[PLAY-3126] Testing MCP server for LibreChat

[nidaqg]

What does this PR do? A clear and concise description with your runway ticket url.

Adds playbook-mcp, a hosted MCP-UI render server that turns Playbook kits into ui:// HTML for LibreChat (and other MCP-UI hosts) via server-side pb_rails + dist/ai validation.

Consumers do not need a Playbook (or Highcharts) install. CSS/JS/fonts are self-served from /assets. Icons are inlined as SVG from @powerhome/playbook-icons. Charts ship as one self-contained IIFE that bundles React + Highcharts at image build time.

MCP tools

• list_kits / get_kit_schema
• render_kit / render_layout / render_chart
• Server instructions document tool-usage mechanics (schema-first, layout vs kit vs chart, snake_case kits / camelCase props, Highcharts options keys verbatim, no UI Actions) so hosts/agents get them on connect

Deploy / review

• Milano deploys website + MCP on PR stacks
• Website: https://pr.playbook…
• MCP: https://mcp-pr.playbook… (/health, /mcp)
• Docker builds playbook/dist + chart IIFE + vendored icon SVGs; PR TLS reuses shared playbook-tls
• Streamable HTTP at /mcp (not a browser page)

Security

• Prod fail-closed: SECRET_KEY_BASE + non-empty allowlist
• IP allowlist (PR: * behind VPN), rate limits, props size cap
• Optional X-Playbook-Mcp-Key
• Children HTML sanitization; chart options strip useHTML / formatters
• Asset path traversal hardened (.. / null-byte reject + root containment)
• Fresh Renderer per tool call (thread-safe under Puma multi-thread)

LibreChat / Phase 0 (verified with DW feedback)

• CSP uses absolute asset origin (not 'self') for srcdoc iframes
• Highcharts options keep camelCase (xAxis / yAxis)
• Charts: self-contained playbook-charts.js (no jsDelivr /+esm / importmap)
• Charts reserve mount + options.chart.height (default 400px)
• All kits load /assets/playbook-mcp-resize.js and post ui-size-change so @mcp-ui/client can grow the iframe (charts + tables/cards/layouts)
• Icons (icon_stat_value / icon_circle, etc.) render inline SVG via icon_path, not empty FA circles

Screenshots: Screenshots to visualize your addition/change

How to test? Steps to confirm the desired behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See addition/change

Checklist:

• LABELS Add a label: enhancement, bug, improvement, new kit, deprecated, or breaking. See Changelog & Labels for details.
• DEPLOY I have added the milano label to show I'm ready for a review.
• TESTS I have added test coverage to my code.
• PLAYGROUND I have added and tested Playground metadata and overrides for all kits and props updated in my code.
• SEMVER I have added a minor, major, or patch label for release.
• RC I have added an inactive RC label if not an active RC.

[powerhome-portal]

A change to documentation files was detected in your PR. Please visit this link to preview changes: https://portal-staging.powerapp.cloud/docs?filters[kind]=all&filters[user]=all&filters[namespaceFilter]=playbook-mcp

[nitro-pr-review]

The new playbook-mcp service is generally well structured (fail-closed boot, allowlisting, sanitization), but two high-severity issues should be fixed before production traffic: /assets path traversal past the intended allowlist, and a process-wide shared Renderer/ActionView context under Puma’s default multi-thread pool.

[nitro-pr-review]

Blocking reliability issues for production: in-memory /ui HTML storage cannot work with the default 2 replicas, and IP allowlisting does not exempt browser-loaded /ui and /assets the way the other gates do.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 24 hours if no further activity occurs.
If this change is desirable, please accelerate completing it. If it is not, please close the PR. If you're blocked on something, please ensure there's a reference to this PR in a story on your team's board so the team will follow up, and consider closing the PR for now.
Please do not artificially extend the deadline with a dummy comment. If necessary, provide a status update, such as "this change is being actively tested".
Thank you for your contributions and your collaboration in reducing WIP and cycle time.