feat(@angular/cli): add --read-only option to mcp command

This change introduces a `--read-only` flag to the `ng mcp` command. When this flag is present, the MCP server will only register tools that are explicitly marked as read-only.

This provides a way for host applications to connect to the Angular CLI MCP server with a restricted set of capabilities, ensuring that no tools capable of modifying the user's workspace are exposed.

Author: clydin

packages/angular/cli/src/commands/mcp/cli.ts

@@ -33,18 +33,22 @@ export default class McpCommandModule extends CommandModule implements CommandMo
   longDescriptionPath = undefined;
 
   builder(localYargs: Argv): Argv {
-    return localYargs;
+    return localYargs.option('read-only', {
+      type: 'boolean',
+      default: false,
+      describe: 'Only register read-only tools.',
+    });
   }
 
-  async run(): Promise<void> {
+  async run(options: { readOnly: boolean }): Promise<void> {
     if (isTTY()) {
       this.context.logger.info(INTERACTIVE_MESSAGE);
 
       return;
     }
 
     const server = await createMcpServer(
-      { workspace: this.context.workspace },
+      { workspace: this.context.workspace, readOnly: options.readOnly },
       this.context.logger,
     );
     const transport = new StdioServerTransport();

packages/angular/cli/src/commands/mcp/mcp-server.ts

@@ -21,6 +21,7 @@ import { registerTools } from './tools/tool-registry';
 export async function createMcpServer(
   context: {
     workspace?: AngularWorkspace;
+    readOnly?: boolean;
   },
   logger: { warn(text: string): void },
 ): Promise<McpServer> {
@@ -63,14 +64,18 @@ export async function createMcpServer(
     },
   );
 
-  const toolDeclarations = [
+  let toolDeclarations = [
     BEST_PRACTICES_TOOL,
     DOC_SEARCH_TOOL,
     LIST_PROJECTS_TOOL,
     MODERNIZE_TOOL,
     FIND_EXAMPLE_TOOL,
   ];
 
+  if (context.readOnly) {
+    toolDeclarations = toolDeclarations.filter((tool) => tool.isReadOnly);
+  }
+
   await registerTools(
     server,
     {