MCP integration

1. Connect to the approved MCP endpoint.
2. Complete the advertised authentication flow.
3. List tools and resources for the current identity.
4. Call a representative read-only tool.
5. Expand to mutating tools only after validation.

Tool visibility is identity and tenant scoped. Clients must not assume every server-side capability is exposed.