fix(code-mode): fail closed for unannotated MCP tools

[MTEnt]

Summary

Closes #318.

Code Mode previously treated MCP tools without annotations as non-destructive, which allowed them to bypass the approval path. It also read only the camelCase annotation attributes exposed by MCP Python SDK 1.29, which raises on the snake_case attributes used by MCP Python SDK 2.0.

This change follows the MCP ToolAnnotations defaults: tools are treated as destructive unless they explicitly declare read-only behavior or destructiveHint: false. Both SDK attribute casings are supported.

Changes

• Fail closed when tool annotations are missing, malformed, or incomplete.
• Preserve Code Mode access for explicitly read-only and additive-write tools.
• Support camelCase attributes from MCP Python SDK 1.29 and snake_case attributes from MCP Python SDK 2.0.
• Add regression coverage for the core sandbox client and local sandbox client.
• Add patch changesets for @truefoundry/trueforge-core and @truefoundry/trueforge.

How was this tested?

• pnpm --filter @truefoundry/trueforge-core test --runTestsByPath tests/core/sandbox/scripts/mcpClientPolicy.test.ts --runInBand
• pnpm --filter @truefoundry/trueforge test --runTestsByPath tests/unit/sandbox/local/scripts/mcpClientPolicy.test.ts --runInBand
• Policy checks using real mcp==1.29.0 and mcp==2.0.0 model objects.
• Live remote-MCP verification against DeepWiki over Streamable HTTP: the server returned three unannotated tools, and Code Mode rejected read_wiki_structure before tools/call was dispatched (remoteToolCalls=0).
• pnpm test (clean Ubuntu clone, Node.js 22.23.2, commit 60850ef)
• pnpm typecheck
• pnpm lint:ci
• pnpm format:check
• pnpm build

Checklist

• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed — not applicable

---

Note

^{Cursor Bugbot is generating a summary for commit 60850ef. Configure here.}