[P0][OpenCode] Expose a restricted project-only MCP surface

[isayahc]

Objective

Give the OpenCode project agent only the Forma operations required to author and modify projects.

Implementation locations

• Add a dedicated endpoint/module rather than exposing the full tool list in apps/api/a2a.py.
• Existing broad MCP registration is at apps/api/a2a.py:_mcp_tools().
• Existing dispatch is at apps/api/a2a.py:_call_mcp_tool().
• Existing persistence is at apps/api/a2a.py:_persist_mcp_compile().
• Existing owner-scoped revision enforcement is in forma_core/database.py and the project repositories.

Allowed operations

• Create a project.
• Read the session's owned project.
• Update the session's owned project.
• Compile Hardware IR.
• Validate Hardware IR.
• Return typed project/artifact results.

Forbidden operations

• forma.generate_project.
• A2A send/poll/list/get tools.
• Debug/config tools.
• Arbitrary filesystem access.
• Shell, Git, network, or repository operations.
• Access to unrelated MCP servers.

Security requirements

• Derive owner and project scope from authenticated session context.
• Ignore caller-provided ownership and authoring_agent values.
• Set authoring_agent to opencode server-side.
• Reject updates to projects owned by another user.
• Keep new projects private or owner-scoped until an explicit visibility action exists.
• Use typed Pydantic request/result objects and discriminated operation types; do not expand Dict[Any, Any] edge-case payloads.

Acceptance criteria

• OpenCode can complete a create, compile, validate, and update flow.
• Forbidden tool names and arbitrary project IDs fail closed.
• Cross-user and cross-project mutations are rejected.
• No raw provider credentials or internal errors appear in tool results.

Related

• Parent: [P0][OpenCode] Hosted project agent bridge between Vercel and mini-PC #454
• [P0][Security] Enforce server-derived project ownership for MCP and A2A actions #334 server-derived project ownership
• [P0][Security] Remove process-global provider credential mutation #333 request-scoped provider settings