feat: mcp tools as plugins

[cdcabrera]

What is it?

• feat: mcp tools as plugins

Notes

• see MCP tools should be expandable via tool-plugins #22
• MCP tooling can be modified by allowing additional sandboxed tools via cli or programmatically
• min version of NodeJs allowed to use tooling is v22+ (for external files/resources/packages)
  • you can still use NodeJs 20 with inline tools-as-plugins, you just can't run tools-as-plugins from external files
  • reasons behind this limitation have to do with the way we're importing files and the sandbox being experimental in v20 vs v22 vs v24 where the features stabilized
• Current expectations (this list will be updated once code is resolved... this is not a contract and is subject to change)
  • Tool plugins will initially have two sandboxed modes none and strict. Selecting none is an indication you accept security responsibility (file reads, network access)
  • Tool plugins will have access to a limited subset of the servers internals, this includes
    • defaults
    • internal helper tooling (because they're tested and predictable, ie. stable)