- server.md: add the `POST /mcp` section (transport, tool + resource catalog,
the Cedar gate + deny-masking, the branch-scope tools/list caveat, connecting
+ the OAuth caveat) and an endpoint-inventory row; list MCP OAuth under
"not implemented".
- rfc-003: mark Status partially-implemented (shipped in #157); refresh the
stale stdio-package figures (the package re-synced to 0.6.1 — 16 tools, ~9
resources) and note omnigraph-ts#7 was closed in favor of this surface.
- testing.md: record that the mcp_* tests live in server.rs (reusing its
app_*/json_response helpers).
Co-Authored-By: Claude <noreply@anthropic.com>