Minor, deliberately not a patch.
phylokit_mcp.server no longer exposes a module-level mcp. Anything importing it breaks, so this is a public API change even though no tool signature moved — build_server() replaces it. Importing the module no longer constructs a server, and each call returns a fresh one.
Two tests pin that property and were seen to fail against three deliberate mutants (a reintroduced singleton, a cached factory, and a factory registering no tools). Verified from an installed wheel: 5 tools, console script intact.
Also carries the community-health tier (CONTRIBUTING.md, SECURITY.md, issue forms, PR template, .editorconfig, .mcp.json, glama.json, CodeQL, Dependabot) and server.json validation against the registry's published schema.