Add VPC DNS diagnostics MCP

[ddericco]

Description

Adds mcp/aws-vpc-dns-diagnostics-mcp, an MCP server for AWS DevOps Agent that diagnoses VPC DNS resolution in beyond that the AWS APIs can determine.

• dns_probe_* (Mode A): runs comparative, multi-resolver DNS resolution inside an EC2 instance via SSM Run Command. It returns what a name actually resolves to from that subnet, which resolver answered (hostname.bind), and how a custom or hybrid resolver diverges from the VPC resolver. The EC2, VPC, and Route 53 describe APIs return DNS configuration but do not have visibility into what a client actually sees.

• dns_simulate_* (Mode B): read-only, pre-change validation. It builds the VPC's effective config as the union of directly attached and Route 53 Profile-inherited constructs, applies a proposed change symbolically, and reports which currently-resolving names would break. A seven-level precedence engine and six trap detectors name the mechanism rather than just the affected zones: VPCE-shadow-NXDOMAIN, broad-FORWARD-sweep, flag-AND-mismatch, DNS-Firewall-block, Profile-union-shift, resolver-disabled.

• list_sops / get_sop: serves 16 diagnostic runbooks bundled in the deployment package, so the agent fetches interpretation guidance at runtime rather than carrying it in context.

• Companion skill to help the agent decide when to invoke and define a consistent investigation sequence

Transport follows the documented DevOps Agent path: FastMCP over Streamable HTTP via Lambda Web Adapter, on a Lambda Function URL with AuthType: AWS_IAM and RESPONSE_STREAM, registered with the mcpserversigv4 service type. No AgentCore Gateway or OAuth front end required.

Type of change

• New skill
• New custom agent
• Update to an existing skill or agent
• Documentation or infrastructure change

This is a new MCP server under mcp/. There is no checkbox for that, so ticking the closest option.

Testing

• Unit: 88 tests, no AWS calls. Cross-account denial paths use fake sessions raising real botocore exceptions. sam build and sam validate --lint both clean.

• Live testing: deployed and drove all six tools over a SigV4-signed Function URL. Unsigned requests return 403; signed return 200 with an mcp-session-id. Mode A reproduced a custom-resolver divergence (10.42.200.99 from a local resolver vs 10.42.200.10 from the PHZ, with getent following the custom resolver). Mode B read the live effective config and correctly predicted a broad . FORWARD rule would sweep seven names.

• Security review: passed the MCP security review skill. Five findings from the first pass were remediated and a re-review returned PASS with no findings and no new issues. Guard tests assert the IAM grants cannot silently re-widen.

• Agent Skill Eval: report.json shows "passed": true at the root, overall score 0.96, with audit 100/100, functional 0.9 (grade A), and trigger passing. Six functional evals and eight trigger queries, six of them negative. Artifacts committed under skills/aws-vpc-dns-investigation/evals/.

Notes:

• test-infra/ holds CloudFormation fixtures that reproduce each diagnostic scenario end to end, including a two-account provider/consumer pair for the cross-account opacity cases. Let me know if these should be removed.
• No credentials exist, so Secrets Manager is not used; the function contacts only AWS control-plane APIs, so it needs no VPC attachment. Both deviations from the reference pattern are documented in the README.

License confirmation

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache License 2.0.