# test\(server\): cover the agent browser access gate · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/9989fdf25bbabe2e3c77a5d56bf5792e4803ed53)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: 9989fdf25bbabe2e3c77a5d56bf5792e4803ed53

Requested commit: 9989fdf25bbabe2e3c77a5d56bf5792e4803ed53

Commit: 9989fdf25bbabe2e3c77a5d56bf5792e4803ed53

Tree: 57495a9d1b7a8ed61d813755fa667e2075b1c4fe

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
test(server): cover the agent browser access gate

The check flagged an untested backend behavior change, and it was right —
withholding the MCP credential is the whole feature, and nothing asserted it.

Credential issuance is the observable that matters: it is the only place a
credential is minted and `/mcp` accepts nothing else, so withholding it is
what actually denies every provider and any external MCP client.

Testing it needed a seam. The real issuer reads a module-global registry that
only a running MCP server installs, so from a unit test the enabled and
disabled paths look identical — both leave no session behind. Reading the
stored session back would have passed either way, which is worse than no test.
`ProviderServiceLiveOptions` already carries a test override for the canonical
event logger, so the issuer follows that existing pattern.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

```

## Parents

- [5e93541498f3e8c172bba6ad54b2ac742d625705](https://git.cafe/pingdotgg/t3code/commit/5e93541498f3e8c172bba6ad54b2ac742d625705?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/9989fdf25bbabe2e3c77a5d56bf5792e4803ed53?format=markdown)