GET /api/embed-mcp/bootstrap

The projection of the current user the MCP iframe may read. Closed on purpose: a field belongs here only when something the iframe renders reads it, so widening the projection is a decision someone has to make in this file rather than a side effect of the shared GET /api/user/current response growing.

Deliberately absent: email, login_attributes, jwt_attributes, attributes, sso_source, group_ids and the advanced-permissions flags. Nothing in the visualization reads them, and they are what made the general endpoint a scope-escalation target. The name fields are absent for the same reason: the iframe displays no user, and common_name falls back to the email address when a user has neither first nor last name.