feat(mcp): add Streamable HTTP screenshot generation tool

[FenjuFu]

Summary

• add an optional loopback-only Streamable HTTP MCP v2 server with one generate_code_from_screenshot tool
• reuse the existing parameter extraction, prompt creation, model selection, and agentic generation stages instead of maintaining a second generation path
• run one selected model variant per tool call to bound latency and provider cost
• validate local raster screenshots, instruction/design-system sizes, tool schema, and safe opt-in defaults for image generation and asset extraction
• document Astron Agent and other MCP client setup, including the unauthenticated loopback boundary
• add seven offline tests and the minimal FastAPI/Uvicorn compatibility updates required by the current MCP SDK

Validation

• uvx poetry run pytest -q — 283 passed
• uvx poetry run pyright — 0 errors; 36 existing warnings in unchanged files
• uvx poetry run pyright mcp_server.py tests/test_mcp_server.py agent/providers/gemini.py — 0 errors, 0 warnings
• official MCP v2 client connected over Streamable HTTP and discovered generate_code_from_screenshot
• git diff --cached --check

No live model generation was run, so validation did not consume provider quota.

Closes #521

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​uvicorn@​0.25.0 ⏵ 0.31.1
	pypi/​mcp@​2.1.1
	pypi/​pydantic@​2.10.4 ⏵ 2.13.5	+1
	pypi/​fastapi@​0.115.6 ⏵ 0.116.2	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: pypi pycparser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/poetry.lock → pypi/mcp@2.1.1 → pypi/uvicorn@0.31.1 → pypi/pycparser@3.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/pycparser@3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi pycparser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/poetry.lock → pypi/mcp@2.1.1 → pypi/uvicorn@0.31.1 → pypi/pycparser@3.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/pycparser@3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report