Harden ARR MCP tool surface and installer

dev/test_sonarr_release_grab.py

@@ -8,6 +8,7 @@ import sys
 import types
 import unittest
 from pathlib import Path
+from unittest.mock import patch
 
 
 SOURCE = Path(__file__).parents[1] / "platform/mcp/patches/mcp_sonarr.py"
@@ -145,6 +146,50 @@ class ReleaseGrabTests(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(result["results"]["total"], 1)
         self.assertEqual(result["results"]["items"][0]["guid"], "exact-guid")
 
+    def test_read_only_surface_is_explicit_and_has_no_generic_action(self) -> None:
+        class FakeMcp:
+            def __init__(self):
+                self.names = []
+
+            def tool(self, **_kwargs):
+                def decorate(function):
+                    self.names.append(function.__name__)
+                    return function
+                return decorate
+
+        with patch.dict("os.environ", {"ARR_MCP_WRITE": "0"}):
+            mcp = FakeMcp()
+            self.module.register_sonarr_tools(mcp)
+        self.assertEqual(
+            mcp.names,
+            [
+                "sonarr_find_series",
+                "sonarr_get_season_summary",
+                "sonarr_search_releases",
+                "sonarr_system_status",
+            ],
+        )
+        self.assertNotIn("sonarr_action", mcp.names)
+
+    def test_write_tools_are_registered_only_when_enabled(self) -> None:
+        class FakeMcp:
+            def __init__(self):
+                self.names = []
+
+            def tool(self, **_kwargs):
+                def decorate(function):
+                    self.names.append(function.__name__)
+                    return function
+                return decorate
+
+        with patch.dict("os.environ", {"ARR_MCP_WRITE": "1"}):
+            mcp = FakeMcp()
+            self.module.register_sonarr_tools(mcp)
+        self.assertIn("sonarr_preview_release_grab", mcp.names)
+        self.assertIn("sonarr_grab_release", mcp.names)
+        self.assertIn("sonarr_preview_episode_search", mcp.names)
+        self.assertIn("sonarr_start_episode_search", mcp.names)
+
 
 if __name__ == "__main__":
     unittest.main()