[vicgupta]

Summary

• Added opt-in stdio MCP servers with explicit tool allowlists, bounded discovery and calls, schema checks, and namespaced tools.
• Recorded the external catalog in trajectories and rejected MCP-enabled resumes.
• Documented configuration, trust boundaries, limits, and result handling.

Verification

• go test ./...
• go vet ./...
• Static builds for Linux, macOS, and Windows on amd64 and arm64
• git diff --check

Closes #55

---

Opened by amf.

[vicgupta]

Hourly-merge rebase note (from the tinyagent-hourly-merge run):

Rebased this PR onto current main (a38e86b) — conflicts in cmd/tinyagent/main.go (read-only notice vs. MCP startup) and internal/agent/loop.go (read-only tool list vs. MCP catalog) were resolved by keeping both sides: the read-only notice and tool restrictions stay, and MCP startup/catalog are added alongside them.

One fix beyond pure conflict resolution, needed to keep main's read-only guarantee intact after the rebase:

• Executor.Catalog() now returns only Specs(true) in read-only mode, and Executor.Run() no longer dispatches external (MCP) calls when ReadOnly is set — previously the rebased Catalog() ignored ReadOnly and Run() dispatched external calls before the read-only check in run(), so MCP tools would have been offered and executed in read-only mode. The trajectory ToolSignature in loop.go also keeps the read-only argument (ToolSignature(a.Tools.ReadOnly)) so read-only checkpoints still validate.
• No other behavior changed; MCP runs remain opt-in, allowlisted, and non-resumable as in the original PR.