chore(runtime): classify the external MCP fetch in the egress inventory

The HTTP transport for a user's MCP server is a new safeFetch call site,
which the URL egress audit requires an inventory entry for.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XiCF7BrK6J3ybmB2ULvFND

Author: georgi

docs/url-egress-inventory.md

@@ -104,6 +104,7 @@ Everything here fetches a URL somebody else chose, through the protected fetch.
 | Gemini node video download | `packages/llm-nodes/src/nodes/gemini.ts` | provider response |
 | provider result downloads | `packages/runtime/src/providers/{fal,replicate,kie,topaz,meshy,rodin,minimax,evolink,gemini,anthropic}-provider.ts` | provider response |
 | MCP OAuth Client ID Metadata Document fetch | `packages/websocket/src/oauth/cimd.ts` | model/client (an MCP client's self-hosted `client_id` URL) |
+| external MCP server (HTTP transport) | `packages/websocket/src/external-mcp.ts` | operator (a user's own MCP server URL; guarded under the cloud profile, loopback allowed on a local install) |
 
 The provider row is eleven files, each downloading a URL a provider's response
 named — plus one reading a URL the caller's own message named

packages/runtime/tests/url-egress-inventory.ts

@@ -266,6 +266,21 @@ export const URL_EGRESS_INVENTORY: EgressEntry[] = [
     "Reads the uri a workflow output named before storing the bytes as an asset."
   ),
 
+  {
+    file: "packages/websocket/src/external-mcp.ts",
+    owner: "external MCP server (HTTP transport)",
+    inputSource: "operator",
+    schemes: ["https"],
+    authScope:
+      "The headers the user configured for that server, resolved from their own secrets; safeFetch strips Authorization on a cross-origin hop.",
+    redirects: "checked-per-hop",
+    dnsRebinding: "deployment-egress",
+    policy: "guarded",
+    guardedBy: ["safeFetch", "assertSafePublicHttpsUrl"],
+    note:
+      "A user's own MCP server URL. Under the cloud profile the MCP transport is handed safeFetch and the URL is checked on save and probe; a local install may reach its own loopback servers and uses the global fetch."
+  },
+
   // -------------------------------------------- guarded (provider result URLs)
   guardedSafeFetch(
     "packages/kie-nodes/src/kie-base.ts",