F7.1: MCP read tools (`sith serve --mcp`)

[gnanirahulnutakki]

Part of epic #25 (E7). Milestone: Phase L (day-0 adoption wedge). Source: docs/EPICS.md / docs/SITH-NOTION.md.

F7.1 — MCP read tools

What it is. Read tools (fleet.inventory, fleet.health, fleet.correlate,
fleet.cve-search) carrying readOnlyHint: true, hitting the fleet model, scoped to the caller's
workspace.

How it works.

1. An external agent calls a read tool over MCP.
2. The MCP layer is a thin client onto the same PEP; the read is tenant-scoped to the caller's
   workspace.
3. The fleet model (E2) answers, including cross-cluster correlation and CVE search.
4. The read is audited like any other (E6); no gate beyond tenant scope is needed for reads.

sequenceDiagram
    autonumber
    participant AG as External agent (MCP client)
    participant MCP as Sith MCP server
    participant PEP as PEP (tenant scope)
    participant FM as Fleet model (E2)
    AG->>MCP: call fleet.correlate (readOnlyHint: true)
    MCP->>PEP: same path as UI — resolve workspace scope
    PEP->>FM: query within caller's workspace
    FM-->>PEP: cross-cluster answer (stale flagged)
    PEP-->>MCP: result (audited)
    MCP-->>AG: result

Loading

Acceptance criteria.

• Read tools return workspace-scoped fleet answers, including correlation and CVE search.
• Reads are audited and carry readOnlyHint.

Key risk / guardrail. A read tool that ignored tenant scope would leak cross-tenant fleet
data. Guardrail: MCP reads go through the same PEP tenant scoping and DB RLS as the UI — the MCP
layer has no privileged data path.

---

Spec & slice. Slice 6 of docs/BUILD-SEQUENCE.md (PR #40). AC: the four read tools carry readOnlyHint:true, are workspace-scoped and audited; MCP reads use the same scope-resolution path as CLI/UI (no privileged data path — asserted by test); sith serve --mcp binds loopback only in local mode. Adopts MCP-2026 auth hardening from E7 #25 (audience-bound tokens, enforce-at-execution).

[gnanirahulnutakki]

Released to main in #62 (merge d2cfb284c8518f81be4510b44e225b5e9d742b7e) after feature PR #61.

Verification evidence:

• feature CI 29164690755: green in 6m19s
• post-merge dev CI 29164888965: green in 6m23s
• release CodeQL 29165108761: Actions 42s, JavaScript/TypeScript 59s, Go 2m28s
• post-release main CodeQL 29165194010: Actions 42s, JavaScript/TypeScript 1m16s, Go 2m59s
• local make ci, real two-cluster kind race gate (73.265s), no-egress compiled MCP E2E, and CGO-free darwin/linux/windows cross-compiles: green
• GitHub security queues were 0 open before publication

Delivered all four read-only tools, shared workspace scoping, privacy-safe auditing, loopback-only transport, optional short-lived keychain token, and execution-time audience/expiry enforcement. The local opaque token limitation versus future hub OAuth 2.1 is explicit in ADR 0007.