Thin MCP tool adapter that maps approved calls to the authenticated gateway API without bypassing it.