feat(adapters): add mcp_tool_interceptor() to AxonFlowLangGraphAdapter

[gzak]

Summary

Closes #107.

Adds mcp_tool_interceptor() factory method to AxonFlowLangGraphAdapter, returning an async callable ready to pass directly to MultiServerMCPClient:

mcp_client = MultiServerMCPClient(
    {"my-server": {"url": "...", "transport": "http"}},
    tool_interceptors=[adapter.mcp_tool_interceptor()],
)

The method accepts an optional MCPInterceptorOptions object:

opts = MCPInterceptorOptions(
    connector_type_fn=lambda req: req.server_name,
    operation="query",
)
tool_interceptors=[adapter.mcp_tool_interceptor(opts)]

The interceptor enforces AxonFlow input and output policies around every MCP tool call: mcp_check_input → handler() → mcp_check_output.

Design decisions

Redacted output passthrough — when mcp_check_output returns redacted_data, the interceptor substitutes it for the original result rather than discarding it silently:

if output_check.redacted_data is not None:
    return output_check.redacted_data
return result

Pluggable connector type derivation — MCPInterceptorOptions.connector_type_fn overrides the default "{server_name}.{tool_name}" mapping for tenants that key connector types differently.

Configurable operation type — MCPInterceptorOptions.operation is forwarded to mcp_check_input (default: "execute"; set to "query" for known read-only tool calls).

No new runtime dependencies

MCPToolCallRequest from langchain-mcp-adapters is only used for type hints under TYPE_CHECKING. The interceptor duck-types request.server_name, request.name, and request.args at runtime.

Test plan

• 14 new unit tests in tests/test_langgraph_adapter.py:
  • Allowed call returns handler result
  • Default connector type derived as "{server_name}.{tool_name}"
  • Same connector type forwarded to mcp_check_output
  • Default operation is "execute"
  • Custom operation via MCPInterceptorOptions is forwarded
  • Input blocked: raises PolicyViolationError and handler is not called
  • Input blocked with no reason: fallback message used
  • Output blocked: raises PolicyViolationError
  • Output blocked with no reason: fallback message used
  • Redacted output returned in place of original result
  • Original result returned when no redaction
  • Custom connector_type_fn used for both input and output checks
  • Each factory call returns an independent interceptor
• MCPInterceptorOptions and WorkflowApprovalRequiredError exported from axonflow.adapters
• CHANGELOG.md updated with 3.8.0 entry
• Full existing test suite passes (592 tests)