feat(mcp): add tool discovery and per-tool permissions

- Add MCP protocol client for tool discovery (initialize + tools/list)
- Show discovered tools in settings UI with enable/disable checkboxes
- Build explicit allowedTools list from enabled MCP tools
- Remove bypassPermissions hack - now uses proper tool allowlisting
- Format: mcp__servername__toolname for SDK allowedTools

1 files changed, 12 insertions, 0 deletions

diff --git a/src/main/preload.ts b/src/main/preload.ts
index 44467db..e7ee0aa 100644
--- a/src/main/preload.ts
+++ b/src/main/preload.ts
@@ -63,6 +63,15 @@ export interface ClaudeFlowAPI {
   // Dialogs
   selectDirectory: () => Promise<string | null>;
 
+  // MCP
+  discoverMcpTools: (config: {
+    type: "stdio" | "sse" | "http";
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    url?: string;
+  }) => Promise<{ tools: Array<{ name: string; description?: string }>; error?: string }>;
+
   // Window
   toggleMaximize: () => Promise<void>;
   onWindowMaximized: (cb: (isMaximized: boolean) => void) => () => void;
@@ -132,6 +141,9 @@ const api: ClaudeFlowAPI = {
     return result;
   },
 
+  // MCP
+  discoverMcpTools: (config) => ipcRenderer.invoke("mcp:discoverTools", config),
+
   // Window
   toggleMaximize: () => ipcRenderer.invoke("window:toggleMaximize"),
   onWindowMaximized: (cb) => {