// Sanitized reproduction of the nginx-ui pre-2.3.4 MCP router shape
// that produced CVE-2026-33032 (MCPwn). Do not run. The actual tool
// handler is stubbed — this file is read by the AAK-MCPWN-001
// scanner as text only.

package mcp

import "github.com/gin-gonic/gin"

func RegisterMcp(router *gin.Engine) {
    // /mcp requires auth — good.
    router.POST("/mcp", AuthRequired(), mcpHandler)

    // /mcp_message shares the handler but has no middleware — the bug.
    router.POST("/mcp_message", mcpHandler)
}
