Add read-only Buzz client entrypoint

Expose the existing stdio server to a dedicated Buzz agent without granting mutation tools or leaking unrelated runtime credentials. Document the verified Hermes and Buzz client paths.

Co-authored-by: fredamn76 <fredrik.fallman@gmail.com>
Signed-off-by: fredamn76 <fredrik.fallman@gmail.com>

mealie_mcp/server.py

@@ -38,6 +38,19 @@ RESOURCE_DIR = Path(__file__).parent / "resources"
 
 mcp = MCPServer("mealie", version="0.1.0")
 
+WRITE_TOOL_NAMES = frozenset(
+    {
+        "import_recipe_url",
+        "import_recipe_text",
+        "import_recipe_image",
+        "patch_recipe",
+        "delete_recipe",
+        "parse_ingredients",
+        "set_cover_image",
+        "shopping_list_add",
+    }
+)
+
 
 class MealieAuthError(RuntimeError):
     """The Mealie token is missing, expired, or wrong (HTTP 401)."""
@@ -745,3 +758,18 @@ instructions, and units (`msk`, `tsk`, `dl`, `krm`, `st`, `klyfta`).
 
 def main() -> None:
     mcp.run()
+
+
+def _configure_read_only(
+    server: MCPServer,
+    write_tool_names: frozenset[str] = WRITE_TOOL_NAMES,
+) -> None:
+    """Remove mutating tools before exposing the server to a read-only client."""
+    for name in sorted(write_tool_names):
+        server.remove_tool(name)
+
+
+def main_read_only() -> None:
+    """Run the same server without import, patch, delete, parse, image, or HA writes."""
+    _configure_read_only(mcp)
+    mcp.run()