feat: add MCP server for AI agent integration

[james00012]

Summary

• Adds an MCP (Model Context Protocol) server (cloud-nuke mcp-server) that exposes cloud-nuke capabilities to AI agents over stdio
• Implements 4 tools: list_resource_types, inspect_resources, nuke_resources, validate_config
• Multi-layer safety model: dry_run defaults true, CONFIRM_NUKE confirmation string, --read-only mode, region/resource-type/project allowlists, max-resources-per-nuke limit (default 100)
• Structured audit logging to stderr for all inspect and nuke operations
• 79 unit tests covering safety checks, parameter validation, renderer events, edge cases, and tool annotations

File structure

mcp/
├── server.go          # Server creation, tool registration, validation, audit logging
├── helpers.go         # Shared param parsing, validators, tool param definitions
├── renderer.go        # MCPRenderer implementing reporting.Renderer
├── types.go           # Response types, server config
├── tools_list.go      # list_resource_types handler
├── tools_inspect.go   # inspect_resources handler (AWS + GCP)
├── tools_nuke.go      # nuke_resources handler with safety checks
├── tools_config.go    # validate_config handler
├── server_test.go     # 79 unit tests
commands/
├── mcp_command.go     # CLI wiring for `cloud-nuke mcp-server`
├── cli.go             # Register mcp-server subcommand

Usage

# Start MCP server (for AI agent integration)
cloud-nuke mcp-server

# Read-only mode (disable nuke)
cloud-nuke mcp-server --read-only

# Restrict to specific regions and resource types
cloud-nuke mcp-server --allowed-regions us-east-1 --allowed-resource-types ec2,s3

# Limit max resources per nuke operation
cloud-nuke mcp-server --max-resources-per-nuke 50

MCP client config example

{
  "mcpServers": {
    "cloud-nuke": {
      "command": "cloud-nuke",
      "args": ["mcp-server", "--allowed-regions", "us-east-1"]
    }
  }
}

Test plan

• go build ./... succeeds
• go vet ./... clean
• go test ./mcp/... — 79 tests pass
• Manual: cloud-nuke mcp-server starts and responds to JSON-RPC over stdin
• Integration: list_resource_types returns AWS/GCP types
• Integration: inspect_resources with real AWS creds scans resources
• Integration: nuke_resources with dry_run: true returns preview