feat(mcp): Add optional visibility parameter to control chat visibility (#903)

* Add optional visibility parameter to MCP ask_codebase tool

- Add visibility parameter to askCodebaseRequestSchema in MCP
- Update blocking chat API to accept and use visibility parameter
- Allow agents to override default visibility (PRIVATE/PUBLIC)
- Useful for shared environments like Slack where links should be public

Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

* Update CHANGELOG entries for PR #903

- Add entry to main CHANGELOG.md
- Add entry to packages/mcp/CHANGELOG.md

Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

* Update CHANGELOG to mention /api/chat/blocking endpoint

- Clarify that the change affects both the API endpoint and MCP tool

Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

* Prevent anonymous users from creating PRIVATE chats

- Update visibility logic to ignore PRIVATE requests from unauthenticated users
- Add guard to ensure anonymous users can only create PUBLIC chats
- Update tool description and schema to document this behavior
- Prevents creation of inaccessible ownerless private chats

Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

* Move anonymous user restriction note to API route description

- Remove note from MCP tool descriptions (schemas.ts and index.ts)
- Add note to blocking chat API route's visibility parameter description
- Clarifies that the restriction is enforced at the API level

Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: brendan-kellam

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added optional `visibility` parameter to `/api/chat/blocking` endpoint and MCP `ask_codebase` tool to allow controlling chat session visibility in shared environments. [#903](https://github.com/sourcebot-dev/sourcebot/pull/903)
+
 ## [4.11.1] - 2026-02-18
 
 ### Changed

packages/mcp/CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added optional `visibility` parameter to `ask_codebase` tool to allow controlling chat session visibility in shared environments. [#903](https://github.com/sourcebot-dev/sourcebot/pull/903)
+
 ## [1.0.16] - 2026-02-10
 
 ### Added

packages/mcp/src/index.ts

@@ -416,6 +416,8 @@ server.tool(
 
     Returns a detailed answer in markdown format with code references, plus a link to view the full research session (including all tool calls and reasoning) in the Sourcebot web UI.
 
+    When using this in shared environments (e.g., Slack), you can set the visibility parameter to 'PUBLIC' to ensure everyone can access the chat link.
+
     This is a blocking operation that may take 30-60+ seconds for complex questions as the agent researches the codebase.
     `,
     askCodebaseRequestSchema.shape,

packages/mcp/src/schemas.ts

@@ -381,6 +381,10 @@ export const askCodebaseRequestSchema = z.object({
         .omit({ displayName: true })
         .optional()
         .describe("The language model to use for answering the question. If not provided, defaults to the first model in the config. Use list_language_models to see available options."),
+    visibility: z
+        .enum(['PRIVATE', 'PUBLIC'])
+        .optional()
+        .describe("The visibility of the chat session. If not provided, defaults to PRIVATE for authenticated users and PUBLIC for anonymous users. Set to PUBLIC to make the chat viewable by anyone with the link."),
 });
 
 export const sourceSchema = z.object({

packages/web/src/app/api/(server)/chat/blocking/route.ts

@@ -33,6 +33,10 @@ const blockingChatRequestSchema = z.object({
     languageModel: languageModelInfoSchema
         .optional()
         .describe("The language model to use for the chat. If not provided, the first configured model is used."),
+    visibility: z
+        .nativeEnum(ChatVisibility)
+        .optional()
+        .describe("The visibility of the chat session. If not provided, defaults to PRIVATE for authenticated users and PUBLIC for anonymous users. Set to PUBLIC to make the chat viewable by anyone with the link. Note: Anonymous users cannot create PRIVATE chats; any PRIVATE request from an unauthenticated user will be ignored and set to PUBLIC."),
 });
 
 /**
@@ -62,7 +66,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
         return serviceErrorResponse(requestBodySchemaValidationError(parsed.error));
     }
 
-    const { query, repos = [], languageModel: requestedLanguageModel } = parsed.data;
+    const { query, repos = [], languageModel: requestedLanguageModel, visibility: requestedVisibility } = parsed.data;
 
     const response: BlockingChatResponse | ServiceError = await sew(() =>
         withOptionalAuthV2(async ({ org, user, prisma }) => {
@@ -95,12 +99,18 @@ export const POST = apiHandler(async (request: NextRequest) => {
             const { model, providerOptions } = await _getAISDKLanguageModelAndOptions(languageModelConfig);
             const modelName = languageModelConfig.displayName ?? languageModelConfig.model;
 
+            // Determine visibility: anonymous users cannot create private chats (they would be inaccessible)
+            // Only use requested visibility if user is authenticated, otherwise always use PUBLIC
+            const chatVisibility = (requestedVisibility && user)
+                ? requestedVisibility
+                : (user ? ChatVisibility.PRIVATE : ChatVisibility.PUBLIC);
+
             // Create a new chat session
             const chat = await prisma.chat.create({
                 data: {
                     orgId: org.id,
                     createdById: user?.id,
-                    visibility: user ? ChatVisibility.PRIVATE : ChatVisibility.PUBLIC,
+                    visibility: chatVisibility,
                     messages: [] as unknown as Prisma.InputJsonValue,
                 },
             });