Harden M7.6/7.7: recursive restriction accumulation, MCP server enforcement, fast-fail authorization

CLAUDE.md

@@ -40,11 +40,13 @@ python -m cmdforge.cli  # Alternative CLI invocation
 ### Core Modules (`src/cmdforge/`)
 
 - **cli/**: CLI commands entry points (`cmdforge` command). Routes subcommands: list, create, edit, delete, test, run, ui, docs, check, refresh, providers, registry, collections, deps, install, lock, verify, add, remove, init, config, settings, system-deps
-- **tool.py**: Tool definition dataclasses (`Tool`, `ToolArgument`, `PromptStep`, `CodeStep`, `ToolStep`), YAML config loading/saving, wrapper script generation
+- **tool.py**: Tool definition dataclasses (`Tool`, `ToolArgument`, `PromptStep`, `CodeStep`, `ToolStep`, `McpStep`), YAML config loading/saving, wrapper script generation
 - **runner.py**: Execution engine. Runs tool steps sequentially, handles variable substitution (`{input}`, `{varname}`), executes Python code steps via `exec()`, handles nested tool calls with depth limit (MAX_TOOL_DEPTH=10)
 - **resolver.py**: Tool resolution. `resolve_tool()` searches: project manifest → local tools → owner/name → registry. Returns `ResolvedTool` with path info
 - **collection.py**: Collection management (`Collection` dataclass, `resolve_tool_references()`, `classify_tool_reference()`), local collection storage in `~/.cmdforge/collections/`
-- **providers.py**: Provider abstraction. Supports subprocess CLI tools, OpenAI-compatible HTTP APIs, and experimental PTY wrappers. Auto-discovers installed providers on first run. Config in `~/.cmdforge/providers.yaml` with versioned migration.
+- **providers.py**: Provider abstraction. Supports subprocess CLI tools, OpenAI-compatible HTTP APIs, experimental PTY wrappers, fallback chains, and tool/MCP-server allowlists. Auto-discovers installed providers on first run. Config in `~/.cmdforge/providers.yaml` with versioned migration.
+- **skills.py**: Validated Agent Skills loader for per-provider `SKILL.md` context under `~/.cmdforge/providers/<name>/skills/`
+- **mcp_client.py / mcp_server.py**: Stdio MCP client/server integration, configuration, schema discovery, and exposure policy
 - **profiles.py**: AI persona profiles with system prompts, stored in `~/.cmdforge/profiles/`
 - **manifest.py**: Project manifest (`cmdforge.yaml`) for declaring tool dependencies with version constraints
 - **lockfile.py**: Lock file support for reproducible installs (`cmdforge.lock`)
@@ -85,7 +87,8 @@ Tools are YAML configs with:
    - `max_tokens`: Max output tokens (provider-dependent, e.g., 4096 for haiku)
    - `plain_text`: Bypass structured output enforcement
 2. **Code Step**: Executes Python code via `exec()`, captures specified variables (comma-separated for multiple outputs)
-3. **Tool Step**: Calls another tool (meta-tools), supports `input_template`, `args` dict, and `provider` override. Dependencies resolved via `resolver.py`
+3. **Tool Step**: Calls another tool (meta-tools), supports `input_template`, `args`, and recursive agent context (`provider`, `profile`, `skills`, `tools`). Provider and delegated allowlists are both enforced before resolution.
+4. **MCP Step**: Calls a tool on a configured MCP server. Provider `mcp_servers` allowlists are enforced before connecting.
 
 ### Variable Flow
 
@@ -132,6 +135,8 @@ Provider fields:
 - `tags`: List of strings (e.g. `["free", "code", "local"]`)
 - `pty_config`: Dict with `prompt_pattern`, `response_pattern`, `exit_command` for pty providers
 - `install`: Optional structured install metadata dict
+- `tools`: Optional CmdForge tool allowlist; `null` allows all and `[]` denies all
+- `mcp_servers`: Optional MCP server allowlist; `null` allows all and `[]` denies all
 
 The `mock` provider is built-in for testing without API calls. Use `--provider mock` or `--dry-run` flags when testing tools.