feat(indexer): mcp_tools — discover MCP tools from Helm config

docs/configuration/workspaceinfo-customization.md

@@ -26,12 +26,39 @@ codeCollections:
 - # Another code collections to scan
 
 
+# Information about MCP servers to discover tools from
+mcpConfig:
+  servers:
+    - display_name: jira
+      url: https://jira-mcp.internal:443/mcp
+      secret_ref: jira-mcp-token
+
+
 # Custom information about specific code bundles
 custom:
   prometheus_provider: gmp
   # More custom configuration
 ```
 
+#### MCP Server Discovery (`mcpConfig`)
+
+The optional `mcpConfig` block declares one or more private MCP servers to introspect during the indexer phase. For each entry the workspace builder calls `initialize` + `tools/list` on the server, then emits one `mcp_tool` resource per discovered tool. The `mcp-tool-proxy` codebundle in [rw-generic-codecollection](https://github.com/runwhen-contrib/rw-generic-codecollection) renders one SLX + Runbook per `mcp_tool` resource via its generation rule.
+
+<table><thead><tr><th width="220">Field</th><th width="120">Required</th><th>Description</th></tr></thead><tbody><tr><td><code>display_name</code></td><td>yes</td><td>Short identifier used in generated SLX names and tags (e.g. <code>jira</code>, <code>linear</code>). Lowercase, alphanumeric / underscores.</td></tr><tr><td><code>url</code></td><td>yes</td><td>Full HTTPS URL of the MCP endpoint, including the path (commonly <code>/mcp</code>). Must be reachable from the workspace-builder pod's network at index time, <em>and</em> from runner pods at execution time.</td></tr><tr><td><code>secret_ref</code></td><td>yes</td><td>Name of a Kubernetes <code>Secret</code> in the same namespace whose <code>data.token</code> is the bearer token to send as <code>Authorization: Bearer &lt;token&gt;</code>. Token is base64-decoded by the indexer before use.</td></tr><tr><td><code>verify_tls</code></td><td>no (default <code>true</code>)</td><td>Set to <code>false</code> to skip TLS certificate verification for this server. Intended for environments where the pod's CA bundle does not yet trust the server's issuer; a warning is logged for every cycle in which it is disabled. Prefer extending the CA bundle for production use.</td></tr></tbody></table>
+
+> The generated Runbook's <code>codeBundle.ref</code> is pinned to the ref of the codecollection the template was loaded from (the <code>ref</code> standard template variable). Point your <code>codeCollections</code> entry for <code>rw-generic-codecollection</code> at the branch/tag you want runners to execute against — no extra knob in <code>mcpConfig</code>.
+
+A single server's `tools/list` failure logs a warning and skips that server only — other servers and the rest of the cycle continue normally.
+
+##### Required secret shape
+
+```bash
+kubectl -n <namespace> create secret generic jira-mcp-token \
+  --from-literal=token='<bearer-token-value>'
+```
+
+The runner uses the same `secret_ref` at execution time (via `secretsProvided.workspaceKey`), so the secret must be reachable from the runner namespace too.
+
 #### Basic Workspace Configuration Info
 
 There are several settings that are used to configure information in the workspace that's generated to be uploaded to the RunWhen platform to. The available settings are:

src/component.py

@@ -248,7 +248,7 @@ def init_components():
     # be added here, which is less than ideal, although practically may not be
     # a huge deal.
     component_stages_init = (
-        (Stage.INDEXER, ["load_resources", "kubeapi", "cloudquery", "azure_devops"]),
+        (Stage.INDEXER, ["load_resources", "kubeapi", "cloudquery", "azure_devops", "mcp_tools"]),
         (Stage.ENRICHER, ["generation_rules"]),
         (Stage.RENDERER, ["render_output_items", "dump_resources"])
     )

src/enrichers/generation_rules.py

@@ -35,6 +35,7 @@
 from .gcp import GCPPlatformHandler, GCP_PLATFORM
 from .aws import AWSPlatformHandler, AWS_PLATFORM
 from .azure_devops import AzureDevOpsPlatformHandler
+from .mcp import McpPlatformHandler, MCP_PLATFORM
 
 from renderers.render_output_items import OUTPUT_ITEMS_PROPERTY
 from renderers.render_output_items import OutputItem as RendererOutputItem
@@ -1110,6 +1111,7 @@ def load(context: Context) -> None:
         GCP_PLATFORM: GCPPlatformHandler(),
         AWS_PLATFORM: AWSPlatformHandler(),
         "azure_devops": AzureDevOpsPlatformHandler(),
+        MCP_PLATFORM: McpPlatformHandler(),
     }
     context.set_property(PLATFORM_HANDLERS_PROPERTY_NAME, platform_handlers)
     request_code_collections = context.get_setting("CODE_COLLECTIONS")

src/enrichers/mcp.py

@@ -0,0 +1,35 @@
+from typing import Any, Optional
+
+from resources import Resource
+
+from .generation_rule_types import PlatformHandler
+
+# Source of truth for the platform name lives with the indexer; mirror it
+# here for the enricher's registration without forcing a cross-package
+# dependency at the top level.
+from indexers.mcp_tools import PLATFORM_NAME as MCP_PLATFORM
+
+
+class McpPlatformHandler(PlatformHandler):
+    """Platform handler for MCP-discovered tool resources.
+
+    Resources are emitted by `indexers.mcp_tools._emit_tool_resource` with a
+    nested `spec` dict carrying the server/tool fields. This handler surfaces
+    those fields as qualifier values and resource property values so the
+    generic generation-rules engine can match and name SLXs against them.
+    """
+
+    def __init__(self):
+        super().__init__(MCP_PLATFORM)
+
+    def _spec_value(self, resource: Resource, key: str) -> Optional[str]:
+        spec = getattr(resource, "spec", None) or {}
+        value = spec.get(key)
+        return value if value is not None else None
+
+    def get_resource_qualifier_value(self, resource: Resource, qualifier_name: str) -> Optional[str]:
+        return self._spec_value(resource, qualifier_name)
+
+    def get_resource_property_values(self, resource: Resource, property_name: str) -> Optional[list[Any]]:
+        value = self._spec_value(resource, property_name)
+        return [value] if value is not None else None