Add bounded read-only Athena terminal MCP

platform/mcp/compose.yaml

@@ -166,6 +166,30 @@ services:
       retries: 5
       start_period: 10s
 
+  mcp-athena-terminal:
+    <<: *tool-common
+    build:
+      context: .
+      dockerfile: Dockerfile.athena-terminal
+    image: mike-ai/mcp-athena-terminal:1.0.0
+    container_name: mike-ai-mcp-athena-terminal
+    environment:
+      ATHENA_TERMINAL_WORKSPACE: /workspace
+      ATHENA_TERMINAL_RUNTIME: /runtime
+    volumes:
+      # The terminal sees only versioned source and the bounded, payload-free
+      # runtime snapshot. It receives no Docker socket, host filesystem,
+      # secrets, SSH material, devices, PID namespace or egress network.
+      - ${PLATFORM_STACK_DIR:-/opt/mike-ai/stack}:/workspace:ro
+      - ${PLATFORM_CONTEXT_RUNTIME_DIR:-/var/lib/mike-ai-platform-context}:/runtime:ro
+    networks: [tools]
+    healthcheck:
+      test: ["CMD", "python", "-c", "import socket; s=socket.create_connection(('127.0.0.1',8000),2); s.close()"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
   mcp-github:
     <<: *tool-common
     build: