feat: upgrade MCP to Docker-based architecture (Beta)

Each MCP server can now run as its own Docker container on a dedicated
per-project bridge network, enabling proper isolation and lifecycle
management. SSE transport is removed (deprecated per MCP spec) with
backward-compatible serde alias. Docker socket access is auto-enabled
when stdio+Docker MCP servers are configured.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/src-tauri/src/commands/project_commands.rs

@@ -53,6 +53,19 @@ fn load_secrets_for_project(project: &mut Project) {
     }
 }
 
+/// Resolve enabled MCP servers and filter to Docker-only ones.
+fn resolve_mcp_servers(project: &Project, state: &AppState) -> (Vec<McpServer>, Vec<McpServer>) {
+    let all_mcp_servers = state.mcp_store.list();
+    let enabled_mcp: Vec<McpServer> = project.enabled_mcp_servers.iter()
+        .filter_map(|id| all_mcp_servers.iter().find(|s| &s.id == id).cloned())
+        .collect();
+    let docker_mcp: Vec<McpServer> = enabled_mcp.iter()
+        .filter(|s| s.is_docker())
+        .cloned()
+        .collect();
+    (enabled_mcp, docker_mcp)
+}
+
 #[tauri::command]
 pub async fn list_projects(state: State<'_, AppState>) -> Result<Vec<Project>, String> {
     Ok(state.projects_store.list())
@@ -97,6 +110,18 @@ pub async fn remove_project(
             let _ = docker::stop_container(container_id).await;
             let _ = docker::remove_container(container_id).await;
         }
+
+        // Remove MCP containers and network
+        let (_enabled_mcp, docker_mcp) = resolve_mcp_servers(project, &state);
+        if !docker_mcp.is_empty() {
+            if let Err(e) = docker::remove_mcp_containers(&docker_mcp).await {
+                log::warn!("Failed to remove MCP containers for project {}: {}", project_id, e);
+            }
+        }
+        if let Err(e) = docker::remove_project_network(&project.id).await {
+            log::warn!("Failed to remove project network for project {}: {}", project_id, e);
+        }
+
         // Clean up the snapshot image + volumes
         if let Err(e) = docker::remove_snapshot_image(project).await {
             log::warn!("Failed to remove snapshot image for project {}: {}", project_id, e);
@@ -143,10 +168,7 @@ pub async fn start_project_container(
     let image_name = container_config::resolve_image_name(&settings.image_source, &settings.custom_image_name);
 
     // Resolve enabled MCP servers for this project
-    let all_mcp_servers = state.mcp_store.list();
-    let enabled_mcp: Vec<McpServer> = project.enabled_mcp_servers.iter()
-        .filter_map(|id| all_mcp_servers.iter().find(|s| &s.id == id).cloned())
-        .collect();
+    let (enabled_mcp, docker_mcp) = resolve_mcp_servers(&project, &state);
 
     // Validate auth mode requirements
     if project.auth_mode == AuthMode::Bedrock {
@@ -178,6 +200,17 @@ pub async fn start_project_container(
         // AWS config path from global settings
         let aws_config_path = settings.global_aws.aws_config_path.clone();
 
+        // Set up Docker network and MCP containers if needed
+        let network_name = if !docker_mcp.is_empty() {
+            emit_progress(&app_handle, &project_id, "Setting up MCP network...");
+            let net = docker::ensure_project_network(&project.id).await?;
+            emit_progress(&app_handle, &project_id, "Starting MCP containers...");
+            docker::start_mcp_containers(&docker_mcp, &net).await?;
+            Some(net)
+        } else {
+            None
+        };
+
         let container_id = if let Some(existing_id) = docker::find_existing_container(&project).await? {
             // Check if config changed — if so, snapshot + recreate
             let needs_recreate = docker::container_needs_recreation(
@@ -218,6 +251,7 @@ pub async fn start_project_container(
                     &settings.global_custom_env_vars,
                     settings.timezone.as_deref(),
                     &enabled_mcp,
+                    network_name.as_deref(),
                 ).await?;
                 emit_progress(&app_handle, &project_id, "Starting container...");
                 docker::start_container(&new_id).await?;
@@ -250,6 +284,7 @@ pub async fn start_project_container(
                 &settings.global_custom_env_vars,
                 settings.timezone.as_deref(),
                 &enabled_mcp,
+                network_name.as_deref(),
             ).await?;
             emit_progress(&app_handle, &project_id, "Starting container...");
             docker::start_container(&new_id).await?;
@@ -299,6 +334,15 @@ pub async fn stop_project_container(
         }
     }
 
+    // Stop MCP containers (best-effort)
+    let (_enabled_mcp, docker_mcp) = resolve_mcp_servers(&project, &state);
+    if !docker_mcp.is_empty() {
+        emit_progress(&app_handle, &project_id, "Stopping MCP containers...");
+        if let Err(e) = docker::stop_mcp_containers(&docker_mcp).await {
+            log::warn!("Failed to stop MCP containers for project {}: {}", project_id, e);
+        }
+    }
+
     state.projects_store.update_status(&project_id, ProjectStatus::Stopped)?;
     Ok(())
 }
@@ -322,6 +366,14 @@ pub async fn rebuild_project_container(
         state.projects_store.set_container_id(&project_id, None)?;
     }
 
+    // Remove MCP containers before rebuild
+    let (_enabled_mcp, docker_mcp) = resolve_mcp_servers(&project, &state);
+    if !docker_mcp.is_empty() {
+        if let Err(e) = docker::remove_mcp_containers(&docker_mcp).await {
+            log::warn!("Failed to remove MCP containers for project {}: {}", project_id, e);
+        }
+    }
+
     // Remove snapshot image + volumes so Reset creates from the clean base image
     if let Err(e) = docker::remove_snapshot_image(&project).await {
         log::warn!("Failed to remove snapshot image for project {}: {}", project_id, e);