feat(mcp): contracts, capability stats migration and MCP SDK dependency

- contracts/mcp.ts: capability stats/tools, MCP server status/config schemas, mcpToolVisible
- api.ts: GET /capabilities/stats, GET /capabilities/tools, GET /mcp/status, PATCH /mcp/config
- migration 0039: mcp_server_config single row + audit_event capability index
- deno.json: npm:@modelcontextprotocol/[email protected].1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/api.ts

@@ -11,6 +11,7 @@ import * as execution from "./execution.ts";
 import * as files from "./files.ts";
 import * as identity from "./identity.ts";
 import * as instances from "./instances.ts";
+import * as mcp from "./mcp.ts";
 import * as ops from "./ops.ts";
 import * as organization from "./organization.ts";
 import * as pi from "./pi.ts";
@@ -1564,6 +1565,40 @@ export const Api = {
       body: z.object({ input: z.unknown(), preview: z.boolean().default(false) }),
       response: z.object({ output: z.unknown(), taskId: Id.nullable(), planId: Id.nullable() }),
     }),
+    stats: ep({
+      method: "get",
+      path: "/capabilities/stats",
+      scope: "read",
+      summary: "能力调用统计：每能力调用数、失败数、平均耗时、最近调用、调用来源（内置 Agent / MCP / REST）",
+      query: mcp.CapabilityStatsQuery,
+      response: mcp.CapabilityStatsResponse,
+    }),
+    tools: ep({
+      method: "get",
+      path: "/capabilities/tools",
+      scope: "read",
+      summary: "能力清单：描述符、工具名、输入输出 JSON Schema、当前授权状态",
+      response: mcp.CapabilityToolsResponse,
+    }),
+  },
+
+  // ── 对外 MCP 服务端(Streamable HTTP 在 /mcp,不进 OpenAPI;这里是状态与配置)──
+  mcp: {
+    status: ep({
+      method: "get",
+      path: "/mcp/status",
+      scope: "admin",
+      summary: "MCP 服务端状态：启用、允许的 API Key、当前会话、最近调用、限速",
+      response: mcp.McpServerStatus,
+    }),
+    update: ep({
+      method: "patch",
+      path: "/mcp/config",
+      scope: "admin",
+      summary: "修改 MCP 服务端配置（启用开关、允许的 API Key）",
+      body: mcp.McpServerConfigUpdate,
+      response: mcp.McpServerConfig,
+    }),
   },
 
   // ── 设置 ──
@@ -2328,3 +2363,4 @@ export type EndpointResponse<E extends EndpointDef> = z.infer<E["response"]>;
 
 export * from "./files.ts";
 export * from "./schedules.ts";
+export * from "./mcp.ts";