feat(mcp): deepcode mcp serve — expose tools as an MCP server over stdio

[oratis]

Summary

Adds the server side of MCP — docs/DEVELOPMENT_PLAN.md §3.3. After this, other MCP clients (Claude Desktop, another DeepCode instance, any MCP-aware tool) can call DeepCode's built-in tools in a project directory. Mirrors Claude Code's claude mcp serve.

Register it in another client as:

{ "command": "deepcode", "args": ["mcp", "serve"] }

What's in here

core — packages/core/src/mcp/serve.ts (all SDK usage stays in core; the CLI has no third-party deps):

• buildMcpServer({ cwd, ... }) — wraps the tool registry in an @modelcontextprotocol/sdk Server with ListTools + CallTool handlers. Returned unconnected so any transport attaches — stdio in prod, an in-memory linked pair in tests.
• serveMcpOverStdio() — connects StdioServerTransport; resolves on peer disconnect / stdin EOF / abort, and closes the transport cleanly on SIGINT so stdin listeners detach.
• mcpServableTools() / MCP_SERVE_EXCLUDE — exposes only stateless tools (Read/Write/Edit/Bash/Grep/Glob/NotebookEdit/TodoWrite/WebFetch/WebSearch). Excludes the 9 host-coupled tools (AskUserQuestion, EnterPlanMode/ExitPlanMode, EnterWorktree/ExitWorktree, Task, Cron×3) whose ToolContext (askUser / modeSignal / runSubAgent / live worktree / local scheduler) an MCP peer can't provide.

cli — apps/cli/src/mcp-cmd.ts:

• deepcode mcp serve + a deepcode mcp help screen. The banner + readiness line go to stderr — stdout stays the pure JSON-RPC channel. The serve impl is injectable so tests don't grab the real process stdio.
• Wired into cli.ts dispatch + --help.

Tests

• 6 core (serve.test.ts) via a real Client over InMemoryTransport.createLinkedPair(): listTools hides excluded tools + includes core ones, a Write→Read round-trip actually hits disk, unknown-tool and tool-level errors surface as isError.
• 3 CLI (mcp-cmd.test.ts): help (exit 0), unknown subcommand (exit 2), and serve forwards cwd + logs only to stderr (stdout asserted empty).
• End-to-end verified manually: a real StdioClientTransport spawned the built deepcode mcp serve, listed all 10 tools, and called Bash (echo hello-mcp → exit 0).

Core suite 558 green (+6), CLI 72 green (+3); full repo suite green via pre-commit.

Notes

• OAuth + Elicitation (client-side MCP auth flows) remain future work — independent of this server-side feature.

🤖 Generated with Claude Code