docs: move token-exchange screenshot above steps and add pending_verification state copy to verify dialog

[Pratham-Mishra04]

Summary

Improves the MCP token exchange verification flow by distinguishing between first-time verification and re-verification states, and moves the setup screenshot to appear before the setup steps in the documentation.

Changes

• The "Re-verify as me" dialog now shows context-aware title and description text: clients in pending_verification state display "Verify as me" and "Establish Bifrost's discovery credential..." instead of the renewal-focused copy
• The info box body text within the verify dialog similarly adapts between "establish" and "renew" language, and omits the "you only need this if the credential badge shows it's expired" note for first-time verifications since that guidance is irrelevant at initial setup
• Adds three new UI screenshots (ui-mcp-token-exchange-setup.png, ui-mcp-token-exchange-verify.png, ui-mcp-token-exchange-repair.png) to the docs media directory
• Moves the token exchange setup screenshot above the numbered steps in token-exchange.mdx so readers see the UI before following the instructions

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Create a new MCP client with token exchange auth — the verify dialog should show "Verify as me" and "Establish..." copy
2. After the client is active, open the verify dialog again — it should show "Re-verify as me" and "Renew..." copy including the expiry guidance note
3. Confirm the token exchange setup page in the docs renders the screenshot above the numbered steps

Screenshots/Recordings

Three new screenshots added under docs/media/:

• ui-mcp-token-exchange-setup.png — the MCP client creation form with token exchange fields
• ui-mcp-token-exchange-verify.png — the verify dialog for an active client
• ui-mcp-token-exchange-repair.png — the verify dialog for a client in a degraded/expired state

Breaking changes

• Yes
• No

Related issues

Security considerations

No security implications. Changes are limited to UI copy and documentation.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[Pratham-Mishra04]

• docs: add use_idp_credentials to token_exchange config, make client_id optional when set, and document Entra ID requirement with updated prerequisites and gotchas #6069
• feat: add use_idp_credentials to token-exchange config, allowing SSO login app credentials to be reused for providers like Microsoft Entra ID that require it #6068
• docs: move token-exchange screenshot above steps and add pending_verification state copy to verify dialog #6063 👈 (View in Graphite)
• docs: add quarterly (1Q) budget reset with reset_config/quarter_start_month, Entra ID OBO gotchas, and clarify token-exchange app registration guidance #6062
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Improved token-exchange verification messaging for initial setup and re-verification.
  • Added clearer guidance about discovery credentials, renewal, and expiration details.

• Documentation

  • Updated the token-exchange setup guide with a screenshot placed alongside the Web UI setup step.

Walkthrough

The token-exchange verification dialog now provides state-specific guidance. The setup documentation places its screenshot at the start of the Web UI configuration tab.

Changes

Token exchange updates

Layer / File(s)	Summary
State-specific verification dialog ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx	Pending clients use “Verify as me” with establishment guidance. Existing clients use “Re-verify as me” with renewal guidance.
Setup screenshot placement docs/mcp/auth/token-exchange.mdx	The screenshot now appears at the start of the Web UI configuration tab instead of after the setup instructions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: impoiler

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes both the documentation change and the state-specific token-exchange verification copy.
Description check	✅ Passed	The description covers the purpose, changes, affected areas, testing steps, screenshots, breaking changes, and security considerations.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 08-11-feat_token_exchange_mcp_docs_images_added

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx (1)

706-712: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Update stale token-exchange comments.

The new pending_verification branch makes this dialog serve initial verification and renewal. Comments at Lines 275-280, 347-350, and 426-431 still describe it only as "Re-verify as me" for an already-verified client. Update those comments to describe both modes.

Suggested wording

-// Drives the token_exchange "Re-verify as me" confirm dialog.
+// Drives the token_exchange state-aware verification confirm dialog.

-// Opens the "Re-verify as me" confirm dialog for a token_exchange client.
+// Opens the state-aware verification confirm dialog for a token_exchange client.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx` around lines 706 -
712, Update the comments at the token-exchange references around the relevant
client verification logic to describe both initial verification and renewal,
rather than only “Re-verify as me” for an already-verified client. Align the
wording with the pending_verification and re-verification modes shown by the
DialogTitle and DialogDescription; do not change runtime behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx`:
- Around line 729-735: The explanatory text near the MCP credential action must
not claim that running it any time is safe. Update the paragraph to state that
the action performs live verification and may refresh or retain the credential,
or alternatively add endpoint-specific throttling and concurrency protection to
the verify-exchange flow.

---

Nitpick comments:
In `@ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx`:
- Around line 706-712: Update the comments at the token-exchange references
around the relevant client verification logic to describe both initial
verification and renewal, rather than only “Re-verify as me” for an
already-verified client. Align the wording with the pending_verification and
re-verification modes shown by the DialogTitle and DialogDescription; do not
change runtime behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e52c4987-4303-4a53-9f3a-8db38a68b7a2

📥 Commits

Reviewing files that changed from the base of the PR and between fc5a4a6 and 7512e05.

⛔ Files ignored due to path filters (3)

• docs/media/ui-mcp-token-exchange-repair.png is excluded by !**/*.png
• docs/media/ui-mcp-token-exchange-setup.png is excluded by !**/*.png
• docs/media/ui-mcp-token-exchange-verify.png is excluded by !**/*.png

📒 Files selected for processing (2)

• docs/mcp/auth/token-exchange.mdx
• ui/app/workspace/mcp-registry/views/mcpClientsTable.tsx

[akshaydeo]

Merge activity

• Aug 11, 4:47 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Aug 11, 4:48 PM UTC: @akshaydeo merged this pull request with Graphite.

The base branch was changed.