Support secure remote MCP transports and MCP server mode

[Hunter-Thompson]

Problem

The MCP integration currently supports local stdio servers only. Production integrations also need Streamable HTTP, authenticated remote sessions, and the ability to expose SDK tools and agents through an MCP server without bypassing existing policy boundaries.

Proposed scope

Remote client

• Streamable HTTP transport;
• legacy SSE compatibility only where necessary;
• transport-neutral connection and session lifecycle;
• pluggable OAuth and per-tenant header providers;
• reconnect, cancellation, backpressure, and cleanup behavior;
• tool/resource/prompt discovery with caching and invalidation.

Security requirements

• URL, DNS, redirect, and SSRF policy;
• TLS verification and configurable trust roots without insecure defaults;
• OAuth audience/scope validation and safe refresh behavior;
• credential and token redaction from logs, traces, model context, and errors;
• tenant-isolated credentials and connection pools;
• allowlists, quotas, provenance, approval, and audit hooks;
• durable effect classification, idempotency, and outcome-unknown handling before remote mutations are generally enabled.

Server mode

Expose selected SDK tools, resources, prompts, agents, and future workflows through an MCP server while preserving tool access, approvals, guardrails, tracing, and tenant boundaries.

Delivery sequence

1. Transport/auth interfaces and an experimental read-only Streamable HTTP client.
2. Remote-specific security and lifecycle tests.
3. Mutating remote calls only after durable approval and uncertain-effect handling are available.
4. MCP server mode.

Acceptance criteria

• Read-only Streamable HTTP works with authenticated and unauthenticated test servers.
• Redirect/DNS rebinding, private-network, invalid TLS, credential-leak, and cross-tenant tests fail closed.
• Cancellation, reconnect, session cleanup, and bounded resource use are tested.
• Production mutating calls bind approval to the immutable remote request.
• Unknown outcomes are surfaced for reconciliation and never retried blindly.
• Stdio behavior remains compatible and shares the transport-neutral policy layer.
• MCP server exposure cannot bypass the SDK tool policy or guardrails.
• Protocol conformance tests cover tools, resources, prompts, structured content, errors, and cancellation.