feat(@angular/cli): add --read-only option to mcp command

This change introduces a `--read-only` flag to the `ng mcp` command. When this flag is present, the MCP server will only register tools that are explicitly marked as read-only. This provides a way for host applications to connect to the Angular CLI MCP server with a restricted set of capabilities, ensuring that no tools capable of modifying the user's workspace are exposed.

Author: clydin

packages/angular/cli/src/commands/mcp/cli.ts

@@ -33,18 +33,22 @@ export default class McpCommandModule extends CommandModule implements CommandMo
  longDescriptionPath = undefined;
 
  builder(localYargs: Argv): Argv {
- return localYargs;
+ return localYargs.option('read-only', {
+ type: 'boolean',
+ default: false,
+ describe: 'Only register read-only tools.',
+ });
  }
 
- async run(): Promise<void> {
+ async run(options: { readOnly: boolean }): Promise<void> {
  if (isTTY()) {
  this.context.logger.info(INTERACTIVE_MESSAGE);
 
  return;
  }
 
  const server = await createMcpServer(
- { workspace: this.context.workspace },
+ { workspace: this.context.workspace, readOnly: options.readOnly },
  this.context.logger,
  );
  const transport = new StdioServerTransport();

packages/angular/cli/src/commands/mcp/mcp-server.ts

@@ -21,6 +21,7 @@ import { registerTools } from './tools/tool-registry';
 export async function createMcpServer(
  context: {
  workspace?: AngularWorkspace;
+ readOnly?: boolean;
  },
  logger: { warn(text: string): void },
 ): Promise<McpServer> {
@@ -43,14 +44,18 @@ export async function createMcpServer(
 
  registerInstructionsResource(server);
 
- const toolDeclarations = [
+ let toolDeclarations = [
  BEST_PRACTICES_TOOL,
  DOC_SEARCH_TOOL,
  LIST_PROJECTS_TOOL,
  MODERNIZE_TOOL,
  FIND_EXAMPLE_TOOL,
  ];
 
+ if (context.readOnly) {
+ toolDeclarations = toolDeclarations.filter((tool) => tool.isReadOnly);
+ }
+
  await registerTools(
  server,
  {