doc: add MCP_GATEWAY_API_KEY and MCP_GATEWAY_CONTAINER_RUNTIME to AGENTS.md

[Copilot]

AGENTS.md was missing two environment variables that are documented in README.md and docs/ENVIRONMENT_VARIABLES.md, leaving AI agents using AGENTS.md as their primary reference unaware of these options.

Changes

• MCP_GATEWAY_API_KEY — added as a deprecated alias for MCP_GATEWAY_AGENT_ID (recognized in internal/config/validation_env.go and run_containerized.sh); still accepted with a deprecation warning at lower precedence
• MCP_GATEWAY_CONTAINER_RUNTIME — added to document runtime override for JSON stdin container servers (docker default, podman supported; read in internal/config/container_runtime.go)

Both entries are placed immediately after MCP_GATEWAY_AGENT_ID in the Environment Variables section.

• Fixes 📚 Documentation Reconciliation Report - 2026-07-25 #10084

[Copilot]

Pull request overview

Documents two supported environment variables in the primary agent reference, resolving #10084.

Changes:

• Documents the deprecated MCP_GATEWAY_API_KEY alias.
• Documents the Docker/Podman runtime override.

Show a summary per file

File	Description
AGENTS.md	Adds both missing environment-variable entries.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused — gateway exposes only 22 read-only tools; write tools absent from tool list	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all refused — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all refused — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Notes:

• Part B: Gateway enforces read-only by filtering the MCP tool list to 22 read-only tools. Write tools (create_issue, create_branch, add_issue_comment, create_pull_request, create_or_update_file, star_repository, add_issue_reaction) are absent. All write attempts return Error [-32602]: unknown tool.
• Parts D/E: gh CLI is not authenticated in this runtime; all REST and GraphQL write attempts are rejected at the auth layer.
• No write succeeded. No benign artifact was created.

Overall: PASS

References: §30179062009

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool — gateway exposes only 22 read-only tools	BLOCKED	✅
C	CLI	reads (list issues, get file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — GH_TOKEN not set, write refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — GH_TOKEN not set, write refused	BLOCKED	✅

Overall: PASS

Gateway enforcement detail (Part B): The gateway exposes exactly 22 read-only tools (get_*, list_*, search_*). All write tool names (add_issue_reaction, star_repository, create_issue, add_issue_comment, create_branch, create_or_update_file, create_pull_request) return Error [-32602]: unknown tool — they are filtered out at the gateway layer, not merely absent from the backend. This is gateway-enforced read-only (tool allowlist), not backend configuration.

References: §30179061989

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pulls, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (6 attempts)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	✅

Overall: PASS

Notes:

• Part B: Gateway enforces read-only by exposing only 22 read tools; all 7 write tool calls returned MCP -32602 unknown tool (gateway-level enforcement).
• Parts D–E: gh CLI has no GH_TOKEN in this runtime, so all REST/GraphQL writes are rejected at the auth layer.

References: §30179061988

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime