HTTP-tools MCP bridge

Problem

A character's HTTP tools block did nothing on the claude-cli provider. Only anthropic-sdk and openai-api run the in-process tool loop (buildTools / executeTool); the CLI prompt says "You have tools" without enumerating any endpoint. On the fleet's dominant provider, the declarations were dead config — anything that worked did so because personas hand-wrote curl instructions and the agent had Bash.

That collided head-on with readOnly (#653/#654): a locked-down character has no Bash, so it had no route at all to its own declared endpoints. Policy and purpose were in direct conflict.

Design

src/mcp-servers/http-tools.js — a stdio MCP server in the same pattern as the built-in advisor.js. It reads the character file named by CHARACTER_FILE and serves each declared endpoint as an MCP tool.

The names, descriptions and schemas come from the same buildTools() the in-process loop uses, and calls are executed by the same executeTool() — identical by construction, not by convention. The response shape is the loop's existing contract ({ status, data }), unchanged.

Wire-up (config, not code)

"mcpServers": {
  "httptools": { "command": "node", "args": ["src/mcp-servers/http-tools.js"] }
},
"llm": { "passMcpToCli": true }

CHARACTER_FILE is already in the pod environment; the bridge reads the same file the runtime loads.

How it composes with the capability boundary

Piece	Contribution
#651 / #652	the MCP grant is strict — declared servers are the whole grant
#653 / #654	readOnly denies built-ins via permission mode; declared MCP servers are pre-approved as mcp__<name>
this bridge	the declared HTTP endpoints become MCP tools flowing through that same grant

Net effect: the character file is the single, complete, enforced statement of what the agent can reach — voice in the persona, authority in the policy, tools in the grant.

Deliberately not in this change

• No auto-injection. The bridge is opt-in per character. Auto-injecting for every claude-cli character with a tools block would silently hand new callable tools to fleet agents whose personas currently assume curl — a behaviour change each character owner should make deliberately.
• codex-cli support: the bridge is provider-agnostic stdio MCP, but codex wiring is untested here.