feat(integrations): add looot MCP integration

[walidboulanouar]

HUMAN:
I run looot. It gives agents one account for 2,500+ data endpoints. Happy to answer questions

Why

looot (https://looot.ai) is a hosted MCP server with one account and one prepaid balance for 2,500+ data API endpoints (work emails, phone numbers, company and people search, web search, LinkedIn profiles, local businesses). The agent searches the catalog, sees the price before a call runs, and pays per call. A failed call costs nothing. There is no subscription, and top-ups start at $5. The integration catalog has Exa, Tavily and Brave Search for web search but nothing for people and company data.

Summary

• Add integrations/catalog/looot.json: a hosted Streamable HTTP MCP server at https://api.looot.ai/mcp. Option 1 is OAuth 2.1 with PKCE and dynamic client registration. Option 2 is an optional bearer token.
• Regenerate integrations/catalog-index.js with npm run build:integrations.

Issue Number

None.

How to Test

Checked against the live endpoints, no paid run:

curl -s https://api.looot.ai/.well-known/oauth-authorization-server
  authorization_endpoint https://api.looot.ai/oauth/authorize
  token_endpoint         https://api.looot.ai/oauth/token
  registration_endpoint  https://api.looot.ai/oauth/register
  code_challenge_methods_supported ['S256']
  token_endpoint_auth_methods_supported ['none', ...]

curl -si -X POST https://api.looot.ai/mcp -H 'content-type: application/json' -d '{}'
  HTTP 401, www-authenticate: Bearer resource_metadata="https://api.looot.ai/.well-known/oauth-protected-resource", scope="catalog.read runs.execute runs.read usage.read"

Against this branch:

node scripts/build-integration-catalog.mjs          # regenerates catalog-index.js, one new import
python3 -c "Draft202012Validator(schema).iter_errors(looot.json)"   # schema errors: []
node -e "listIntegrationCatalog({mcp:true,oauth:true}).some(x => x.id==='looot')"   # true

I did not run the pytest suite (no pytest in my environment), so tests/test_catalog_schema.py and tests/test_integration_catalog_in_sync.py are covered only by the schema check and the regenerate step above. I did not exercise the OpenHands install modal. A live call needs a looot account (sign in with the browser flow on first use).

Video/Screenshots

None, data-only change.

Notes

• The icon at logoUrl is the 1024 px PNG from https://github.com/loootai/looot-plugin (MIT).
• The OAuth scopes are the ones the server asks for in its WWW-Authenticate header. The server also supports connections.read, workflows.read and workflows.execute, which are not needed for the basic flow.
• I work on looot. Docs: https://docs.looot.ai. Privacy: https://looot.ai/privacy. Support: https://looot.ai/contact.