[vishu-bh]

Superseded by smaller PRs for review:

• fix: restore standalone E2E TypeScript checks #218 — Independent E2E typing fix, targeting main.
• feat: define OAuth connection validation contract #219 — OpenAPI contract, targeting main.
• feat: add shared OAuth connection validation #220 — Shared validation, based on feat: define OAuth connection validation contract #219.
• feat: surface OAuth validation on MCP Servers #221 — MCP Servers UI, based on feat: add shared OAuth connection validation #220.
• feat: surface OAuth validation on Catalog cards #222 — Catalog UI, based on feat: surface OAuth validation on MCP Servers #221.

Merge the feature stack in the order #219 → #220 → #221 → #222. The split stack plus #218 exactly reproduces this PR. Each feature checkpoint passes its production build and full coverage suite; browser flows pass on the Servers and Catalog checkpoints.

Original description

OAuth authorization currently reloads token status and imports components without proving that the stored token can access tools. Add an explicit Test connection action with shared token, MCP negotiation, and tools-access results on MCP Servers, server details, and catalog cards.

Tests use the exact saved gateway ID and URL with validationMode: "post_authorization". The UI supports cancellation, retesting, reauthorization, permission checks, and stale-result protection. Structured callback errors receive localized guidance in English, Spanish, and Portuguese. Missing stage evidence cannot report success.

Related to IBM/mcp-context-forge#5722. Depends on IBM/mcp-context-forge#7343, which is still unmerged. The OpenAPI schema is pinned to backend revision d2da38b56be5e8e4bdf51db9b2c43d4c96036b62. Keep this PR in draft until the backend dependency lands; then refresh the schema and repeat contract checks against the merged revision.

Also fixes two existing standalone E2E TypeScript errors and records the verified permission-expression false positive in the secret-scan baseline.

Validation:

• Frontend and BFF production builds; frontend, BFF, and E2E TypeScript checks; ESLint; Prettier; whitespace checks: passed.
• Frontend: 3,852 tests passed, 1 skipped; all coverage thresholds passed.
• BFF: 300 tests passed.
• Playwright: 266 tests passed, 2 real Keycloak tests skipped in mocked-API mode.
• Backend PR smoke tests: 6 passed against an isolated running gateway.
• Repository secret-detection check: passed.