Expose the grounded pipeline as an MCP server with the same guards

[ChelseaKR]

What

Assistants and agents call tools, and a plant-care tool answered by an ungrounded model is the failure Sprout exists to prevent. Add sprout mcp (stdio transport, offline by default, optional extra): tools ask, toxicity_check, and identify, each returning the same structured Answer payload the JSON API returns (sentences, citations with fetch dates, confidence band, refusal reason, escalation card) and never free text without a source. The output guard runs on every tool result. Nothing is persisted.

Add --target mcp to sprout eval so all suites run through the MCP boundary, and the report names the target so a reader can see the numbers came through the tool surface rather than in-process.

Why it matters

The value of Sprout is the contract, not the chat. An MCP surface lets a household assistant or a vet clinic's agent use the cited pipeline while the contract holds; evaluating through the boundary is what proves the boundary did not weaken it (the same reason plumbline-live.sh exists in cairn).

Scope

• Server module, tool schemas mirroring models.py, pyproject extra, docs.
• Eval target implementation via the plugin API (ADR-0019).
• Structured logging through obs.py, PII-free.

Out of scope

• Remote transports or auth (loopback stdio only).
• Reminders or Family Greenhouse data over MCP.

Done when

• sprout eval --target mcp byte-matches the in-process report's verdicts and scores.
• A tool call for an out-of-corpus species returns a refusal object with the routing line, not prose.
• A test proves no tool result can contain a certification string.
• The server starts and answers with the network blocked.

Pointers

• src/sprout/server.py, src/sprout/answer.py, src/sprout/models.py, src/sprout/guards.py, src/sprout/eval/runner.py, docs/adr/0019

Proposed with AI assistance.

[ChelseaKR]

Triage against origin/main (b24f12d): unbuilt, premise intact, automatable.

Verified: no MCP surface anywhere in src/sprout/. The pieces it would compose all exist — answer.py, models.py, guards.py, server.py's JSON shapes, the eval plugin API (ADR-0019), and obs.py.

Assessment: buildable, no owner decisions. Scoped to stdio on loopback with remote transports and auth explicitly out, this needs no credential, no network, and no product call. The acceptance bullets are all checkable offline, including "the server starts and answers with the network blocked".

The bullet that carries the argument, and the one to build first: "sprout eval --target mcp byte-matches the in-process report's verdicts and scores." Evaluating through the boundary is the only thing that proves the boundary did not weaken the contract; without it this is a second surface that has to be trusted rather than measured. It is also the same shape as the cross-language conformance suite already in web-static-test, so the pattern is established in this repository.

And the one that must not be softened: "A test proves no tool result can contain a certification string." An MCP tool result is consumed by another model, which will paraphrase it. The output guard has to run on every tool result — including error and refusal objects, which are the easiest path to forget.

One design note. "A tool call for an out-of-corpus species returns a refusal object with the routing line, not prose" is right, and it is worth making the refusal a distinct schema rather than a text field containing a refusal sentence. A calling agent that receives prose will summarise it; one that receives a typed refusal cannot.

Not started this pass. Left open.

Triaged with AI assistance; premises checked against origin/main.