fix(mcp): filter credentials per-server in _embed_credentials

[aryanma]

_embed_credentials() was attaching all encrypted credentials to every server spec. Each server now receives only its own credentials, matched by connection name (slug.replace("/", "-")). API-side workaround removed in dedalus-labs/dedalus#9.

[cursor]

PR Summary

Medium Risk
Changes request payload shaping for encrypted MCP credentials; if connection-name derivation or server naming differs, servers may receive None creds and fail auth. Covered by new sync+async unit tests but impacts client/server integration.

Overview
Fixes MCP request preparation so _embed_credentials no longer attaches all encrypted credentials to every server; it now embeds only the credential matching that server’s connection name.

Adds wire.slug_to_connection_name() (slash-to-dash) plus request-side filtering logic and updates payloads so servers without a matching credential get credentials: None. Includes new tests validating both prepare_mcp_request and prepare_mcp_request_sync embed per-server credentials and remove the top-level credentials field.

^{Written by Cursor Bugbot for commit 375e62e. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Truthiness check silently drops falsy credential values
  • Changed the credential presence check to blob is not None so falsy-but-present values are preserved instead of treated as missing.

Or push these changes by commenting:

@cursor push f55259a6a3

Preview (f55259a6a3)

diff --git a/src/dedalus_labs/lib/mcp/request.py b/src/dedalus_labs/lib/mcp/request.py
--- a/src/dedalus_labs/lib/mcp/request.py
+++ b/src/dedalus_labs/lib/mcp/request.py
@@ -172,7 +172,7 @@
     """Return the subset of *all_creds* that belongs to *name*, or None."""
     conn = slug_to_connection_name(name)
     blob = all_creds.get(conn)
-    return {conn: blob} if blob else None
+    return {conn: blob} if blob is not None else None
 
 
 def _embed_credentials(