The MCP tells the truth about itself: probe reads, the guide lists all ten tools, probe and stop have tests #342

The MCP now describes itself accurately: probe is marked read-only, the guide lists all ten tools, and probe and stop have their own tests.

• probe: src/http/mcp.ts now sets writes: false on it, so tools/list reports readOnlyHint: true. The canWrite check inside the tool is unchanged, so it still needs the access the page needs.
• Read tokens: an ro token held by a user who can write to the repo can now call probe, because that is what read-only means here. A user without write access still gets forbidden, and one who can't read the repo gets not_found.
• Guide: docs/MCP.md adds audit and probe to the tools table in the same voice, with no "writes" mark. The access note now says knocking with probe is a writer's, like stopping a run.
• Existing test: I changed the old audit test's probe assertion, which expected an ro token to get forbidden. That held only because of the token's scope, which no longer applies to probe. The probe checks now live in their own test.
• New probe test: it checks the readOnlyHint values for probe (true) and stop (false). It also checks that rw and ro tokens reach the app-and-contract stage on a repo they can read. A repo the token can't read, and a nonexistent repo, both return not_found.
• New stop test: it covers a fresh run id (stopped), an ro token (forbidden), another user's token (not_found), an unknown id (not_found) and a repeat on the same id (finished, "already ended").

bun test test/mcp.test.ts passes (11 tests). The full bun test run timed out in my shell (the 500-second limit), so I haven't seen the whole suite pass.

I did not add a test of probe against a running app with a sound contract. That needs a served app, which this file doesn't set up.

To try it, call tools/list on POST /mcp with a token and read the annotations, or run bun test test/mcp.test.ts.

🤖 Generated with Claude Code

Closes #333