Remove MCP stdio support and harden action authorization

[Paul Lizer (paullizer)]

Summary

Outbound MCP should not launch local processes or rely on manifest-supplied identity and scope for authorization. This change makes MCP remote-only and applies consistent authorization throughout configuration, credential resolution, and execution.

• Remove stdio for every role and scope, including Admin/global actions. Keep streamable HTTP, SSE, WebSocket, inbound MCP, and the HTTP-based development server.
• Bind actions to authoritative storage origins and authorize with the current caller and current policy, including cached invocation and retries. Environment destination restrictions remain a non-overridable minimum; management reads do not hydrate credentials.
• Preserve retired actions and legacy settings.plugins records for explicit reconfiguration or deletion. Preflight imports and bulk saves, retain IDs, and replace blanket migration cleanup with verified per-record outcomes and conflict handling.
• Remove process controls from schemas, presets, and the shared modal; show unsupported states and migration outcomes without silently selecting HTTP. Personal deletion uses stable IDs/legacy locators to avoid same-name collisions.

Breaking change: existing stdio actions remain visible but cannot execute. Owners must explicitly configure a supported remote endpoint or delete the action; there is no privileged stdio opt-in.

Linked issue

N/A - tracked as security advisory work; no issue-closing reference.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.028 -> 0.261.031. No deployer changes.

Testing / validation

• Combined offline Python coverage passed for retirement, request boundaries, trusted runtime authorization, legacy preservation/migration, bulk saves, and fresh-process import boundaries:

python -B -m pytest -q --disable-warnings `
    .\functional_tests\test_mcp_stdio_removal.py `
    .\functional_tests\test_mcp_action_route_security.py `
    .\functional_tests\test_mcp_user_settings_ingestion.py `
    .\functional_tests\test_user_plugin_bulk_save_id_preservation.py `
    .\functional_tests\test_mcp_authorization_context.py `
    .\functional_tests\test_mcp_legacy_stdio_management.py `
    .\functional_tests\test_app_settings_import_boundaries.py

• Review follow-up: the seven suites above plus test_mcp_server_presets.py passed in normal and optimized Python (python -B -O -m pytest), with 161 tests and 266 subtests in each run, including fresh-process import checks.
• The unhashability assertion follow-up passed 16 tests and 60 subtests in normal and optimized Python. Mutation probes also confirmed the regression rejects an incorrectly hashable manifest and an unrelated TypeError.
• node --experimental-vm-modules --test .\functional_tests\test_mcp_stdio_removal_ui.js: 12 offline UI scenarios passed.
• Existing MCP manifest, destination/preconfiguration, preset, argument-normalization, connection-secret-redaction, profile-authorization, route-policy, Swagger, documentation, logging, and syntax checks passed.
• python -B -m pytest -q --collect-only .\ui_tests\test_workspace_mcp_action_modal.py: five scenarios collected. Authenticated browser/Azure Playwright and live MCP/cloud validation were not run.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated MCP action, preset, preconfiguration, governance, and connection-test guidance, with retirement notices on historical guidance. Added docs/explanation/fixes/MCP_STDIO_REMOVAL_AND_AUTHORIZATION_FIX.md and regenerated the application surface inventory. Release notes are intentionally unchanged in this PR; upgrade guidance is included in the fix documentation.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new route URLs were added; security decorators were checked on all four changed route modules. User-settings responses expose safe legacy management views rather than process configuration or credentials.