Update PubFi authentication metadata

[acgxv]

Change Type

• Add a new server definition
• Update an existing server definition
• Fix a bug in an existing definition
• Other (describe in Summary)

Summary

Correct PubFi's authentication metadata so public MCP discovery is represented separately from authenticated tool execution.

Server Details

• Server Name: PubFi MCP
• Server ID: ai.pubfi-mcp
• Transport: http
• Authentication: optional_api_key
• Categories: ai-ml, developer-tools
• Upstream Repository: https://github.com/helixbox/pubfi-docs

Checklist

CI-enforced - your PR will fail without these

• JSON file lives at servers/<id>.json
• Filename matches the id field exactly
• Required fields present: id, name, transport
• pnpm validate servers/<id>.json passes
• pnpm check-conflicts passes (no duplicate IDs or aliases)
• pnpm test passes
• Every commit is signed off - git commit -s (DCO)

Reviewer quality bar

• description is one clear sentence - no marketing fluff
• At least one category from categories.json is assigned
• Every ${input:ID} placeholder has a matching metadata.inputs[].id
• Every secret / credential input is marked "secret": true
• Each credential input has an obtain block with step-by-step instructions (numbered, \n between steps)
• auth.type is consistent with how credentials are actually wired into the transport
• links.repository resolves (when the upstream is public)
• capabilities (tools / resources / prompts / read_only_mode) reflect what the server actually implements
• platforms is accurate - don't claim ["all"] without verifying Windows/macOS/Linux

Platform-managed fields - leave unset

• I did not set badges, stats, sponsored, featured
• I did not set publisher.official, publisher.verified, publisher.domain_verified
• I did not add any _platform*-prefixed keys

Trademark & branding

• No "official" / "certified" / "endorsed" wording unless I represent the trademark owner
• I have the right to reference the logo URL (an asset I'm allowed to hot-link - emoji are not accepted)

Tested locally (recommended for new servers)

• Installed the server in McpMux and it started successfully
• Called at least one tool / fetched at least one resource / rendered at least one prompt

Notes for Reviewers

Fresh production probes confirmed the authentication boundary:

• unauthenticated initialize: HTTP 200
• unauthenticated tools/list: HTTP 200, five tools returned
• unauthenticated tools/call: HTTP 401

The transport URL, authorization header, server identity, and capabilities are unchanged. This PR only makes PUBFI_API_KEY optional for discovery and sets auth.type to optional_api_key; calling a tool still requires the Bearer key.

Local checks passed:

• npx --yes pnpm@10.28.1 validate servers/ai.pubfi-mcp.json
• npm run validate:all
• npx --yes pnpm@10.28.1 check-conflicts
• npx --yes pnpm@10.28.1 test