Harden agent-friendly discovery and one-shot execution

CLAUDE.md

@@ -46,7 +46,7 @@ python -m cmdforge.cli  # Alternative CLI invocation
 - **collection.py**: Collection management (`Collection` dataclass, `resolve_tool_references()`, `classify_tool_reference()`), local collection storage in `~/.cmdforge/collections/`
 - **providers.py**: Provider abstraction. Supports subprocess CLI tools, OpenAI-compatible HTTP APIs, experimental PTY wrappers, fallback chains, and tool/MCP-server allowlists. Auto-discovers installed providers on first run. Config in `~/.cmdforge/providers.yaml` with versioned migration.
 - **skills.py**: Validated Agent Skills loader for per-provider `SKILL.md` context under `~/.cmdforge/providers/<name>/skills/`
-- **mcp_client.py / mcp_server.py**: Stdio MCP client/server integration, configuration, schema discovery, and exposure policy
+- **mcp_client.py / mcp_server.py**: Stdio and Streamable HTTP MCP integration, configuration, schema discovery, transport security, and exposure policy
 - **profiles.py**: AI persona profiles with system prompts, stored in `~/.cmdforge/profiles/`
 - **manifest.py**: Project manifest (`cmdforge.yaml`) for declaring tool dependencies with version constraints
 - **lockfile.py**: Lock file support for reproducible installs (`cmdforge.lock`)
@@ -101,6 +101,17 @@ runner supplies with the called tool's input contract.
 Quality headlines exclude categories with missing evidence and are accompanied
 by evidence coverage plus checked/not-tested category states.
 
+### Agent-facing discovery
+
+Use `cmdforge list --json --filter "<need>" --limit 10` for a compact local
+catalog containing names, descriptions, argument definitions, and contracts.
+Complete definitions (including prompt and code bodies) require an explicit
+`--full`. If no local tool fits, use
+`cmdforge registry search "<need>" --json --limit 5`. For one-off AI work,
+pipe data through `cmdforge run-once "Instruction {input}"`; repeated workflows
+should become normal versioned tools. Do not force CmdForge into application
+code where a direct SDK/API is itself the intended runtime dependency.
+
 ### Step Types
 
 1. **Prompt Step**: Calls AI provider with template, stores result in `output_var`