Summary

Once user identity extraction from headers is proven (RHCLOUD-45377), implement MCP tools for all remaining RBAC GET endpoints. This completes the read-only tool surface for Phase 1.

Details

Each existing GET endpoint in the RBAC API should be exposed as an individual MCP tool. All tools must be read-only and scoped to the authenticated user's identity.

Acceptance Criteria

• All existing RBAC GET endpoints are exposed as MCP tools.
• All tools return user-scoped data based on the identity extracted from headers.
• No write operations are exposed.
• Tools are discoverable by the HCC AI agent service.