Allowlist deep-research MCP for CTO

manifest.yaml

@@ -162,7 +162,26 @@ disclosure:
       role: toolkit
       justification: "Angular stack patterns — closes CONTRACT.md §6 'Angular = skill-only' gap; anchored to adwright/adwright-console"
 
-  mcp_servers: []                  # cto orchestrates via sandcastle + shell, not MCP
+  mcp_servers:
+    - name: deep-research
+      transport: http
+      endpoint: "http://127.0.0.1:3010/mcp"
+      tools:
+        - id: mcp_deep_research_deep_research
+          mode: read
+          justification: "Full source-grounded research artifact for architecture, standards, vendor behavior, dependency choices, and PRD work."
+        - id: mcp_deep_research_web_search
+          mode: read
+          justification: "Granular current-source search for CTO investigations when a full artifact is too heavy."
+        - id: mcp_deep_research_fetch_page
+          mode: read
+          justification: "Fetch source pages selected during CTO research; browsing/fetch capability disclosed explicitly."
+        - id: mcp_deep_research_extract_pdf
+          mode: read
+          justification: "Extract standards papers, vendor PDFs, and architecture docs during CTO research."
+      hosted_api: "conditional: hosted only when deep-research INFERENCE_URL routes through llm-gateway"
+      data_boundary: "Tailnet HTTP MCP; search/fetch reaches public web sources; LLM route disclosed by deep-research inference mode."
+      approval_required: false
 
   sovereign_apis:
     - name: bte-rest