assistant read-only MCP — POST /mcp (auth required)