fix(mcp): enforce trusted workspace roots

[cursor]

Bug and impact

The new ClawBench workspace read/write tools accepted a caller-supplied workspace_root. During agent-routed tool calls, a prompt-influenced model could set workspace_root to / or another host directory and read or overwrite files outside the intended task workspace. The write path could truncate repo/config files accessible to the MCP process.

Root cause

MultiMCP.route_tool_call() only used setdefault("workspace_root", trace_context["workspace"]), so untrusted tool arguments took precedence over the trusted trace workspace. Direct MultiMCP.call_tool() also forwarded caller roots unchanged.

Fix

• Added a common MCP argument preparation boundary for workspace file tools.
• Always override workspace_root with the trusted trace workspace when present.
• Strip caller-provided workspace_root when no trusted trace workspace exists.
• Added regression tests for traced routed calls and direct calls without trace context.

Validation

• python3 -m unittest tests.test_multi_mcp_modes -v
• python3 -m pytest tests/test_multi_mcp_modes.py tests/test_mockehr_mcp.py -q