A public bearer client previously reached the full 160-tool catalog,
including save_document (fs::write at a caller-chosen path), the
process-global codegen plan store, and host diagnostics. Online mode
now classifies every tool by surface in one reviewable table and denies
the 17 that touch the daemon host (filesystem, outbound fetch,
unscoped globals, diagnostics, future process spawn) in both tools/list
and tools/call — refusal happens before argument parsing, so traversal
payloads never reach a handler. mcp:read/mcp:write scopes gate write
tools ahead of dispatch (deny-then-scope, so a filesystem tool reports
denial rather than inviting a bigger token); session cookies keep full
scope and unclassified static tools fail the build. Local and managed
catalogs are unchanged. The deployment-boundaries script now refuses
direct invocation instead of green-exiting with every helper missing.
79beee711f