[giacaglia]

Summary

The Transcend Rails Agent Controls plugin defaulted GATEWAY_BASE_URL to the dev gateway (mcp.dev.myelin-internal.com). A fresh install signed in against dev, even for production customers.

This PR changes the default to the production US gateway, https://mcp.us.withrails.ai. The plugin has no auth host of its own. Cursor reads the issuer from the gateway's Protected Resource Metadata, and production already advertises https://api.us.withrails.ai. The public client myelin_cursor_plugin is registered there with the Cursor redirect URIs.

Changes

• Changed the GATEWAY_BASE_URL default and description in plugin.json, and bumped the plugin to 0.7.0 so the marketplace listing picks it up.
• Removed the validator's exception for the dev host. An internal hostname can no longer ship as a plugin default.
• Named the default gateway in the plugin README install steps.

Cutover

• Installs that kept the default move to production after updating. Users whose organization lives on dev must set Gateway base URL to https://mcp.dev.myelin-internal.com. Dev stays up, so nothing breaks for anyone who set an override.
• Cursor stores OAuth state per server name. A user who signed in to dev may need to clear auth for transcend-agent-governance and reconnect.
• The global mcp.withrails.ai name does not exist in DNS. Production hosts are region-scoped, so EU tenants will override the default once an EU region ships.

Verification

• node scripts/validate-cursor-plugins.mjs passes. Restoring the dev default makes it fail, as intended.
• Production discovery checked with curl: mcp.us.withrails.ai Protected Resource Metadata lists api.us.withrails.ai, and that issuer serves Authorization Server Metadata and the myelin_cursor_plugin client metadata.
• Not verified: a live Cursor install and sign-in against production with the updated plugin.

Related Issues

• Closes LINK-10131
• Ref LINK-8874

[linear-code]

LINK-10131

LINK-8874

[pkg-pr-new]

Open in StackBlitz

@transcend-io/airgap.js-types

pnpm add https://pkg.pr.new/@transcend-io/airgap.js-types@037b167

yarn add https://pkg.pr.new/@transcend-io/airgap.js-types@037b167.tgz

@transcend-io/cli

pnpm add https://pkg.pr.new/@transcend-io/cli@037b167

yarn add https://pkg.pr.new/@transcend-io/cli@037b167.tgz

@transcend-io/custom-function-types

pnpm add https://pkg.pr.new/@transcend-io/custom-function-types@037b167

yarn add https://pkg.pr.new/@transcend-io/custom-function-types@037b167.tgz

@transcend-io/design-tokens

pnpm add https://pkg.pr.new/@transcend-io/design-tokens@037b167

yarn add https://pkg.pr.new/@transcend-io/design-tokens@037b167.tgz

@transcend-io/internationalization

pnpm add https://pkg.pr.new/@transcend-io/internationalization@037b167

yarn add https://pkg.pr.new/@transcend-io/internationalization@037b167.tgz

@transcend-io/privacy-types

pnpm add https://pkg.pr.new/@transcend-io/privacy-types@037b167

yarn add https://pkg.pr.new/@transcend-io/privacy-types@037b167.tgz

@transcend-io/sdk

pnpm add https://pkg.pr.new/@transcend-io/sdk@037b167

yarn add https://pkg.pr.new/@transcend-io/sdk@037b167.tgz

@transcend-io/secret-value

pnpm add https://pkg.pr.new/@transcend-io/secret-value@037b167

yarn add https://pkg.pr.new/@transcend-io/secret-value@037b167.tgz

@transcend-io/type-utils

pnpm add https://pkg.pr.new/@transcend-io/type-utils@037b167

yarn add https://pkg.pr.new/@transcend-io/type-utils@037b167.tgz

@transcend-io/utils

pnpm add https://pkg.pr.new/@transcend-io/utils@037b167

yarn add https://pkg.pr.new/@transcend-io/utils@037b167.tgz

commit: 037b167

[bencmbrook]

@giacaglia @TCJackwood do we use the .us convention anywhere else in Rails?

[TCJackwood]

@giacaglia @TCJackwood do we use the .us convention anywhere else in Rails?

@bencmbrook our Prod setup has been following the same conventions we've been doing in the Admin Dash, with api.withrails.ai being for the EU cluster, and api.us.withrails.ai for the US cluster.

@dipack95 has been owning all of those pieces, he would know best on where we use the .us bit for routing to the correct cluster on things

[bencmbrook]

@TCJackwood Ahh interesting thanks! Good to go here then.

Would love to think through the multi-region strategy at some point, but not a super high priority. Will file a ticket! LINK-10137

[giacaglia]

@jwahjudi Can u take a look at it whenever you have a chance?

[jwahjudi]

I can take a look!

[giacaglia]

Thank you!