Add AST-based security middleware and enforcement wiring

src/mcp.ts

@@ -20,6 +20,7 @@ import type {
   McpLoadContext,
   SharedMcpConfigFile,
 } from "./mcp/types.js";
+import type { ToolClearancePolicy } from "./security/schemas.js";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -62,6 +63,7 @@ export function loadMcpConfigFromEnv(
   options?: {
     config?: Readonly<AppConfig>;
     registry?: McpRegistry;
+    toolClearance?: ToolClearancePolicy;
   },
 ): LoadedMcpConfig {
   const runtimeConfig = options?.config ?? getConfig();
@@ -82,6 +84,7 @@ export function loadMcpConfigFromEnv(
       server,
       context,
       fullConfig: config,
+      toolClearance: options?.toolClearance,
     });
     resolvedHandlers[serverName] = resolved.handlerId;