subMIT Status Checking MCP Server

[NamN8Tr]

Summary

This PR adds a built-in submit_status MCP server that allows ARCHI agents to run safe, read-only diagnostics across selected subMIT cluster nodes.

The new MCP server exposes two tools:

• run_diagnostic: run a diagnostic command on a specific submit node
• run_diagnostic_all: run a diagnostic command across all configured nodes in a machine group

Supported node groups include login, scratch, and Ceph nodes. The server only permits a whitelisted set of diagnostic commands, such as df, free, condor_q, ceph status, systemctl status, and journalctl. Each command argument is validated individually to prevent shell chaining, piping, or command injection.

Changes

• Added a new built-in MCP server under:src/archi/mcp_servers/submit_status/
• Added support for run_diagnostic and run_diagnostic_all tools.
• Added per-command and per-argument validation for safe read-only diagnostics.
• Wired the new server into CMSCompOpsAgent through a BUILTIN_MCP_SERVERS class attribute.
• Added BaseReActAgent.get_mcp_servers_config(), which merges:
  • MCP servers defined by the agent itself through BUILTIN_MCP_SERVERS
  • MCP servers defined in the deployment config under mcp_servers
• Updated _build_mcp_tools to use the merged MCP server config, so deployment-configured MCP servers continue to work alongside built-in ones.
• Updated the chat container Dockerfiles to:
  • install openssh-client
  • mount ${HOME}/.ssh read-only
  • support SSH authentication to submit nodes through the a2rchi account using SUBMIT_SSH_USER and SUBMIT_SSH_KEY