coder · ibetitsmike · Aug 26, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/chat_routes.go b/coderd/chat_routes.go
@@ -227,7 +227,7 @@ func (api *API) registerUserAIProviderKeyRoutes(r chi.Router) {
 // registerOrganizationChatRoutes mounts the organization-scoped chat and
 // MCP server configuration routes; r must already extract the
 // organization parameter.
-func (api *API) registerOrganizationChatRoutes(r chi.Router) {
+func (api *API) registerOrganizationChatRoutes(r chi.Router, prefix chatAPIPrefix) {
 	r.Route("/mcp-servers", func(r chi.Router) {
 		r.Get("/", api.listMCPServerConfigs)
 		r.Post("/", api.createMCPServerConfig)
@@ -242,6 +242,10 @@ func (api *API) registerOrganizationChatRoutes(r chi.Router) {
 				policy.ActionShare)).Get("/acl", api.mcpServerConfigACL)
 			r.With(httpmw.ExtractMCPServerConfigParam(api.Database, api.HTTPAuth.Authorize,
 				policy.ActionShare)).Patch("/acl", api.patchMCPServerConfigACL)
+			if prefix == chatAPIPrefixV2 {
+				r.With(httpmw.ExtractMCPServerConfigParam(api.Database, api.HTTPAuth.Authorize,
+					policy.ActionShare)).Get("/acl/available", api.mcpServerConfigACLAvailable)
+			}
 			r.With(httpmw.ExtractMCPServerConfigParam(api.Database, api.HTTPAuth.Authorize,
 				policy.ActionRead)).Get("/oauth2/connect", api.mcpServerOAuth2Connect)
 		})

diff --git a/coderd/chat_routes_test.go b/coderd/chat_routes_test.go
@@ -54,6 +54,7 @@ func TestChatRoutesCompatibility(t *testing.T) {
 		{http.MethodGet, "/api/v2/chats/config/advisor"},
 		{http.MethodGet, fmt.Sprintf("/api/v2/chats/%s/debug/runs", chat.ID)},
 		{http.MethodGet, fmt.Sprintf("/api/v2/chats/%s/stream/desktop", chat.ID)},
+		{http.MethodGet, fmt.Sprintf("/api/experimental/organizations/%s/mcp-servers/not-a-uuid/acl/available", firstUser.OrganizationID)},
 		{http.MethodGet, "/api/v2/mcp/servers/not-a-uuid/oauth2/callback"},
 		{http.MethodPost, "/api/v2/mcp/http/server"},
 	} {

diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -1383,7 +1383,7 @@ func New(options *Options) *API {
 			r.Use(apiKeyMiddleware)
 			r.Route("/{organization}", func(r chi.Router) {
 				r.Use(httpmw.ExtractOrganizationParam(options.Database))
-				api.registerOrganizationChatRoutes(r)
+				api.registerOrganizationChatRoutes(r, chatAPIPrefixExperimental)
 				r.Route("/members/{user}", func(r chi.Router) {
 					r.Use(httpmw.ExtractOrganizationMemberParam(options.Database))
 					api.registerOrganizationMemberChatRoutes(r)
@@ -1514,7 +1514,7 @@ func New(options *Options) *API {
 				r.Use(
 					httpmw.ExtractOrganizationParam(options.Database),
 				)
-				api.registerOrganizationChatRoutes(r)
+				api.registerOrganizationChatRoutes(r, chatAPIPrefixV2)
 				r.Get("/", api.organization)
 				r.Post("/templateversions", api.postTemplateVersionsByOrganization)
 				r.Route("/templates", func(r chi.Router) {

diff --git a/coderd/mcp.go b/coderd/mcp.go
@@ -532,7 +532,8 @@ func (api *API) getMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 	hasFullView := api.Authorize(r, policy.ActionUpdate, config) ||
 		api.Authorize(r, policy.ActionRead, rbac.ResourceAuditLog.InOrg(config.OrganizationID))
 	if !hasFullView && !config.Enabled &&
-		!api.Authorize(r, policy.ActionDelete, config) {
+		!api.Authorize(r, policy.ActionDelete, config) &&
+		!api.Authorize(r, policy.ActionShare, config) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}