Feature request: allow marking HTTP MCP tools as reader in config

[mivallion]

Problem

HTTP/Streamable HTTP MCP servers (such as Context7, Tavily, Brave Search, etc.) expose tools that are purely read-only — they fetch documentation or search results without mutating any state. However, Reasonix currently classifies all tools from HTTP MCP servers as writers by default, because they make outbound network requests.

This means these tools are blocked from being called in read-only contexts (planner, subagents, read-only tasks), even though they never change anything.

Error seen:

MCP server "context7" no longer classifies tool "resolve-library-id" as an allowed reader

Current behavior

• MCP servers can declare readOnlyHint: true in their tools/list response, and Reasonix respects that.
• However, many popular HTTP MCP servers don't declare this hint (Context7, Tavily, etc.).
• There is currently no user-side override — nothing in reasonix.toml or .mcp.json lets you mark an HTTP MCP server or its tools as read-only.

Requested feature

Add a configuration option to explicitly declare an MCP server's tools (or specific tools) as read-only / reader, bypassing the automatic writer classification. For example:

[[plugins]]
name    = "context7"
type    = "http"
url     = "https://mcp.context7.com/mcp"
headers = { CONTEXT7_API_KEY = "..." }
reader  = true   # treat all tools from this server as read-only

Or more granular, per-tool:

[[plugins]]
name    = "tavily"
type    = "http"
url     = "https://mcp.tavily.com/mcp/?tavilyApiKey=..."
reader_tools = ["tavily_search", "tavily_extract"]

This gives users a safe escape hatch for servers they trust, without requiring every MCP server maintainer to implement readOnlyHint.

Why this matters

The current workaround is calling the underlying REST API directly via bash wrappers — which defeats the purpose of using the MCP protocol. Making HTTP MCP tools usable in read-only paths would unlock many practical use cases: documentation lookup, web search, API reference queries, all without workarounds.

Related context

From SPEC.md §3.7 / GUIDE.md Permissions section: readers always default to allow, and the per-call gating only applies to writers. If an HTTP MCP server's tools could be marked as readers, they would work transparently everywhere — including in the planner, strict read-only subagents, and review workflows.