feat(mcp): federate profile-scoped tools through agentgateway

[robinbraemer]

Outcome

Expose approved MCP servers through agentgateway as one profile-scoped tool surface, with every discovery and invocation authorized from canonical Mate and Assignment identity.

Scope

• Federate selected MCP servers without replacing native Git, Kubernetes, PostgreSQL, or Herdr tools.
• Filter tools/list, resources, and prompts to the caller's effective OpenFGA capabilities.
• Authorize tools/call using the tool name plus reviewed, bounded resource selectors.
• Reject inconsistent routing metadata and request bodies.
• Preserve MCP session, cancellation, streaming, and provider error semantics.
• Emit privacy-safe OTel spans and audit decisions.

Acceptance criteria

• Two Mate profiles discover different tool catalogs from the same endpoint.
• A hidden or denied tool cannot be invoked by guessing its name.
• Assignment end, profile revocation, or kill-switch activation denies later calls within the revocation SLO.
• Tool arguments and results never enter logs, metrics, traces, or audit events.
• MCP failure does not remove ordinary Internet or native-tool access.
• Protocol conformance covers initialization/session behavior and the emerging stateless-header form.

References

• https://agentgateway.dev/blog/2026-02-20-mcp-multiplexing-tool-access-agentgateway/
• https://agentgateway.dev/blog/2026-07-21-stateless-mcp-still-needs-mcp-native-dataplane/