Serve the Orbit MCP server without the mcp_client feature flag

What does this MR do and why?

Duo agentic chat gets its MCP servers from Ai::DuoWorkflows::McpConfigService. Every server was behind the mcp_client feature flag, including the first-party Orbit server. The flag is off by default. Dedicated does not enable default-off flags. So on every Dedicated and self-managed instance the agent has no Orbit tools. This is true even when Orbit is enabled and the group allows external MCP tools. A Dedicated customer on 19.3 hit this.

This MR takes the Orbit server and its pre-approved tool names out from behind mcp_client. Orbit keeps its own gates in Ai::Orbit::Settings: Knowledge Graph availability, the orbit_foundational_agent flag, and the per-user settings. The GitLab MCP server, the AI Catalog servers, and the x-gitlab-enabled-mcp-server-tools header stay behind the flag. This MR does not start the GitLab MCP tool migration.

References

• Root cause and evidence: gitlab-org/orbit/knowledge-graph#1036 (closed).
• Flag definition: mcp_client.yml.
• Old gate: mcp_config_service.rb#L53.
• Flag rollout issue: #572340.
• Duo Workflow Service side, already merged: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!7058 (merged).

Screenshots or screen recordings

Both sessions ran on the same GDK with mcp_client off. The agent session view on the left of each screenshot is the same fixed session, kept for context.

Before (master)	After (this MR)
Agentic chat has no Orbit tools and answers NO_ORBIT_TOOLS.	The Orbit agent in the Duo Chat panel runs 7 Orbit tool actions (list_commands, get_graph_schema, get_query_dsl, query_graph) and lists real projects.

How to set up and validate locally

Verified end to end on a GDK at this commit. The Duo Workflow Service and AI Gateway ran ai-assist main (3befc0ff9), and the Orbit stack was up. Each row is one agentic chat over the Workhorse WebSocket.

Case	Code	mcp_client	Allow external MCP tools	Result
Baseline	master	off	on	NO_ORBIT_TOOLS, reproduces the customer report
Fix	this MR	off	on	orbit_list_commands and orbit_invoke_command query_graph called, 5 real projects returned
Toggle off	this MR	off	off	same Orbit calls, same result
GitLab MCP stays gated	this MR	off	on	ask for gitlab_get_mcp_server_version, agent answers NO_GITLAB_MCP_TOOLS
Regression	this MR	on	on	gitlab_get_mcp_server_version and the Orbit tools both called
Web UI, Orbit agent	this MR	off	on	Duo Chat panel, 7 Orbit tool actions, 5 real projects (screenshot above)

Workhorse request log for the same window: with the flag off, the only requests with user agent GitLab-Workhorse-Mcp-Client go to /api/v4/orbit/mcp. With the flag on, /api/v4/mcp appears as well.

Steps:

1. Feature.disable(:mcp_client) in the Rails console.
2. Enable Orbit for the root group and for your user under Preferences.
3. Start an agentic chat. Ask it to use its Orbit tools to find 5 projects.
4. The agent calls orbit_list_commands, then orbit_invoke_command, and lists real projects.
5. Ask: "Call the tool gitlab_get_mcp_server_version." The agent reports that it has no such tool.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.