Add saas-status-mcp MCP server for upstream SaaS dependency checks

[benlec]

Summary

Adds saas-status-mcp, a read-only MCP server that gives AWS DevOps Agent visibility into upstream SaaS dependency health during investigations. When the real root cause is upstream (Snowflake down, Datadog degraded, a third-party API on fire), that signal lives outside AWS. This server lets the agent correlate its infrastructure findings with SaaS status without leaving the investigation flow.

It exposes four provider-agnostic tools backed by the public Atlassian Statuspage.io /api/v2/* contract (which 80%+ of major SaaS providers use), so one generic client covers Snowflake, Datadog, GitHub, PagerDuty, and ~24 others with no provider-specific code:

• list_providers
• get_service_status
• get_active_events (core investigation tool)
• check_all_dependencies (bulk, parallel)

Architecture

• Hosted on Amazon Bedrock AgentCore Runtime, streamable-http transport, IAM/SigV4 auth (DevOps Agent only — not stdio-compatible; a local proxy is included solely as a testing aid).
• Stateless, no database, no credentials (upstream status APIs are public/unauthenticated).
• Provider registry is source-controlled (agent/providers.json) and read live from S3 via conditional GET, so the provider list can be updated with no redeploy.
• IaC in both CDK (Python) and Terraform, plus one-command deploy scripts (PowerShell + bash) and a DevOps Agent registration stack.

Testing

• Unit tests (tests/test_tools.py) cover all four tools with mocked Statuspage.io responses (operational, degraded, active incident, active maintenance, history, bulk-check, and the 10-provider cap).
• End-to-end tests/invoke_test.py against a deployed runtime.

Security

• Ran the AIDevOpsAgentMCPSecurityReview skill (devops-agent-custom-mcp-security) against the server — PASS, no findings. All tools are read-only and the outbound destination is never caller-controlled: tools take a provider name resolved against the source-controlled registry; unknown names error out before any network call, so there is no mutation and no attacker-directable outbound call / exfiltration channel.
• AppSec Guardian consultation: requested (in progress).

Notes for reviewers

• IaC choice: Appendix A's checklist mentions "SAM/CloudFormation"; this server ships CDK + Terraform instead, consistent with the existing aws-vpc-dns-diagnostics-mcp server in this repo. Happy to adjust if a SAM template is required.
• Adapted from the published sample in aws-samples/sample-aws-genai-ops-demos; internal references removed and docs aligned to this repo's conventions.