declare the MCP path, so the agent gets OpenSEO's own tools

A path, resolved against this Officer, so the agent reaches /api/openseo/mcp
through the same gate as everything else and never the instance directly.

Not wrapped as Officer-native tools: the vocabulary moves upstream, a copy would
go stale, and it fails silently — a tool exists that Officer cannot see.

manifest.ts

@@ -51,6 +51,18 @@ export const manifest: PluginManifest = {
   icon: 'TrendingUp',
   color: '#22c55e',
 
+  /*
+    OpenSEO's own MCP server, handed to the agent as-is.
+
+    A PATH, resolved against this Officer — so the agent reaches `/api/openseo/mcp`, through the same
+    gate as everything else, and never the instance directly. Which matters more here than elsewhere:
+    upstream self-hosts unauthenticated by design, so the proxy is the authentication.
+
+    Not wrapped as Officer-native tools, deliberately. The vocabulary moves upstream; a copy would go
+    stale and fail silently, with a tool existing that Officer cannot see.
+  */
+  mcp: { path: '/mcp' },
+
   permissions: [
     {
       key: 'openseo',