Add MCP Connections support to sandbox startup

[jancurn]

Summary

This PR adds support for MCP (Model Context Protocol) Connectors in the sandbox. When users select MCP Connectors (like Slack, Notion, GitHub) in the Actor input, the sandbox now writes them to /sandbox/mcp.json on startup, making them immediately available to tools like mcpc connect.

Key Changes

• New MCP Connections Module (sandbox/src/mcp-connections.ts):

  • buildMcpConfig(): Constructs MCP server configuration from Connector IDs, building proxy URLs and authentication headers
  • writeMcpConfig(): Writes the configuration to /sandbox/mcp.json on sandbox startup
  • Includes sanitization for Connector IDs used as JSON keys while preserving original IDs in URLs
  • Gracefully handles missing/empty inputs and logs warnings when proxy URL is not configured

• Comprehensive Unit Tests (sandbox/tests/unit/mcp-connections.test.ts):

  • Tests for empty/nullish inputs, valid Connector IDs, proxy URL handling, and key sanitization
  • Validates that ${APIFY_TOKEN} placeholder is preserved in Authorization headers for runtime substitution

• Actor Input Integration (sandbox/src/types.ts):

  • Added mcpConnections?: string[] field to ActorInput interface to accept Connector IDs

• Actor Configuration (sandbox/.actor/actor.json):

  • Added mcpConnections input field with resource picker UI for selecting MCP Connectors

• Sandbox Startup (sandbox/src/main.ts):

  • Integrated writeMcpConfig() call during sandbox initialization (non-local mode only)
  • Logs the count of configured MCP connections

• Documentation (sandbox/artifacts/AGENTS.md):

  • Added section explaining user-provided MCP Connections with example usage and fallback behavior

Implementation Details

• The module writes /sandbox/mcp.json even when the connection list is empty, ensuring downstream tools can rely on its presence
• Connector IDs are sanitized for use as JSON object keys (alphanumeric, _, - are safe; others replaced with _)
• Original Connector IDs are preserved in proxy URLs for correct routing
• Authorization headers use Bearer ${APIFY_TOKEN} as a literal placeholder for runtime token substitution
• Errors during file write are logged but don't abort sandbox startup
• Trailing slashes are stripped from proxy base URLs to prevent double slashes in constructed URLs

https://claude.ai/code/session_01Kqvg4XLUCnqzWekWN889DJ