Add read-only Buzz client entrypoint

Expose the existing stdio server to a dedicated Buzz agent without granting mutation tools or leaking unrelated runtime credentials. Document the verified Hermes and Buzz client paths.

Co-authored-by: fredamn76 <fredrik.fallman@gmail.com>
Signed-off-by: fredamn76 <fredrik.fallman@gmail.com>

tests/test_server_contracts.py

@@ -1,8 +1,11 @@
 """Boundary contracts for the verified Mealie instance quirks."""
 from __future__ import annotations
 
+import asyncio
+
 import httpx
 import pytest
+from mcp.server.mcpserver import MCPServer
 
 from mealie_mcp import server
 
@@ -21,6 +24,26 @@ class TestAuthenticationFailures:
             server._raise_for_status(response(403, "error code: 1010"))
 
 
+def test_read_only_server_removes_all_mutating_tools():
+    test_server = MCPServer("test")
+
+    @test_server.tool()
+    def search_recipes(query: str) -> list[str]:
+        return [query]
+
+    def mutating_tool(value: str) -> str:
+        return value
+
+    for name in server.WRITE_TOOL_NAMES:
+        test_server.tool(name=name)(mutating_tool)
+
+    server._configure_read_only(test_server)
+
+    tool_names = {tool.name for tool in asyncio.run(test_server.list_tools())}
+
+    assert tool_names == {"search_recipes"}
+
+
 class TestUrlImportResponse:
     def test_slug_only_import_response_is_resolved_before_reporting(self, monkeypatch):
         recipe = {"slug": "lax-med-citron", "name": "Lax med citron", "recipeIngredient": []}