Module capabilities 

GET /api/capabilities (kernel spec §8; plan 4b): which mode this collector runs in, and which features it has switched on. The web UI shows the views of its mode (frontend spec §2) and hides a screen whose feature is off.

Behind the session cookie: the shell asks for it first, so a 401 here is what sends a signed-out browser to the login screen. The login and setup screens never ask, so they render in either mode.

Functions

current

What GET /api/capabilities answers.

features

The one place features are switched on: each gateway part adds its name when its API lands (mcp_connections, mcp_stdio, mcp_oauth, mcp_clients). Plan 8a’s connections API (/api/mcp/connections) is served, alongside stdio servers and plan 8f’s OAuth (…/authorize, the callback, the pre-registered client, the probe).

mode

The one place the mode is decided. Always the whole cockpit until the standalone gateway (plan 8g) adds its switch here.

router

The route, behind the browser rules and the session cookie.