feat(mcp): map MCP tools to schema-derived bash commands

[M09Ic]

Profiles can mount existing MCP servers as named commands in the AI's bash tool. Runtime tools/list discovery generates subcommands and schema-derived flags: a server named ida exposes ida decompile --addr 0x401000. The model discovers detailed parameters on demand and uses JSON/file input for complex schemas.

ida --list
ida decompile --help
ida decompile --addr 0x401000
ida decompile --json '{"addr":"0x401000"}'
ida decompile --file arguments.json > result.json

• Use the already-pinned mcp-go v0.45.0 client for stdio and Streamable HTTP. Contribute one native CommandRegistry command per configured server, preserving upstream tool/property names and complete declarations.
• Convert scalar properties to typed flags and objects/arrays/ambiguous types to JSON values. Preserve optional omission, large integers and number spelling; reject missing top-level required fields, unknown flags and duplicate parameters. Raw JSON/file input supports arbitrary schemas, nulls and control-name collisions. Upstream servers validate the complete schema.
• Write complete MCP result JSON to stdout, including rich content, structured results and metadata. isError retains stdout and fails the command. Existing bash variables, pipelines, redirects, conditionals, admission hooks and cancellation apply.
• Discover paginated, allowlisted catalogs and publish atomically. Reject namespace collisions before connecting; roll back partial loads, revoke/drain calls on unload and retain incomplete cleanup for Close retries. HTTP headers also apply to session DELETE; redirects are not followed.
• Add the no-model examples/mcp host and the real-model examples/mcp-agent host, plus configuration and existing IDA/REA integration instructions. The latter composes existing StandardLoop/Session extensions, maintains MCP state across model decisions and records AOP evidence. No new IDA adapter/server is required.

Command design references: hengyunabc/mcp2cli, knowsuchagency/mcp2cli, and mcporter CLI generation.

Validation on Windows:

• Focused race tests for MCP tools/extensions and hosts pass. Real stdio children, SDK HTTP servers and raw protocol fixtures cover AI bash → CommandRegistry → MCP, typed parameters, complex schemas, precision, omission, shell composition, errors, hooks, cancellation, rollback and cleanup retries. Architecture, terminal and harness tests also pass. Targeted vet/golangci-lint, dependency diff, documentation links/fences and diff checks pass.
• Real engine integration passes with the unchanged REA-pinned jadx-headless-mcp 0.7.1 and public ApiDemos 6.0.18 APK, checked against fixed SHA-256 values. The actual bash tool boundary discovers 26 tools, indexes 2,876 classes and returns Java class/method source; typed flags, JSON parity, paths with spaces, shell composition, errors, persistent state and cleanup pass. Normal test: 13.67s; race test: 12.38s. The opt-in lane skips without explicitly supplied artifacts.
• Real gpt-6.1-sol investigations pass through StandardLoop → bash → MCP → JADX. UnCrackable L1: 10 model decisions, 16 bash calls, 521.50s; recovered the accepted plaintext, independently checked against AES ciphertext roundtrip and a one-character negative. ApiDemos LoaderCustom: 13 decisions, 41 bash calls, 448.31s; reconstructed async enumeration, caching, broadcasts, cancellation/reset and UI flow, and found the incoming-list release anomaly and empty release hook. Nine finite source/evidence checks pass. Both tasks finish with EMPTY engine state, closed harnesses and exited processes.

The live verification record retains model limitations: an overgeneralized cached-icon branch and omitted configuration field names required independent correction. An unsupported flag and Windows FIND failure were recovered; empty upstream inner-class source results led to method queries. Reported token counts exclude API attempts without usage. Credentials, binaries and large traces are not committed; the live host removes its dedicated credential environment variable before loading tools/children.

Scope: opt-in Go extension with a catalog snapshot at load time, rather than an aiscan CLI configuration declaration or generated PATH executable. MCP tools support stdio and Streamable HTTP; engines remain separately installed. Connections are shared within a Profile; upstream databases and detached workers remain caller-owned. Cancellation does not establish remote job termination. Actual JADX verification covers stdio/static analysis. Android runtime, JADX HTTP, real IDA, Hopper and Ghidra execution are unverified.

Refs #176.