feat(tool): support canonical Veryfront MCP identities

[kwakayama]

Links veryfront/veryfront-issue-inbox#1055.

This Code-library lane adds typed tools/list params with resolver support, preserves them across pagination, exports one trusted Veryfront identity finalizer, enables canonical discovery for the default Veryfront API source, and makes MCP allow/deny policy match authoritative platform aliases with deny precedence. Generic third-party MCP sources retain exact-name behavior and receive no Veryfront metadata.

Out of scope: API routes and mutation normalization, Agent wrapper/package adoption, Studio rendering and persistence, package publication, deployment, and issue closure.

Red/green evidence: the new focused tests initially failed because the list-param/finalizer exports and behavior did not exist. After implementation, the focused suite passes 65 assertions.

Verification:

• PATH=/tmp/deno-2.7.7:$PATH deno task test:file src/tool/remote-mcp.test.ts src/agent/mcp-tool-policy.test.ts src/agent/service/mcp-server-config.test.ts
• deno check on modified implementation files
• Broader repository verification and exact-head Codex review will be added before readiness.

Staging plan: after API metadata support and Agent package adoption are merged through their separate lanes, capture canonical tools/list packets, verify old-API legacy fallback, and run the persisted/scoped allow/deny compatibility matrix. This PR alone cannot close the inbox issue.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	289	2304 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codecov]

Codecov Report

❌ Patch coverage is 80.27211% with 29 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/tool/remote-mcp.ts	73.14%	19 Missing and 10 partials ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
81.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[kwakayama]

Closing this draft as superseded by the merged compatibility direction in veryfront/veryfront-api#4752 and #4468. Existing routes now negotiate canonical catalog names, and Code explicitly requests legacy transport names to preserve saved selectors and policy behavior. The full v2-route/trusted-finalizer migration in these parallel drafts is no longer the smallest compatible implementation.

The branch and local work remain preserved. This does not close veryfront/veryfront-issue-inbox#1055: canonical public defaults, canonical tool-reference discovery, Studio compatibility, scoped project-identity regressions, and staging invocation/mixed-version evidence remain gates. Narrow missing behavior will be handled against current main instead of merging this entire draft.