feat: MCP AWS servers and proxy (ENG-103)

[betterclever]

ENG-103 — MCP AWS Servers (CloudTrail + CloudWatch)

Summary

• Add MCP stdio proxy (spec-compliant Streamable HTTP) and AWS MCP server images.
• Add MCP runtime helper + AWS MCP components (tool-mode only) with credential bundle support.
• Add MCP category and UI badges for MCP nodes; update colors + palette ordering.
• Add workflow cleanup for MCP containers + managed volumes.

What changed

• docker/mcp-stdio-proxy: streamable HTTP proxy using official SDK Server + stdio client.
• docker/mcp-aws-cloudtrail, docker/mcp-aws-cloudwatch: images with AWS MCP servers installed.
• MCP runtime helper in worker supports dynamic ports and localhost binding.
• AWS MCP components now write shared credentials/config into isolated volumes.
• New mcp category across backend + frontend; MCP badge on node header.
• Cleanup activity removes MCP containers and managed volumes per run.

Testing

• Manual: container boots, tools list/call via streamable HTTP, creds mounted OK.
• Not run: full end-to-end workflow + UI validation.

Notes

• Stacked on ENG-101/102.
• Proxy currently bound to localhost only (per requirement).

Refs: ENG-103

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd8746daec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve allowedTools filter when refreshing MCP servers

When a gateway session is initialized with an x-allowed-tools header, getServerForRun registers tools with that filter. The new refreshServersForRun path re-registers tools with allowedTools set to undefined, so any newly registered tools will be added to existing server instances even if they were created with a narrower tool list. This means clients that intentionally requested a limited tool set can see additional tools after any tool registration event, which breaks the expected scoping for those sessions. Consider storing the original allowedTools per cacheKey and passing it back into registerTools during refresh.

Useful? React with 👍 / 👎.