[FEATURE] Mods API: expose an MCP tool's input schema and annotations before the call

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Arrester (github.com/dot-agi/arrester) is a guard mod. It stops calls that reach files a hook, rule or classifier already refused. It reads paths from tool arguments. For an MCP tool it cannot tell which arguments are paths, or whether the call reads or writes them.

In Claude Code 2.1.296 (macOS), $.tool.list() returns:

export type ToolInfo = {
    name: string;
    description: string;
    mcp: boolean;
};

tool.call and tool.check inputs carry only the name and arguments. The one read/write signal, isReadOnly?: true, is on the result, after the tool ran.

The engine has the schema: at save time it writes each server's inputSchema into the mod's claude-code-mcp type root. A running mod cannot read it.

Proposed Solution

1. ToolInfo: add server?: string (the name $.mcp.call takes), inputSchema?: unknown (as declared) and annotations?: { readOnlyHint?: boolean; destructiveHint?: boolean; idempotentHint?: boolean; openWorldHint?: boolean }.
2. Put the same annotations on tool.call and tool.check input for MCP tools, read only and pinned, like ceiling.
3. Document both as server claims, not facts the engine checked.

Alternative Solutions

• A hand-kept list of path arguments goes stale.
• #90131 (open) asks for inputSchema on $.tool.list(). This includes it and adds the annotations, at check time too.
• #83886 (closed as stale) asked for annotations in classic PreToolUse input. This is the Mods API equivalent.

Priority

Medium - Would be very helpful

Feature Category

MCP server integration

Use Case Example

Arrester's README lists this limit: "A call of any other tool, such as an MCP tool, gives no paths, so the target and guard rules cannot match it." The schema lets Arrester find file arguments before the call. The hints tell it which blocks to check: read, write or deletion.

Additional Context

This closes the limit partly. A server that runs commands or resolves relative paths needs an OS sandbox around MCP servers, which is out of scope.