Overview
core-agent-mcp wraps the Internal Agent API into 116 MCP tools (one tool per endpoint), shared by Claude Code during development and by corecms-agent-middleware (Python/FastAPI) at runtime. Because the backend has a single internal API key, the middleware is the ONLY role-based authorization layer (Client/Staff/Manager/Admin): it re-checks permissions on every tool call and never trusts identity parameters generated by the LLM.