[E13–S9 15/15] Add a bounded daemon-first MCP server

[salmonumbrella]

What changed

• Docbank now exposes a bounded, daemon-first MCP 2026-07-28 server through the official Go SDK v1.7.0. Stdio is the default; stateless loopback Streamable HTTP is opt-in.
• The fixed read catalog covers vault info, live document browsing, source-fenced search, exact document and version reads, rendition windows, processing plans, job status, and processing coverage. Results carry bounded cursors, exact source fences, and canonical rendition resource links.
• --allow-processing adds one guarded start_processing tool. It requires the exact reviewed plan fingerprint and existing operator consent, cannot grant consent, and never blindly replays an ambiguous start.
• HTTP uses a separate bearer credential and refuses to reuse the daemon API key. Host, origin, authentication, request size, concurrency, response size, and deadline checks all happen at the local transport boundary.

Why

The CLI works for operators, but agents need a typed document surface that does not bypass daemon ownership or turn the vault into an unbounded file reader. MCP keeps the same source, consent, and version authority while making browsing, retrieval, and bounded rendition reads directly usable from local agent clients.

Usage

Start the stdio server:

docbank mcp

For loopback HTTP, configure a separate process credential:

[mcp.http]
credential_binding = "credential:mcp-http"

[credential_bindings.mcp-http]
environment_variable = "DOCBANK_MCP_HTTP_TOKEN"

Then start the listener:

docbank mcp --transport http --listen 127.0.0.1:7341

Add the guarded processing tool only when the MCP client is allowed to enqueue work that the operator already reviewed and consented to:

docbank mcp --transport stdio --allow-processing

Part of #176 (S9). Stacks on #238.

[roborev-ci]

roborev: Combined Review (a2a00d0)

Verdict: Three medium-severity issues require attention.

Medium

• internal/store/search.go:663-718 — Semantic eligibility is filtered only by vector_space_id, allowing results from another profile, binding, or input kind that shares the vector space. Filter by profile fingerprint, binding ID, and input kind, and add shared-vector-space coverage tests.

• internal/store/embedding_reconcile.go:90-114 — Reconciliation treats every direct-file generation in a profile as valid for every executable original_file binding. This can enqueue duplicate cross-binding jobs and publish sets referencing the wrong generation authority. Validate generations against the binding-specific input fingerprint/identity.

• document/pymupdf/provider.go:201-215 — PyMuPDF executes a configured native parser directly on untrusted PDF bytes without network isolation or process-tree containment. Use the same fail-closed isolated runner as Trafilatura, including network denial, executable verification, and process-tree cleanup.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 34m23s