ug mcp login: per-service sign-in status + login for agents' MCP services

[sunishsheth2009]

All dependencies are now merged: databricks/cli auth login --resource (databricks/cli#6763), plus #717/#731/#679. This branch is rebased on main and ready to review. The service-name filter flag is --names (matching ug mcp add).

What

Adds ug mcp login — sign in to the connection-backed AI Gateway MCP services the coding agents are configured to use. Shows which are already signed in vs. need a per-user connection sign-in, and runs the sign-in for the ones you pick (interactive picker) or name with --services / scope with --agents.

Why

Non-native agents (codex, gemini, opencode) reach connection-backed MCP services (e.g. system.ai.github) via ug mcp-proxy, which vends tools only after a per-user connection login. Rather than block inside an agent-spawned proxy (fragile), this is an explicit, decoupled login the user runs in their own shell. It also works for Claude/Cursor — the credential is per-user and shared across all agents, so signing in once unblocks the service everywhere.

Reuses the shared enumeration (incl. #717's OS-managed files)

• list_mcp_command's developer + workspace-managed server merge is extracted into a shared configured_mcp_servers_by_name(state, agents); ug mcp list, ug status, and ug mcp login all use it, so they agree on the configured-server set.
• Managed-file coverage: [AIGTWY-4784] Write managed MCP servers to agents' OS-managed files #717 delivers Claude/Codex managed servers into the agents' OS-managed files (not state). configured_mcp_servers_by_name now also reads those files (claude.read_managed_mcp_urls() / codex.read_managed_mcp_urls()), so ug mcp login sees managed mcp-services regardless of how they were delivered — the cross-PR gap is closed here instead of left as a follow-up.

How it works (existing UC REST APIs — no unshipped deps)

• GET /mcp-services/<full-name> → id + source_connection (name + securable_kind)
• GET /connections/<conn>/user-credentials/<user>?dependent.mcp_service.id=<id> → provisioning_info.state (ACTIVE = signed in; HTTP 404 = needs login)

Works for any connection-backed MCP service — not just system.ai.* (source connection resolved from the service's own config).

UX (symmetric with ug mcp add)

• bare ug mcp login → status table + picker (needs-sign-in pre-checked)
• --services system.ai.github[,github] → targeted, non-interactive
• --agents claude,codex → scope to those agents' services

Status renders with the same rich Table + status_badge styling as ug mcp list. Sign-in is databricks auth login --resource <mcp-url> (databricks/cli#6621), with a clear "upgrade your CLI" error if --resource is missing.

Testing

tests/test_mcp_login.py — status classification, the --resource invocation incl. the old-CLI clear error, --services/--agents scoping, workspace-managed inclusion, and OS-managed-file inclusion. tests/test_mcp.py — configured_mcp_servers_by_name merge/scope + the managed-file read (TestConfiguredMcpServersByName). ruff + ty clean; the full mcp/login/cli/agent suite (876) is green.

This pull request and its description were written by Isaac.

Example output

ug mcp login (real output) — the status table, then an interactive checklist (needs-sign-in pre-checked) to pick which to sign in to:

╭───────────╮
│ MCP login │
╰───────────╯
  Workspace: https://eng-ml-inference.staging.cloud.databricks.com

Connection-backed MCP services
MCP SERVICE       AGENTS         SIGN-IN
system.ai.github  claude, codex  needs sign-in

? Sign in to MCP services (space to toggle, enter to confirm):
 ❯ ◉ system.ai.github  (needs sign-in)

Non-interactive form, ug mcp login --names system.ai.github, signs in to the named service(s) directly (no picker), and prints signed in on success.