feat(m3.6): local MCP server (tron mcp)

[ralyodio]

Implements M3.6 — MCP server (PRD §14). Base main.

tron mcp             # headed managed session
tron mcp --headless

Host config:

{ "mcpServers": { "tronbrowser": { "command": "tron", "args": ["mcp", "--headless"] } } }

Design: dependency-free, reuse the SDK

• The protocol layer is a minimal JSON-RPC 2.0 server (initialize/tools/list/tools/call/ping) — no @modelcontextprotocol/sdk dependency, so the shipped runtime stays self-contained like the rest of M3.
• Tools wrap the SDK Browser/Page, so M3.1–M3.5 are reused, not reimplemented. Lives in the SDK package (packages/sdk/src/mcp), shipped in the existing sdk/ payload.

Tools (16)

Primitive: browser_open browser_snapshot browser_click browser_fill browser_type browser_press browser_select browser_scroll browser_wait browser_extract browser_screenshot browser_tabs browser_close
AI-assisted: browser_analyze (non-mutating dry-run) · browser_step · browser_run_task

• Mutating tools return a fresh snapshot (PRD §10); browser_screenshot returns image content; analyze/extract/tabs return JSON.
• analyze/step/run_task are backed by the M3.5 deterministic engine — form-fill works without a provider; open-ended goals report AI_PROVIDER_NOT_CONFIGURED.
• Session launches lazily on first tool call, tears down on browser_close. Local stdio only — never a network listener.

Acceptance criteria (PRD §22)

• ✅ Open a page and receive a structured snapshot.
• ✅ browser_analyze non-mutating page/form analysis.
• ✅ browser_step one validated action; browser_run_task bounded loop.
• ✅ Mutating actions return a fresh snapshot.
• ✅ Runs locally, no public exposure.

Verification — +11 tests

• Protocol (initialize/list/call/ping/unknown-method/notification), all tools against a fake page (mutations→snapshots, screenshot image, analyze dry-run, close), and the newline-delimited stdio transport.
• End-to-end over real stdio: initialize → tools/list (16) → browser_open (launched session → "Page: Example Domain") → browser_close against a WS CDP stub session.
• Full workspace suite green in CI order (build → typecheck → test) from clean.

Scope

Node ≥22, stdio transport only. Cookies/storage not exposed as tools. See docs/mcp.md.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.