Add read-only Buzz client entrypoint

Expose the existing stdio server to a dedicated Buzz agent without granting mutation tools or leaking unrelated runtime credentials. Document the verified Hermes and Buzz client paths.

Co-authored-by: fredamn76 <fredrik.fallman@gmail.com>
Signed-off-by: fredamn76 <fredrik.fallman@gmail.com>

README.md

@@ -42,6 +42,57 @@ Create the Mealie token at `/user/profile/api-tokens`.
 Home Assistant is optional and isolated: without `HA_BASE_URL` and `HA_TOKEN`
 everything except `shopping_list_add` works normally.
 
+## Client integration
+
+### Hermes
+
+Hermes runs this server over stdio. The credential stays in
+`~/.hermes/.env`; `config.yaml` contains only environment placeholders.
+
+```bash
+hermes mcp add mealie \
+  --command /home/fredrik/.local/bin/uv \
+  --connect-timeout 60 \
+  --env 'MEALIE_API_TOKEN=${MEALIE_API_TOKEN}' \
+        'MEALIE_BASE_URL=${MEALIE_BASE_URL}' \
+        'MEALIE_USER_AGENT=Mealie-MCP/0.1' \
+  --args --directory /home/fredrik/.buzz/REPOS/mealie-mcp run mealie-mcp
+
+hermes config set mcp_discovery_timeout 10
+hermes mcp test mealie
+```
+
+The normal `hermes chat` client and the long-running gateway wait for MCP
+discovery. On the Hermes version used for the P1 acceptance test,
+`hermes -z` could snapshot its tools before a slower stdio server finished
+discovery; use the normal chat/gateway path for this server until that
+one-shot startup issue is fixed.
+
+### Buzz managed agent
+
+Buzz's managed-agent harness accepts one per-agent MCP executable. Set the
+dedicated Recept agent's MCP command to this read-only launcher:
+
+```text
+/home/fredrik/.buzz/REPOS/mealie-mcp/scripts/run-mealie-mcp-read-only-for-buzz
+```
+
+It contains search, read, scaling, organizer, duplicate-check, suggestion, and
+verification tools, but no import, patch, delete, ingredient-parse, image, or
+shopping-list tools. Switch to the full `mealie-mcp` entry point only after the
+separate write acceptance test has passed.
+
+The launcher reads only `MEALIE_API_TOKEN`, `MEALIE_BASE_URL`, and
+`MEALIE_USER_AGENT` from `~/.hermes/.env`, then starts the same stdio server
+with a clean environment. It does not place the token in the agent prompt,
+agent definition, command line, or Codex configuration.
+
+Keep this configuration agent-specific. Adding Mealie globally to
+`~/.codex/config.toml` would make the tools available to every Codex-based
+Buzz agent on the host, which is broader access than the private Recept agent
+needs. No HTTP transport is required while the agent and server run on the
+same machine.
+
 ## Tools
 
 **Read**
@@ -105,7 +156,7 @@ file tools; folding it in would make this server two things at once.
 ## Tests
 
 ```bash
-python -m pytest
+uv run --extra dev python -m pytest
 ```
 
 The suite covers the verified failure modes: Cloudflare 1010 vs 401, decimal-comma