## Summary New JSON-RPC 2.0 endpoint at `POST /api/v4/mcp-orbit` for external agents to query the Knowledge Graph via MCP protocol. This is a separate MCP server from the existing `/api/v4/mcp` (AI Framework). We need a dedicated endpoint because the Knowledge Graph is a distinct data product with its own GA timeline, monetization for the existing MCP endpoint has not been decided, and bundling KG tools into the existing server would bloat the system prompt by ~3.3k tokens for all consumers regardless of whether they use KG features. Separating the endpoints lets us manage rate limiting, feature flagging, and beta status independently. Context: https://gitlab.slack.com/archives/C089YV8KZL1/p1771895586482919 ## Scope - `POST /api/v4/mcp-orbit` with JSON-RPC 2.0 dispatch - MCP methods: `initialize`, `notifications/initialized`, `tools/list`, `tools/call` - `tools/list` and `tools/call` proxy to the GKG Rust service over gRPC - `initialize` and `notifications/initialized` handled locally in Rails - OAuth token with `mcp` scope required - Gated behind `:knowledge_graph` feature flag (EE-only) - Beta endpoint ## Implementation MR https://gitlab.com/gitlab-org/gitlab/-/merge_requests/224832 ## Dependencies - !224421 (gRPC client) must merge first - !224386 (JWT auth) - !224372 (traversal ID authorization)