feat(providers): support dynamic token grants for MCP endpoints

[muralimaram]

Summary

Support dynamic provider token grants on endpoints configured with protocol: mcp, so OpenShell can enforce MCP tool-level policy and inject a short-lived credential on the same request.

Problem

OpenShell currently requires a choice between MCP-aware policy enforcement and dynamic credential injection:

1. With protocol: mcp, the Supervisor can parse MCP JSON-RPC and restrict individual tools such as jira_search, but the MCP relay does not execute the provider's dynamic token_grant before forwarding the request.
2. With protocol: rest, the REST relay executes the dynamic grant and injects the bearer token, but policy is limited to the HTTP method and endpoint path. OpenShell cannot distinguish one MCP tool from another inside that request.

The REST compatibility path allows the integration to function, but it weakens enforcement from an individual MCP-tool allowlist to an exact-path POST allow rule.

Requested behavior

• Execute configured dynamic token grants for admitted protocol: mcp requests.
• Parse and enforce MCP tools/list and tools/call policy before obtaining or injecting the downstream credential.
• Inject the resolved credential using the provider's configured authentication style and header placement.
• Fail closed when policy admission, credential resolution, or credential injection fails.
• Keep credential values and reusable credential handles outside the sandbox and agent-visible state.
• Preserve MCP-specific audit events without recording credential values.

Example configuration

endpoints:
  - host: mcp.example.com
    port: 443
    protocol: mcp
    path: /jira/mcp
    enforcement: enforce
    mcp:
      strict_tool_names: true
    rules:
      - allow:
          method: tools/list
      - allow:
          method: tools/call
          params:
            name:
              glob: jira_search

credentials:
  - name: access_token
    auth_style: bearer
    header_name: Authorization
    token_grant:
      url: https://credential-broker.example.com/api/token/grant
      audience: jira
      scopes:
        - mcp.read
      subject_token:
        credential: subject_token

Acceptance criteria

• An allowed MCP tool call executes its configured dynamic token grant and receives the injected credential.
• A disallowed MCP tool is rejected before credential resolution and upstream execution.
• tools/list and tools/call remain subject to MCP-specific policy.
• Grant failure, timeout, or an unresolved credential prevents the upstream request.
• The actual credential and any reusable credential handle are never exposed to the sandbox or agent.
• Credential injection remains restricted to the matched scheme, host, port, and path with TLS inspection active.
• Logs and policy events identify the MCP method/tool and grant outcome without exposing token values.
• Tests cover allowed and denied tools, grant success and failure, cache expiry/refresh, redaction, and cross-sandbox isolation.

Example use case

An agent calls a Jira-compatible MCP endpoint. OpenShell admits only jira_search, obtains a user-delegated short-lived bearer token through the configured token grant, injects it into Authorization, and forwards the request. The agent never receives the bearer token.