#1166 Santa: MCP tools for rules, events and machines Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem osctrl's MCP server has no Santa tools; Workshop offers natural-language questions about hosts, rules and events. Scope • Read-only tools: list rules, list events (filters), list machines, effective rules for a node. • Optional rule create/delete only behind the existing MCP write opt-in. • Delegate through

pkg/apiclient

/ existing API handlers so permissions and audit stay authoritative. • Event fields returned as untrusted model context. Acceptance • Tools follow MCP.md conventions; write tools absent unless writes are enabled. jmpsec/osctrl