ROX-31475: add stdio support

[janisz]

Description

This PR adds a configuration option to run stdio mode.

Validation

I run

claude mcp add --transport stdio  test2 --env STACKROX_MCP__SERVER__TYPE=stdio --env STACKROX_MCP__TOOLS__VULNERABILITY__ENABLED=true -- $PWD/stackrox-mcp

and then asked to list cluster cves and got a valid error:

test2 - list_cluster_cves (MCP)(clusterId: "")
  ⎿  Error: list_cluster_cves tool is not yet implemented

[mtodor]

One thing, I'm not sure is - will this work with passthrough auth type?

[codecov-commenter]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
161	2	159	0

View the full list of 2 ❄️ flaky test(s)

github.com/stackrox/stackrox-mcp/internal/testutil::

Flake rate in main: 100.00% (Passed 0 times, Failed 2 times)

Stack Traces | 0s run time

Build error

github.com/stackrox/stackrox-mcp/internal/toolsets/mock::

Flake rate in main: 100.00% (Passed 0 times, Failed 2 times)

Stack Traces | 0s run time

Build error

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[janisz]

One thing, I'm not sure is - will this work with passthrough auth type?

Good point. Let me add e2e tests and whoami command as the part of startup

[mtodor]

I have tested this, and it doesn't work with the passthrough auth flow. What is understandable because there are no request headers for stdio (I guess).

Anyway, it works for a static auth flow. Command looks like this:

claude mcp add --transport stdio  test3 \
	--env STACKROX_MCP__SERVER__TYPE=stdio \
	--env STACKROX_MCP__CENTRAL__AUTH_TYPE=static \
	--env STACKROX_MCP__CENTRAL__API_TOKEN="${ROX_TOKEN}" \
	--env STACKROX_MCP__TOOLS__CONFIG_MANAGER__ENABLED=true  \
	--env STACKROX_MCP__CENTRAL__URL=staging.demo.stackrox.com:443 \
	-- $PWD/stackrox-mcp

Let's make the following changes:

• document command in the readme (how to use stdio)
• add config validation if stdio is used, the auth type has to be static

P.S. You can use the config manager tool because that one actually makes requests to the server. And you can create API token on staging demo and test everything against it.

[mtodor]

Nice work! Added a few nitpicks, nothing related to the functionality.