MCP: streamable HTTP transport, plus validate_project and curl_request tools #55

Why

apic mcp speaks stdio only (internal/mcp/server.go:80), which suits Claude Code and Cursor on the same machine. Hosted agents, a shared dev box, or a container running the demo API want to reach it over HTTP. Separately, agents that write requests have to shell out for validate and curl because those are not tools.

What

• apic mcp --http 127.0.0.1:8765 serves the MCP streamable HTTP transport from the Go SDK. Loopback by default; binding elsewhere requires --token <bearer> (or APIC_MCP_TOKEN) and the server refuses to start without one. Stdio stays the default.
• New tools: validate_project {} returning the validate --json shape, and curl_request {name, env?, vars?, redact?} returning {"command"}. Both respect the same resource allowlist as today (no env files or session ever leave the server).
• The tool list, resource rules and instructions in server.go:31-70 are updated; list_requests gains refs/disabled fields as those directives land.

Where

internal/mcp/server.go, internal/cli/mcp.go, internal/mcp/server_test.go.

Docs

docs/agents.md (transport section, tools table), docs/cli.md (mcp flags), SECURITY.md (the token rule).

Tests

Server test over HTTP with and without the token; both new tools; refusal to bind non-loopback without a token.