Add a read-only mode to the MCP server (independent of WildFly RBAC) #62

Summary

Add an opt-in read-only mode to the WildFly MCP server, enabled via a system property (-Dorg.wildfly.readonly=true) or environment variable (WILDFLY_MCP_SERVER_READONLY=true), that prevents the server from performing any mutating operation regardless of the WildFly user's RBAC role.

Motivation

Today the only way to restrict the MCP to read operations is to rely on WildFly RBAC by connecting with a Monitor-role user (as documented in the README). This has two limitations:

1. It requires configuring RBAC and a dedicated user on every target server. When the MCP connects with an admin user, there is no protection at all.
2. Several tools are inherently destructive (deployWildFlyApplication, undeployWildFlyApplication, shutdownServer, enableWildFlyLoggingCategory, removeWildFlyLoggingCategory, and arbitrary invokeWildFlyCLIOperation). When the MCP is wired to an LLM, an accidental or hallucinated call can modify or stop a production server.

A server-side read-only switch provides defense-in-depth: the MCP itself refuses to mutate, so safety no longer depends on per-server RBAC configuration.

Proposed behavior

When read-only mode is enabled:

• Mutating tools fail fast with a clear message (or are not registered): deployWildFlyApplication, undeployWildFlyApplication, shutdownServer, enableWildFlyLoggingCategory, removeWildFlyLoggingCategory.
• invokeWildFlyCLIOperation validates the operation against an allow-list of read operations (read-resource, read-attribute, read-children-names, read-children-resources, read-children-types, read-operation-names, read-operation-description, read-resource-description, query, whoami, :read-*, etc.) and rejects everything else. This also resolves the existing // TODO, implement possible rules if needed to disallow some operations. in WildFlyMCPServer.invokeWildFlyCLIOperation.
• Read-only tools remain fully available.

Notes

• Default remains the current behavior (mode off) for backward compatibility.
• Intended to work for both the stdio and SSE servers, and via the container image env vars.
• I'm happy to submit a PR implementing this if the approach is acceptable.