ func TestDashboardRuntimeConfig_ExposesFeatureAvailabilityFlags(t *testing.T) {
 		Admin: config.AdminConfig{
 			LiveLogsEnabled: true,
 		},
+		MCP: config.MCPConfig{
+			Enabled: true,
+		},
 		Cache: config.CacheConfig{
 			Response: config.ResponseCacheConfig{
 				Simple: &config.SimpleCacheConfig{
@@ -541,6 +544,9 @@ func TestDashboardRuntimeConfig_ExposesFeatureAvailabilityFlags(t *testing.T) {
 	if got := values.LiveLogsEnabled; got != "on" {
 		t.Fatalf("dashboardRuntimeConfig()[%q] = %q, want on", admin.DashboardConfigLiveLogsEnabled, got)
 	}
+	if got := values.MCPEnabled; got != "on" {
+		t.Fatalf("dashboardRuntimeConfig()[%q] = %q, want on", admin.DashboardConfigMCPEnabled, got)
+	}
 }
 
 func TestDashboardRuntimeConfig_ExposesIndefiniteLoggingRetention(t *testing.T) {
@@ -550,6 +556,15 @@ func TestDashboardRuntimeConfig_ExposesIndefiniteLoggingRetention(t *testing.T)
 	}
 }
 
+func TestDashboardRuntimeConfig_HidesMCPWhenDisabled(t *testing.T) {
+	values := dashboardRuntimeConfig(&config.Config{
+		MCP: config.MCPConfig{Enabled: false},
+	}, false, false)
+	if got := values.MCPEnabled; got != "off" {
+		t.Fatalf("dashboardRuntimeConfig()[%q] = %q, want off", admin.DashboardConfigMCPEnabled, got)
+	}
+}
+
 func TestDashboardRuntimeConfig_HidesCacheAnalyticsWhenUsageDisabled(t *testing.T) {
 	cfg := &config.Config{
 		Usage: config.UsageConfig{