fix(mcp): treat different URL credentials as a new destination

[TheodoreSpeaks]

Summary

• isSameMcpServerDestination now compares URL username and password, not just origin + path — URL.origin excludes userinfo, so a URL with different embedded credentials was treated as the same destination
• Follow-up to fix(mcp): restrict MCP server destination changes to admins #8629; only the query string and fragment may differ now

Type of Change

• Bug fix

Testing

• Added a regression case to lib/mcp/utils.test.ts; it fails on the pre-fix code and passes after
• lib/mcp/ suite (345 tests), bun run lint, bun run check:audits (58 audits), docs-manifest:check

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 6, 2026 2:52am UTC

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Changes how MCP server destinations are compared for equality.

The PR appears safe to merge; no outstanding finding or new actionable issue was identified.

Summary

The PR makes MCP destination comparison include URL username and password, and adds a regression test for credential-only differences.

• Query strings and fragments remain excluded from the comparison.

_{Reviews (2) · Last reviewed commit: "fix(mcp): treat different URL credential..."}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}